YRP/Borland YRP/powershell YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/RE_Tools YRP/Antivirus YRP/VM_Generic_Detection YRP/VMWare_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/vmdetect YRP/WMI_VM_Detect YRP/anti_dbgtools YRP/network_tcp_listen YRP/network_dyndns YRP/network_dropper YRP/network_tcp_socket YRP/spreading_file YRP/rat_rdp YRP/win_mutex YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter YRP/Big_Numbers0 YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/TEAN YRP/spyeye YRP/spyeye_plugins YRP/GEN_PowerShell YRP/Str_Win32_Winsock2_Library YRP/SurtrStrings YRP/Surtr YRP/nAspyUpdateStrings YRP/nAspyUpdate YRP/Mimikatz_Memory_Rule_1 YRP/REDLEAVES_CoreImplant_UniqueStrings YRP/Ham_backdoor YRP/Tofu_Backdoor YRP/fin7_functions FlorianRoth/Tofu_Backdoor FlorianRoth/REDLEAVES_CoreImplant_UniqueStrings FlorianRoth/Msfpayloads_msf_psh

YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/ThreadControl__Context YRP/SEH__vectored YRP/vmdetect YRP/anti_dbg YRP/antisb_threatExpert YRP/hijack_network YRP/network_tcp_listen YRP/network_dyndns YRP/network_dropper YRP/bitcoin YRP/screenshot YRP/keylogger YRP/spreading_file YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter YRP/Big_Numbers1 YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/Tofu_Backdoor FlorianRoth/PowerShell_Susp_Parameter_Combo FlorianRoth/Recon_Commands_Windows_Gen1 FlorianRoth/Tofu_Backdoor